Trojaner-Board - troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen (https://www.trojaner-board.de/144737-troj-zbotmem-b-sophos-quarantaene-nur-manuell-bereinigen.html)

troj/zbotmem-b in der Sophos Quarantaene und nur manuell zu bereinigen

Hallo und guten Abend,

ich habe seit ein paar Tagen einen Trojaner in der Sophos Quarantaene und hoffe ich kann hier Hilfe oder Infos erhalten. Sophos kam mit dem kleinen 'Bedrohung' Fenster und packte den Trojaner troj / zbotmem-b sofort in die Quarantaene und der ist dort nun nur 'manuell zu beseitigen'.
Am Laptop gab's sonst keine Symptome und alles klappt wie gehabt inklusive hochfahren.

Ich habe Windows 7 Home Premium, Service Pack 1, 64-bit, der Laptop ist in UK gekauft falls das was ausmacht (daher auch das Fehlen der Umlaute - sorry).

Was ich bis jetzt schon unternommen habe ist ein malwarebytes download. Habe ich in den letzten Tagen mehrmals durchlaufen lassen jeweils immer ohne Funde, Logdateien existieren noch.

Ich hoffe, ich habe sonst an infos nichts vergessen. Die downloads habe ich gemacht und Logdateien sind vorhanden. Als ich vorm Starten von Gmer allerdings Sophos abstellen wollte, kam die Warnung dass dann auch in der Quarantaene befindliche Objekte nicht mehr unter Beobachtung stehen... und deshalb brach ich erstmal ab, weil ich mir nicht sicher bin inwieweit das ein Risiko ist bzw. ob das so ok ist.

Die kleine defogger txt ist auch mit bei, an malwarebytes logfiles habe ich insgesamt 4 aus den letzten paar Tagen - ich poste den letzten vollstaendigen Suchlauf vom 16.11.

defogger

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 15:19 on 17/11/2013 (cs)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...
 
 

-=E.O.F=-

frst

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02

Ran by cs (administrator) on TOSHIBA on 17-11-2013 15:40:36

Running from C:\Users\cs\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe

(Conexant Systems Inc.) C:\windows\system32\CxAudMsg64.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe

(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe

(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\IEXPLORE.EXE

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Adobe Systems Incorporated) C:\windows\system32\Macromed\Flash\FlashUtil64_11_9_900_152_ActiveX.exe

() C:\Users\cs\Downloads\Defogger.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [] - [x]

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SACpl.exe [1654400 2012-02-22] (Conexant Systems, Inc.)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223180 2012-03-22] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)

HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [378968 2011-12-21] (Alcor Micro Corp.)

HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [590256 2011-09-23] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon

HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] - C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)

HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [150992 2012-05-11] (Toshiba Europe GmbH)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)

HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-12] (TOSHIBA Corporation)

HKLM-x32\...\Run: [TSleepSrv] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [253312 2011-11-21] (TOSHIBA)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [900160 2012-07-06] (Sophos Limited)

HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [623888 2009-05-12] (Research In Motion Limited)

HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)

HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)

AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [218256 2013-09-16] (Sophos Limited)

AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL [221840 2013-09-16] (Sophos Limited)

Startup: C:\Users\cs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)

Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk

ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ixquick.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - DefaultScope {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 

SearchScopes: HKCU - {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\cs\AppData\Roaming\Mozilla\Firefox\Profiles\qs20zjet.default

FF Homepage: hxxp://www.ixquick.com/

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
 

==================== Services (Whitelisted) =================
 

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [216640 2012-11-12] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [139840 2012-06-15] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [232512 2012-07-06] (Sophos Limited)

R2 Sophos Client Firewall; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe [89112 2011-10-19] (Sophos Limited)

R2 Sophos Client Firewall Manager; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe [150552 2011-10-19] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2869824 2012-11-12] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [1998400 2012-11-12] (Sophos Limited)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-05-20] (Research In Motion Limited)

R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [144672 2012-04-24] (Sophos Limited)

R1 scfdriver; C:\windows\system32\Drivers\scfdriver.sys [102688 2011-08-25] (Sophos Limited)

R1 scfndis; C:\Windows\System32\DRIVERS\scfndis.sys [55072 2011-08-25] (Sophos Limited)

R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2011-08-25] (Sophos Plc)

S3 Tosrfcom; No ImagePath
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-17 15:40 - 2013-11-17 15:41 - 00017975 _____ C:\Users\cs\Downloads\FRST.txt

2013-11-17 15:40 - 2013-11-17 15:40 - 00000000 ____D C:\FRST

2013-11-17 15:37 - 2013-11-17 15:39 - 01958026 _____ (Farbar) C:\Users\cs\Downloads\FRST64.exe

2013-11-17 15:19 - 2013-11-17 15:19 - 00000466 _____ C:\Users\cs\Desktop\defogger_disable.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 _____ C:\Users\cs\defogger_reenable

2013-11-17 15:14 - 2013-11-17 15:15 - 00050477 _____ C:\Users\cs\Desktop\Defogger.exe

2013-11-17 15:09 - 2013-11-17 15:10 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt

2013-11-17 14:53 - 2013-11-17 15:09 - 00000750 _____ C:\Users\cs\Desktop\TrPost.txt

2013-11-17 13:49 - 2013-11-17 13:49 - 00000056 _____ C:\windows\setupact.log

2013-11-17 13:49 - 2013-11-17 13:49 - 00000000 _____ C:\windows\setuperr.log

2013-11-17 06:25 - 2013-11-17 06:26 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-17 06:23 - 2013-11-17 06:24 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe

2013-11-17 06:06 - 2013-11-17 14:54 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-11-17 06:06 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-15 16:32 - 2013-11-16 14:24 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-15 16:31 - 2013-11-16 13:14 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-11-15 16:28 - 2013-11-16 14:24 - 00000000 ____D C:\Users\cs\Desktop\mbar

2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe

2013-11-15 13:45 - 2013-11-15 15:46 - 00015372 _____ C:\Users\cs\Desktop\Charts241113.txt

2013-11-14 15:31 - 2013-10-12 08:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-11-14 15:31 - 2013-10-12 08:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-11-14 15:31 - 2013-10-12 08:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-11-14 15:31 - 2013-10-12 08:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-11-14 15:31 - 2013-10-12 07:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-11-14 15:31 - 2013-10-12 07:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-11-14 15:31 - 2013-10-12 06:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-11-14 15:31 - 2013-10-12 06:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-11-14 15:31 - 2013-10-12 05:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-11-14 15:31 - 2013-10-12 05:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-14 14:10 - 2013-10-05 20:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-14 14:10 - 2013-10-05 19:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-14 14:09 - 2013-10-03 02:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-14 14:09 - 2013-10-03 02:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-14 14:09 - 2013-09-28 01:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-14 14:09 - 2013-09-25 02:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2013-11-14 14:09 - 2013-09-25 02:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2013-11-14 14:09 - 2013-09-25 02:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2013-11-14 14:09 - 2013-09-25 02:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2013-11-14 14:09 - 2013-09-25 02:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2013-11-14 14:09 - 2013-09-25 02:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-14 14:09 - 2013-09-25 02:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2013-11-14 14:09 - 2013-09-25 02:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2013-11-14 14:09 - 2013-09-25 01:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2013-11-14 14:09 - 2013-09-25 01:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-14 14:09 - 2013-09-25 01:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2013-11-14 14:09 - 2013-09-25 01:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2013-11-14 14:09 - 2013-09-25 01:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2013-11-14 14:09 - 2013-07-04 12:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2013-11-14 14:07 - 2013-10-04 02:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll

2013-11-14 14:07 - 2013-10-04 02:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll

2013-11-14 14:07 - 2013-10-04 02:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-14 14:07 - 2013-10-04 01:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-14 14:07 - 2013-10-04 01:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-14 14:07 - 2013-10-04 01:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll

2013-11-14 14:06 - 2013-10-12 02:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll

2013-11-14 14:06 - 2013-10-12 02:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-14 14:06 - 2013-10-12 02:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL

2013-11-14 14:06 - 2013-10-12 02:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll

2013-11-14 14:06 - 2013-10-12 02:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL

2013-11-09 14:59 - 2013-11-09 15:14 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

2013-11-09 14:59 - 2013-11-09 14:59 - 00000000 ____D C:\Users\cs\AppData\Roaming\Ydob

2013-10-31 07:14 - 2013-10-31 07:14 - 00000000 ____D C:\Users\cs\AppData\Local\{C18C4B25-6152-4536-A69E-90F9FCC9DC86}

2013-10-24 18:16 - 2013-09-04 12:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
 

==================== One Month Modified Files and Folders =======
 

2013-11-17 15:41 - 2013-11-17 15:40 - 00017975 _____ C:\Users\cs\Downloads\FRST.txt

2013-11-17 15:40 - 2013-11-17 15:40 - 00000000 ____D C:\FRST

2013-11-17 15:39 - 2013-11-17 15:37 - 01958026 _____ (Farbar) C:\Users\cs\Downloads\FRST64.exe

2013-11-17 15:36 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-17 15:36 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-17 15:25 - 2012-07-28 09:20 - 01931170 _____ C:\windows\WindowsUpdate.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000466 _____ C:\Users\cs\Desktop\defogger_disable.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 _____ C:\Users\cs\defogger_reenable

2013-11-17 15:19 - 2012-09-23 13:09 - 00000000 ____D C:\Users\cs

2013-11-17 15:15 - 2013-11-17 15:14 - 00050477 _____ C:\Users\cs\Desktop\Defogger.exe

2013-11-17 15:10 - 2013-11-17 15:09 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt

2013-11-17 15:09 - 2013-11-17 14:53 - 00000750 _____ C:\Users\cs\Desktop\TrPost.txt

2013-11-17 14:54 - 2013-11-17 06:06 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-11-17 14:50 - 2012-10-01 04:47 - 00000000 ____D C:\__Chr

2013-11-17 14:03 - 2012-07-28 09:25 - 00000828 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

2013-11-17 14:02 - 2013-10-05 06:47 - 00000000 _____ C:\windows\system32\vireng.log

2013-11-17 14:02 - 2013-03-15 22:50 - 00000334 _____ C:\windows\Tasks\dsmonitor.job

2013-11-17 13:50 - 2012-09-23 15:10 - 00000142 _____ C:\windows\ODBC.INI

2013-11-17 13:50 - 2009-07-14 05:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-11-17 13:49 - 2013-11-17 13:49 - 00000056 _____ C:\windows\setupact.log

2013-11-17 13:49 - 2013-11-17 13:49 - 00000000 _____ C:\windows\setuperr.log

2013-11-17 06:26 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-17 06:24 - 2013-11-17 06:23 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe

2013-11-17 06:06 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-17 06:06 - 2012-09-23 14:19 - 00000000 ____D C:\Users\cs\AppData\Local\Adobe

2013-11-17 06:06 - 2012-05-10 23:59 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-17 06:06 - 2012-05-10 23:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-11-16 15:55 - 2012-07-28 09:25 - 00000830 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

2013-11-16 14:24 - 2013-11-15 16:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-16 14:24 - 2013-11-15 16:28 - 00000000 ____D C:\Users\cs\Desktop\mbar

2013-11-16 13:14 - 2013-11-15 16:31 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-11-16 11:28 - 2009-07-14 05:08 - 00032620 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe

2013-11-15 15:46 - 2013-11-15 13:45 - 00015372 _____ C:\Users\cs\Desktop\Charts241113.txt

2013-11-15 13:35 - 2012-05-11 08:24 - 00000000 ____D C:\windows\Panther

2013-11-14 15:31 - 2012-10-18 18:54 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-09 17:39 - 2012-09-23 13:09 - 00000000 ___RD C:\Users\cs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\SysWOW64\Macromed

2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\system32\Macromed

2013-11-09 17:39 - 2010-11-21 07:16 - 00000000 ___RD C:\Users\Public\Recorded TV

2013-11-09 17:39 - 2009-07-14 03:20 - 00000000 ____D C:\windows\registration

2013-11-09 15:14 - 2013-11-09 14:59 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

2013-11-09 14:59 - 2013-11-09 14:59 - 00000000 ____D C:\Users\cs\AppData\Roaming\Ydob

2013-11-09 13:46 - 2013-02-14 20:04 - 00111536 _____ C:\Users\cs\Desktop\Trial.txt

2013-11-06 20:14 - 2012-11-16 10:12 - 00000000 ____D C:\Users\cs\AppData\Local\CutePDF Writer

2013-11-04 07:50 - 2012-09-23 15:52 - 00009189 _____ C:\Users\cs\Desktop\Notes.txt

2013-11-02 10:09 - 2009-07-14 05:13 - 00726444 _____ C:\windows\system32\PerfStringBackup.INI

2013-10-31 07:14 - 2013-10-31 07:14 - 00000000 ____D C:\Users\cs\AppData\Local\{C18C4B25-6152-4536-A69E-90F9FCC9DC86}
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-25 18:31
 

==================== End Of Log ============================

addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2013 02

Ran by cs at 2013-11-17 15:41:35

Running from C:\Users\cs\Downloads

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}

FW: Sophos Client Firewall (Enabled) {5DC05945-DCB7-74B7-ECB2-D2D780BF0EF1}
 

==================== Installed Programs ======================
 

ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)

Adobe AIR (x32 Version: 2.0.3.13070)

Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.152)

Adobe Reader X (10.1.0) MUI (x32 Version: 10.1.0)

Alcor Micro USB Card Reader (x32 Version: 4.3.17.00279)

Atheros Bluetooth Filter Driver Package (Version: 1.0.0.12)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13)

Atheros Driver Installation Program (x32 Version: 9.2)

BBC iPlayer Desktop (x32 Version: 3.0.7)

BlackBerry Desktop Software 5.0 (x32 Version: 5.0.0.8)

BlackBerry® Media Sync (x32 Version: 2.0.20)

Bluetooth Stack for Windows by Toshiba (Version: v9.00.00(T))

CCleaner (Version: 3.22)

Conexant HD Audio (Version: 8.51.2.64)

CutePDF Writer 3.0 (Version:  3.0)

D3DX10 (x32 Version: 15.4.2368.0902)

DivX Setup (x32 Version: 2.6.1.24)

DriverScanner (x32 Version: 4.0.10.0)

High-Definition Video Playback (x32 Version: 11.1.10500.2.65)

Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.35342)

Intel(R) Management Engine Components (x32 Version: 8.0.4.1441)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2752)

Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)

Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)

Intel® Trusted Connect Service Client (Version: 1.23.605.1)

Java Auto Updater (x32 Version: 2.0.6.1)

Java(TM) 6 Update 30 (x32 Version: 6.0.300)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Mesh Runtime (x32 Version: 15.4.5722.2)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office 2007 Service Pack 3 (SP3) (x32)

Microsoft Office 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Silverlight (Version: 5.1.20913.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox 25.0.1 (x86 en-US) (x32 Version: 25.0.1)

Mozilla Maintenance Service (x32 Version: 25.0.1)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)

MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)

MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)

Nero 11 Essentials (x32 Version: 11.0.00300)

Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0)

Nero BackItUp 11 (x32 Version: 6.0.18000.19.100)

Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200)

Nero Backup Drivers (Version: 1.0.11100.8.0)

Nero BurnRights 11 (x32 Version: 5.0.10300.4.100)

Nero BurnRights 11 Help (CHM) (x32 Version: 11.0.10100)

Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27)

Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300)

Nero Core Components 11 (x32 Version: 11.0.15500.1.16)

Nero Express 11 (x32 Version: 11.0.11900.24.100)

Nero Express 11 Help (CHM) (x32 Version: 11.0.10300)

Nero Kwik Media (x32 Version: 1.10.24800.146.100)

Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200)

Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100)

Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400)

Nero Update (x32 Version: 11.0.11400.27.0)

nero.prerequisites.msi (x32 Version: 11.0.20008)

PlayReady PC Runtime amd64 (Version: 1.3.0)

Premium Sound HD (Version: 1.12.1800)

Skype™ 5.10 (x32 Version: 5.10.116)

Sophos Anti-Virus (x32 Version: 10.0.11)

Sophos AutoUpdate (x32 Version: 2.7.4.317)

Sophos Client Firewall (x32 Version: 2.9.1)

Synaptics Pointing Device Driver (Version: 15.3.39.0)

TOSHIBA Assist (x32 Version: 4.2.3.1)

TOSHIBA Disc Creator (Version: 2.1.0.11 for x64)

TOSHIBA eco Utility (Version: 1.3.10.64)

TOSHIBA Hardware Setup (Version: 4.11.03.00)

TOSHIBA Hardware Setup (x32 Version: 4.11.03.00)

TOSHIBA HDD Protection (Version: 2.2.2.15)

TOSHIBA HDD/SSD Alert (Version: 3.1.64.11)

Toshiba Manuals (x32 Version: 10.04)

TOSHIBA Media Controller (x32 Version: 1.0.87.5)

TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.7)

TOSHIBA Online Product Information (x32 Version: 4.02.0000)

TOSHIBA PC Health Monitor (Version: 1.7.15.64)

TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4)

TOSHIBA Recovery Media Creator (x32 Version: 2.1.6.52020009)

TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.1.0.0)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2004)

TOSHIBA Service Station (x32 Version: 2.2.13)

TOSHIBA Sleep Utility (x32 Version: 1.4.0022.000104)

TOSHIBA Supervisor Password (Version: 4.11.03.00)

TOSHIBA Supervisor Password (x32 Version: 4.11.03.00)

TOSHIBA TEMPRO (x32 Version: 3.35)

TOSHIBA Value Added Package (Version: 1.6.0021.640203)

TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203)

TOSHIBA Web Camera Application (x32 Version: 2.0.3.35)

Update for 2007 Microsoft Office System (KB967642) (x32)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)

Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)

Update for Microsoft Office Access 2007 Help (KB963663) (x32)

Update for Microsoft Office Excel 2007 Help (KB963678) (x32)

Update for Microsoft Office Infopath 2007 Help (KB963662) (x32)

Update for Microsoft Office OneNote 2007 Help (KB963670) (x32)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 Help (KB963677) (x32)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825642) 32-Bit Edition (x32)

Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)

Update for Microsoft Office Publisher 2007 Help (KB963667) (x32)

Update for Microsoft Office Script Editor Help (KB963671) (x32)

Update for Microsoft Office Word 2007 Help (KB963665) (x32)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)

welcome (x32 Version: 11.0.22500.0.0)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3538.0513)

Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3538.0513)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Mesh (x32 Version: 15.4.3502.0922)

Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)

Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)

Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)

Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)

Windows Live Messenger (x32 Version: 15.4.3538.0513)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)

Windows Liven sähköposti (x32 Version: 15.4.3502.0922)

Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
 

==================== Restore Points  =========================
 

18-09-2013 06:28:52 Windows Update

21-09-2013 06:44:06 Windows Update

25-09-2013 06:36:28 Windows Update

28-09-2013 07:10:35 Windows Update

05-10-2013 05:05:39 Windows Update

08-10-2013 07:19:38 Windows Update

10-10-2013 20:17:16 Windows Update

18-10-2013 08:00:36 Windows Update

23-10-2013 17:44:55 Windows Update

24-10-2013 20:53:19 Windows Update

01-11-2013 15:20:43 Windows Update

06-11-2013 05:51:18 Windows Update

09-11-2013 17:36:55 Restore Operation

14-11-2013 14:02:43 Windows Update

14-11-2013 15:28:02 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 02:34 - 2009-06-10 21:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {1932333D-E3F0-4C3D-9012-69351C5D5959} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)

Task: {2637A22B-A305-4ED3-8BEE-306F884768CE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-17] (Adobe Systems Incorporated)

Task: {3361ED9C-34B6-4601-9F05-C9D838436073} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

Task: {95D15B3C-4FD9-4959-B637-4E815555DDC1} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)

Task: {9808B527-93CE-46CA-8F78-15D0D67186DF} - System32\Tasks\dsmonitor => C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2013-01-16] (Uniblue Systems Ltd)

Task: {BBB2122A-84F7-468F-BD07-34C8008A38E3} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)

Task: {FF1D667B-2D0A-4870-B8E5-454E9D3B039D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-08-22] (Piriform Ltd)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\dsmonitor.job => C:\Program Files (x86)\Uniblue\DriverScanner\dsmonitor.exe

Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-08-22 22:19 - 2011-08-22 22:19 - 11204992 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll

2010-12-15 22:19 - 2010-12-15 22:19 - 00124320 _____ () C:\Program Files\Toshiba\TECO\MUIHelp.dll

2012-03-27 00:33 - 2012-03-27 00:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-05-11 00:25 - 2011-12-15 13:55 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll

2011-11-26 01:51 - 2011-11-26 01:51 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll

2013-02-13 02:38 - 2013-02-13 02:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

2012-07-28 09:25 - 2012-03-06 22:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos Client Firewall => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos Client Firewall Manager => ""="service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (11/17/2013 03:14:34 PM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (11/17/2013 02:04:17 PM) (Source: Windows Search Service) (User: )

Description: The index cannot be initialized.
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (11/17/2013 02:04:17 PM) (Source: Windows Search Service) (User: )

Description: The application cannot be initialized.
 

Context: Windows Application
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (11/17/2013 02:04:17 PM) (Source: Windows Search Service) (User: )

Description: The gatherer object cannot be initialized.
 

Context: Windows Application, SystemIndex Catalog
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (11/17/2013 02:04:17 PM) (Source: Windows Search Service) (User: )

Description: The plug-in in <Search.TripoliIndexer> cannot be initialized.
 

Context: Windows Application, SystemIndex Catalog
 
 

Details:

        Element not found.  (HRESULT : 0x80070490) (0x80070490)
 

Error: (11/17/2013 02:04:16 PM) (Source: Windows Search Service) (User: )

Description: The plug-in in <Search.JetPropStore> cannot be initialized.
 

Context: Windows Application, SystemIndex Catalog
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (11/17/2013 02:04:16 PM) (Source: Windows Search Service) (User: )

Description: The Windows Search Service cannot load the property store information.
 

Context: Windows Application, SystemIndex Catalog
 
 

Details:

        The content index database is corrupt.  (HRESULT : 0xc0041800) (0xc0041800)
 

Error: (11/17/2013 02:04:16 PM) (Source: Windows Search Service) (User: )

Description: The Windows Search Service is being stopped because there is a problem with the indexer: The catalog is corrupt.
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (11/17/2013 02:04:16 PM) (Source: Windows Search Service) (User: )

Description: The search service has detected corrupted data files in the index {id=4700}. The service will attempt to automatically correct this problem by rebuilding the index.
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 

Error: (11/17/2013 02:04:16 PM) (Source: Windows Search Service) (User: )

Description: The Windows Search Service cannot open the Jet property store.
 
 

Details:

        0x%08x (0xc0041800 - The content index database is corrupt.  (HRESULT : 0xc0041800))
 
 

System errors:

=============

Error: (11/17/2013 02:05:01 PM) (Source: Service Control Manager) (User: )

Description: The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: 

%%1056
 

Error: (11/17/2013 02:04:57 PM) (Source: Service Control Manager) (User: )

Description: The Windows Search service failed to start due to the following error: 

%%1053
 

Error: (11/17/2013 02:04:57 PM) (Source: Service Control Manager) (User: )

Description: A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
 

Error: (11/17/2013 02:04:57 PM) (Source: DCOM) (User: )

Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 

Error: (11/17/2013 02:04:28 PM) (Source: Service Control Manager) (User: )

Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 

Error: (11/17/2013 02:04:17 PM) (Source: Service Control Manager) (User: )

Description: The Windows Search service terminated with service-specific error %%-1073473535.
 

Error: (11/17/2013 02:02:34 PM) (Source: SAVOnAccess) (User: )

Description: File [...48341C277FE5110E7DFAA91377DC_9C4208B8708E743F02200AC05A80C9C4]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process svchost.exe, (start check timestamp [ 1cee39daa4bf37d]).
 

Error: (11/17/2013 02:02:34 PM) (Source: SAVOnAccess) (User: )

Description: File [...48341C277FE5110E7DFAA91377DC_97E680C972C18127C6538B8DA7975803]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process svchost.exe, (start check timestamp [ 1cee39daa49921d]).
 

Error: (11/17/2013 02:02:34 PM) (Source: SAVOnAccess) (User: )

Description: File [...\Device\HarddiskVolume2\Windows\SysWOW64\credssp.dll]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process mbamservice.ex, (start check timestamp [ 1cee39d6a092d77]).
 

Error: (11/17/2013 02:02:34 PM) (Source: SAVOnAccess) (User: )

Description: File [...Program Files (x86)\Sophos\Sophos Client Firewall\op_data.ini]'s scan succeeded following a timeout/busy condition - it is being logged in case it contributed to that condition. Process SCFService.exe, (start check timestamp [ 1cee39c40a803fc]).
 
 

Microsoft Office Sessions:

=========================
 

==================== Memory info =========================== 
 

Percentage of memory in use: 55%

Total physical RAM: 3996.36 MB

Available physical RAM: 1775.47 MB

Total Pagefile: 7990.9 MB

Available Pagefile: 5215.27 MB

Total Virtual: 8192 MB

Available Virtual: 8191.8 MB
 

==================== Drives ================================
 

Drive c: (TI30878800B) (Fixed) (Total:448.8 GB) (Free:344.8 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: DEC2C14C)

Partition 1: (Active) - (Size=1 GB) - (Type=27)

Partition 2: (Not Active) - (Size=449 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=15 GB) - (Type=17)
 

==================== End Of Log ============================

malwarebytes

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.11.15.07
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16736

cs :: TOSHIBA [Administrator]
 

Schutz: Aktiviert
 

16/11/2013 14:27:02

mbam-log-2013-11-16 (14-27-02).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 341755

Laufzeit: 1 Stunde(n), 10 Minute(n), 5 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

vielen dank im voraus!

hi,

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

hallo Schrauber, danke fuer die schnelle Antwort. die nachricht mit dem registrierungsschluessel kam nach dem neustart nicht. lief alles ganz normal.

hier das combofix logfile

Code:

ComboFix 13-11-16.01 - cs 17/11/2013  18:02:40.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.44.1033.18.3996.2256 [GMT 0:00]

Running from: c:\users\cs\Desktop\ComboFix.exe

AV: Sophos Anti-Virus *Disabled/Updated* {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

FW: Sophos Client Firewall *Enabled* {5DC05945-DCB7-74B7-ECB2-D2D780BF0EF1}

SP: Sophos Anti-Virus *Disabled/Updated* {DE9A3984-B0E2-7A61-FD5D-409005EB0337}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

 * Created a new restore point

.

.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe

c:\programdata\Toshiba

c:\programdata\Toshiba\IEFavIcon\Amazon.ico

c:\programdata\Toshiba\IEFavIcon\eBay.ico

c:\programdata\Toshiba\IEFavIcon\Javari.ico

c:\programdata\Toshiba\IEFavIcon\Toshiba.ico

c:\programdata\Toshiba\IEFavIcon\TP.ico

c:\programdata\Toshiba\IEFavIcon\tradera.ico

c:\programdata\Toshiba\IEFavIcon\WildTangent.ico

c:\users\cs\AppData\Roaming\Toshiba

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\1.xml

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\0.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\1.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\2.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\3.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\4.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\5.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\1\Icons\music.png

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\dynamicicon.xml

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\News\News_Of_Place2\8098\Content\en\css\styles.css

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\News\News_Of_Place2\8098\Content\en\img\Thumbs.db

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\News\News_Of_Place2\8098\Content\en\img\UK_Dynamic-Icon_HungerGames.png

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\News\News_Of_Place2\8098\Content\en\index.html

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\News\News_Of_Place2\8098\Content\en\js\scripts.js

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\News\News_Of_Place2\8098_News-en-GB.zip

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB.zip

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Content\css\styles.css

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Content\en\css\styles.css

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Content\en\index.html

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\0.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\1.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\2.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\3.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\4.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\5.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\logo.png

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1199_Place-en-GB\Icons\Thumbs.db

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB.zip

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Content\css\styles.css

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Content\en\index.html

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\0.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\1.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\2.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\3.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\4.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\5.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1205_Place-en-GB\Icons\logo.png

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB.zip

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Content\css\styles.css

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Content\en\index.html

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\0.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\1.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\2.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\3.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\4.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\5.ico

c:\users\cs\AppData\Roaming\Toshiba\DynamicIcon\update\Places\1253_Place-en-GB\Icons\logo.png

c:\users\cs\AppData\Roaming\Ydob

c:\users\cs\AppData\Roaming\Ydob\ityqo.efw

.

.

(((((((((((((((((((((((((   Files Created from 2013-10-17 to 2013-11-17  )))))))))))))))))))))))))))))))

.

.

2013-11-17 18:09 . 2013-11-17 18:09        --------        d-----w-        c:\users\Default\AppData\Local\temp

2013-11-17 18:05 . 2013-11-17 18:05        75888        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{80BFE590-54A7-4C25-BBD1-A27F0A5DB515}\offreg.dll

2013-11-17 15:40 . 2013-11-17 15:40        --------        d-----w-        C:\FRST

2013-11-17 06:25 . 2013-11-17 06:25        --------        d-----w-        c:\users\cs\AppData\Local\Mozilla

2013-11-17 06:25 . 2013-11-17 06:25        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service

2013-11-15 16:32 . 2013-11-16 14:24        --------        d-----w-        c:\programdata\Malwarebytes' Anti-Malware (portable)

2013-11-15 16:31 . 2013-11-16 13:14        91352        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2013-11-15 13:07 . 2013-10-14 07:12        10280728        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{80BFE590-54A7-4C25-BBD1-A27F0A5DB515}\mpengine.dll

2013-11-14 14:57 . 2013-11-14 14:57        --------        d-----w-        c:\users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 . 2013-11-14 14:57        --------        d-----w-        c:\programdata\Malwarebytes

2013-11-14 14:57 . 2013-04-04 14:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-11-14 14:57 . 2013-11-14 14:57        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:56 . 2013-11-14 14:56        --------        d-----w-        c:\users\cs\AppData\Local\Programs

2013-11-14 14:10 . 2013-10-05 20:25        1474048        ----a-w-        c:\windows\system32\crypt32.dll

2013-11-14 14:10 . 2013-10-05 19:57        1168384        ----a-w-        c:\windows\SysWow64\crypt32.dll

2013-11-14 14:07 . 2013-10-04 02:24        1930752        ----a-w-        c:\windows\system32\authui.dll

2013-11-14 14:07 . 2013-10-04 02:28        190464        ----a-w-        c:\windows\system32\SmartcardCredentialProvider.dll

2013-11-14 14:07 . 2013-10-04 02:25        197120        ----a-w-        c:\windows\system32\credui.dll

2013-11-14 14:07 . 2013-10-04 01:56        1796096        ----a-w-        c:\windows\SysWow64\authui.dll

2013-11-14 14:07 . 2013-10-04 01:58        152576        ----a-w-        c:\windows\SysWow64\SmartcardCredentialProvider.dll

2013-11-14 14:07 . 2013-10-04 01:56        168960        ----a-w-        c:\windows\SysWow64\credui.dll

2013-11-14 14:06 . 2013-10-12 02:29        859648        ----a-w-        c:\windows\system32\IKEEXT.DLL

2013-11-14 14:06 . 2013-10-12 02:30        830464        ----a-w-        c:\windows\system32\nshwfp.dll

2013-11-14 14:06 . 2013-10-12 02:29        324096        ----a-w-        c:\windows\system32\FWPUCLNT.DLL

2013-11-14 14:06 . 2013-10-12 02:03        656896        ----a-w-        c:\windows\SysWow64\nshwfp.dll

2013-11-14 14:06 . 2013-10-12 02:01        216576        ----a-w-        c:\windows\SysWow64\FWPUCLNT.DLL

2013-11-09 14:59 . 2013-11-09 15:14        --------        d-----w-        c:\users\cs\AppData\Roaming\Sepo

2013-10-24 18:16 . 2013-09-04 12:12        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys

2013-10-24 18:16 . 2013-09-04 12:11        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys

2013-10-24 18:16 . 2013-09-04 12:11        99840        ----a-w-        c:\windows\system32\drivers\usbccgp.sys

2013-10-24 18:16 . 2013-09-04 12:11        52736        ----a-w-        c:\windows\system32\drivers\usbehci.sys

2013-10-24 18:16 . 2013-09-04 12:11        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys

2013-10-24 18:16 . 2013-09-04 12:11        7808        ----a-w-        c:\windows\system32\drivers\usbd.sys

2013-10-24 18:16 . 2013-09-04 12:11        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys

2013-10-23 18:08 . 2013-10-23 18:08        163504        ----a-w-        c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin

.

.

.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-11-17 06:06 . 2012-05-10 23:59        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-11-17 06:06 . 2012-05-10 23:59        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-09-16 10:37 . 2012-09-23 15:05        37400        ----a-w-        c:\windows\system32\SophosBootTasks.exe

2013-09-08 02:30 . 2013-10-10 18:39        1903552        ----a-w-        c:\windows\system32\drivers\tcpip.sys

2013-09-08 02:27 . 2013-10-10 18:39        327168        ----a-w-        c:\windows\system32\mswsock.dll

2013-09-08 02:03 . 2013-10-10 18:39        231424        ----a-w-        c:\windows\SysWow64\mswsock.dll

2013-09-03 13:35 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe

2013-08-29 02:17 . 2013-10-10 18:39        5549504        ----a-w-        c:\windows\system32\ntoskrnl.exe

2013-08-29 02:16 . 2013-10-10 18:39        1732032        ----a-w-        c:\windows\system32\ntdll.dll

2013-08-29 02:16 . 2013-10-10 18:39        243712        ----a-w-        c:\windows\system32\wow64.dll

2013-08-29 02:16 . 2013-10-10 18:39        859648        ----a-w-        c:\windows\system32\tdh.dll

2013-08-29 02:13 . 2013-10-10 18:39        878080        ----a-w-        c:\windows\system32\advapi32.dll

2013-08-29 01:51 . 2013-10-10 18:39        3969472        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe

2013-08-29 01:51 . 2013-10-10 18:39        3914176        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe

2013-08-29 01:50 . 2013-10-10 18:39        5120        ----a-w-        c:\windows\SysWow64\wow32.dll

2013-08-29 01:50 . 2013-10-10 18:39        1292192        ----a-w-        c:\windows\SysWow64\ntdll.dll

2013-08-29 01:50 . 2013-10-10 18:39        619520        ----a-w-        c:\windows\SysWow64\tdh.dll

2013-08-29 01:48 . 2013-10-10 18:39        640512        ----a-w-        c:\windows\SysWow64\advapi32.dll

2013-08-29 01:48 . 2013-10-10 18:39        44032        ----a-w-        c:\windows\apppatch\acwow64.dll

2013-08-29 00:49 . 2013-10-10 18:39        25600        ----a-w-        c:\windows\SysWow64\setup16.exe

2013-08-29 00:49 . 2013-10-10 18:39        7680        ----a-w-        c:\windows\SysWow64\instnm.exe

2013-08-29 00:49 . 2013-10-10 18:39        14336        ----a-w-        c:\windows\SysWow64\ntvdm64.dll

2013-08-29 00:49 . 2013-10-10 18:39        2048        ----a-w-        c:\windows\SysWow64\user.exe

2013-08-28 01:21 . 2013-10-10 18:39        3155968        ----a-w-        c:\windows\system32\win32k.sys

2013-08-28 01:12 . 2013-10-10 18:39        461312        ----a-w-        c:\windows\system32\scavengeui.dll

.

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"NBAgent"="c:\program files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe" [2011-11-18 1492264]

"ITSecMng"="c:\program files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe" [2011-04-02 80840]

"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-27 291608]

"ToshibaServiceStation"="c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" [2011-07-12 1298816]

"Sophos AutoUpdate Monitor"="c:\program files (x86)\Sophos\AutoUpdate\almon.exe" [2012-07-06 900160]

"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

"DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-01-30 450560]

"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-02-13 1263952]

"BlackBerryAutoUpdate"="c:\program files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-05-12 623888]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"TOPI.EXE"="c:\program files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe" [2012-03-06 847960]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Toshiba Places Icon Utility.lnk - c:\program files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe [2012-5-11 1492352]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

"EnableLinkedConnections"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

"AppInit_DLLs"=c:\progra~2\Sophos\SOPHOS~1\sophos_detoured.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]

@="service"

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]

"DisableMonitoring"=dword:00000001

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]

R2 swi_update_64;Sophos Web Intelligence Update;c:\programdata\Sophos\Web Intelligence\swi_update_64.exe;c:\programdata\Sophos\Web Intelligence\swi_update_64.exe [x]

R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]

R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]

R3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys;c:\windows\SYSNATIVE\DRIVERS\lvrs64.sys [x]

R3 LVUVC64;Logitech QuickCam Pro 9000(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys;c:\windows\SYSNATIVE\DRIVERS\lvuvc64.sys [x]

R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 SophosBootDriver;SophosBootDriver;c:\windows\system32\DRIVERS\SophosBootDriver.sys;c:\windows\SYSNATIVE\DRIVERS\SophosBootDriver.sys [x]

R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]

S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]

S0 NBVol;Nero Backup Volume Filter Driver;c:\windows\system32\DRIVERS\NBVol.sys;c:\windows\SYSNATIVE\DRIVERS\NBVol.sys [x]

S0 NBVolUp;Nero Backup Volume Upper Filter Driver;c:\windows\system32\DRIVERS\NBVolUp.sys;c:\windows\SYSNATIVE\DRIVERS\NBVolUp.sys [x]

S0 Thpdrv;TOSHIBA HDD Protection Driver;c:\windows\system32\DRIVERS\thpdrv.sys;c:\windows\SYSNATIVE\DRIVERS\thpdrv.sys [x]

S0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;c:\windows\system32\DRIVERS\Thpevm.SYS;c:\windows\SYSNATIVE\DRIVERS\Thpevm.SYS [x]

S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]

S1 SAVOnAccess;SAVOnAccess;c:\windows\system32\DRIVERS\savonaccess.sys;c:\windows\SYSNATIVE\DRIVERS\savonaccess.sys [x]

S1 scfdriver;SCF Kernel Driver;c:\windows\system32\Drivers\scfdriver.sys;c:\windows\SYSNATIVE\Drivers\scfdriver.sys [x]

S1 scfndis;Sophos Client Firewall NDIS packet filter;c:\windows\system32\DRIVERS\scfndis.sys;c:\windows\SYSNATIVE\DRIVERS\scfndis.sys [x]

S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]

S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]

S2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [x]

S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]

S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]

S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]

S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x]

S2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [x]

S2 SAVService;Sophos Anti-Virus;c:\program files (x86)\Sophos\Sophos Anti-Virus\SavService.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [x]

S2 Sophos Client Firewall Manager;Sophos Client Firewall Manager;c:\program files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe;c:\program files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe [x]

S2 Sophos Client Firewall;Sophos Client Firewall;c:\program files (x86)\Sophos\Sophos Client Firewall\SCFService.exe;c:\program files (x86)\Sophos\Sophos Client Firewall\SCFService.exe [x]

S2 swi_service;Sophos Web Intelligence Service;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe;c:\program files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [x]

S2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]

S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]

S2 UMVPFSrv;UMVPFSrv;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe;c:\program files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [x]

S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]

S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]

S3 L1C;NDIS Miniport Driver for Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]

S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]

S3 QIOMem;Generic IO & Memory Access;c:\windows\system32\DRIVERS\QIOMem.sys;c:\windows\SYSNATIVE\DRIVERS\QIOMem.sys [x]

S3 SmbDrv;SmbDrv;c:\windows\system32\DRIVERS\Smb_driver.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver.sys [x]

S3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]

S3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]

S3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]

.

.

Contents of the 'Scheduled Tasks' folder

.

2013-11-17 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-10 06:06]

.

2013-11-17 c:\windows\Tasks\dsmonitor.job

- c:\program files (x86)\Uniblue\DriverScanner\dsmonitor.exe [2013-03-15 14:47]

.

2013-11-17 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 20:41]

.

2013-11-17 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

- c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 20:41]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ThpSrv"="c:\windows\system32\thpsrv" [X]

"SmartAudio"="c:\program files\CONEXANT\SAII\SACpl.exe" [2012-02-22 1654400]

"SRS Premium Sound HD"="c:\program files\SRS Labs\SRS Control Panel\SRSPanel_64.exe" [2012-03-22 2165120]

"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2011-12-21 378968]

"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2011-11-26 710560]

"TosVolRegulator"="c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe" [2009-11-11 24376]

"Toshiba TEMPRO"="c:\program files (x86)\Toshiba TEMPRO\TemproTray.exe" [2011-02-10 1546720]

"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaReminder.exe" [2012-05-11 150992]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-05-10 170264]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-05-10 398616]

"Persistence"="c:\windows\system32\igfxpers.exe" [2012-05-10 440088]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\progra~2\Sophos\SOPHOS~1\sophos_detoured_x64.dll

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.ixquick.com/

mLocal Page = c:\windows\SysWOW64\blank.htm

IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath - c:\users\cs\AppData\Roaming\Mozilla\Firefox\Profiles\qs20zjet.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.ixquick.com/

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

Wow6432Node-HKLM-Run-TSleepSrv - %ProgramFiles(x86)%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe

c:\users\cs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe

c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk - c:\program files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe

HKLM-Run-TPwrMain - c:\program files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE

HKLM-Run-TCrdMain - c:\program files (x86)\TOSHIBA\FlashCards\TCrdMain.exe

HKLM-Run-Teco - c:\program files (x86)\TOSHIBA\TECO\Teco.exe

HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe

.

.

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_152_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_152_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_152_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_152_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_152.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2013-11-17  18:12:40

ComboFix-quarantined-files.txt  2013-11-17 18:12

.

Pre-Run: 375,577,280,512 bytes free

Post-Run: 375,418,781,696 bytes free

.

- - End Of File - - 7F527BD2F141875CE758BCBC28F1F44E

viele gruesse

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

hallo, danke fuer die schnelle antwort. habe alle schritte so ausgefuehrt. waehrend der malwarebytes scan lief, meldete sich sophos mit folgender nachricht: 'Adware or PUA NirCmd gefunden und in Quarantaene gepackt'.

malwarebytes log

Code:

Malwarebytes Anti-Malware (Test) 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.11.18.02
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16736

cs :: TOSHIBA [Administrator]
 

Schutz: Aktiviert
 

18/11/2013 10:17:58

mbam-log-2013-11-18 (10-17-58).txt
 

Art des Suchlaufs: Quick-Scan

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 214747

Laufzeit: 5 Minute(n), 55 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

adwarecleaner log

AdwCleaner Logfile:

Code:

# AdwCleaner v3.012 - Report created 18/11/2013 at 10:56:38

# Updated 11/11/2013 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : cs - TOSHIBA

# Running from : C:\Users\cs\Desktop\adwcleaner.exe

# Option : Clean
 

***** [ Services ] *****
 
 

***** [ Files / Folders ] *****
 

Folder Deleted : C:\ProgramData\NCH Software

Folder Deleted : C:\ProgramData\Partner

Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue\DriverScanner

Folder Deleted : C:\Program Files (x86)\NCH Software

Folder Deleted : C:\Program Files (x86)\Uniblue\DriverScanner

Folder Deleted : C:\Users\cs\AppData\LocalLow\boost_interprocess

Folder Deleted : C:\Users\cs\AppData\Roaming\Uniblue\DriverScanner

File Deleted : C:\Users\Public\Desktop\driverscanner.lnk
 

***** [ Shortcuts ] *****
 
 

***** [ Registry ] *****
 

Key Deleted : HKLM\SOFTWARE\Classes\driverscanner

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\NCH Software

Key Deleted : HKCU\Software\PIP

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\NCH Software

Key Deleted : HKLM\Software\PIP

Key Deleted : HKLM\Software\Uniblue

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C2F8CA82-2BD9-4513-B2D1-08A47914C1DA}_is1
 

***** [ Browsers ] *****
 

-\\ Internet Explorer v10.0.9200.16736
 
 

-\\ Mozilla Firefox v25.0.1 (en-US)
 

[ File : C:\Users\cs\AppData\Roaming\Mozilla\Firefox\Profiles\qs20zjet.default\prefs.js ]
 
 

*************************
 

AdwCleaner[R0].txt - [2151 octets] - [18/11/2013 10:33:56]

AdwCleaner[R1].txt - [2211 octets] - [18/11/2013 10:51:22]

AdwCleaner[R2].txt - [2271 octets] - [18/11/2013 10:54:42]

AdwCleaner[S0].txt - [2034 octets] - [18/11/2013 10:56:38]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2094 octets] ##########

--- --- ---

jrt logfile

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.0.8 (11.05.2013:1)

OS: Windows 7 Home Premium x64

Ran by cs on 18/11/2013 at 11:05:23.47

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 

Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page

Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3333763334-3209806367-2958437272-1001\Software\Microsoft\Internet Explorer\Main\\Start Page
 
 
 

~~~ Registry Keys
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\windows\Tasks\dsmonitor.job

Successfully deleted: [File] "C:\Users\cs\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\driverscanner.lnk"
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uniblue"

Successfully deleted: [Empty Folder] C:\Users\cs\appdata\local\{314728FA-1B5F-4038-8319-65B3DC79868F}

Successfully deleted: [Empty Folder] C:\Users\cs\appdata\local\{4324974D-BAE2-47B6-9D19-45538E5D558E}

Successfully deleted: [Empty Folder] C:\Users\cs\appdata\local\{87C964AE-C451-4C3A-A572-BD614FB505ED}

Successfully deleted: [Empty Folder] C:\Users\cs\appdata\local\{C18C4B25-6152-4536-A69E-90F9FCC9DC86}
 
 
 

~~~ FireFox
 

Successfully deleted the following from C:\Users\cs\AppData\Roaming\mozilla\firefox\profiles\qs20zjet.default\prefs.js
 

user_pref("browser.startup.homepage", "hxxp://www.ixquick.com/");
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 18/11/2013 at 11:15:05.20

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

und das zuletzt gemachte FRST

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02

Ran by cs (administrator) on TOSHIBA on 18-11-2013 11:17:56

Running from C:\Users\cs\Downloads

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe

(Conexant Systems Inc.) C:\windows\system32\CxAudMsg64.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe

(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe

(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SACpl.exe [1654400 2012-02-22] (Conexant Systems, Inc.)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223180 2012-03-22] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)

HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [378968 2011-12-21] (Alcor Micro Corp.)

HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [590256 2011-09-23] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon

HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] - C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)

HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [150992 2012-05-11] (Toshiba Europe GmbH)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)

HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-12] (TOSHIBA Corporation)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [900160 2012-07-06] (Sophos Limited)

HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [623888 2009-05-12] (Research In Motion Limited)

HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)

HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)

AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [218256 2013-09-16] (Sophos Limited)

AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll [221840 2013-09-16] (Sophos Limited)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\cs\AppData\Roaming\Mozilla\Firefox\Profiles\qs20zjet.default

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
 

==================== Services (Whitelisted) =================
 

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [216640 2012-11-12] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [139840 2012-06-15] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [232512 2012-07-06] (Sophos Limited)

R2 Sophos Client Firewall; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe [89112 2011-10-19] (Sophos Limited)

R2 Sophos Client Firewall Manager; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe [150552 2011-10-19] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2869824 2012-11-12] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [1998400 2012-11-12] (Sophos Limited)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-05-20] (Research In Motion Limited)

R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [144672 2012-04-24] (Sophos Limited)

R1 scfdriver; C:\windows\system32\Drivers\scfdriver.sys [102688 2011-08-25] (Sophos Limited)

R1 scfndis; C:\Windows\System32\DRIVERS\scfndis.sys [55072 2011-08-25] (Sophos Limited)

R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2011-08-25] (Sophos Plc)

S3 Tosrfcom; No ImagePath

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-18 11:17 - 2013-11-18 11:17 - 00016813 _____ C:\Users\cs\Downloads\FRST.txt

2013-11-18 11:15 - 2013-11-18 11:15 - 00002251 _____ C:\Users\cs\Desktop\JRT.txt

2013-11-18 11:05 - 2013-11-18 11:05 - 00000000 ____D C:\windows\ERUNT

2013-11-18 10:33 - 2013-11-18 10:56 - 00000000 ____D C:\AdwCleaner

2013-11-18 10:31 - 2013-11-18 10:31 - 01034531 _____ (Thisisu) C:\Users\cs\Desktop\JRT.exe

2013-11-18 10:29 - 2013-11-18 10:29 - 01085542 _____ C:\Users\cs\Desktop\adwcleaner.exe

2013-11-18 10:04 - 2013-11-18 10:58 - 00000112 _____ C:\windows\setupact.log

2013-11-18 10:04 - 2013-11-18 10:04 - 00000000 _____ C:\windows\setuperr.log

2013-11-17 18:24 - 2013-11-17 18:24 - 00000000 ____D C:\ProgramData\Toshiba

2013-11-17 18:23 - 2013-11-17 18:23 - 00000000 ____D C:\Users\cs\AppData\Roaming\Toshiba

2013-11-17 18:14 - 2013-11-17 18:14 - 00029907 _____ C:\Users\cs\Desktop\Combofixlg.txt

2013-11-17 18:12 - 2013-11-17 18:12 - 00029905 _____ C:\ComboFix.txt

2013-11-17 18:00 - 2013-11-17 18:12 - 00000000 ____D C:\Qoobox

2013-11-17 18:00 - 2011-06-26 06:45 - 00256000 _____ C:\windows\PEV.exe

2013-11-17 18:00 - 2010-11-07 17:20 - 00208896 _____ C:\windows\MBR.exe

2013-11-17 18:00 - 2009-04-20 04:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00098816 _____ C:\windows\sed.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00080412 _____ C:\windows\grep.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00068096 _____ C:\windows\zip.exe

2013-11-17 17:59 - 2013-11-17 18:10 - 00000000 ____D C:\windows\erdnt

2013-11-17 17:53 - 2013-11-17 17:54 - 05146587 ____R (Swearware) C:\Users\cs\Desktop\ComboFix.exe

2013-11-17 15:51 - 2013-11-17 15:51 - 00377856 _____ C:\Users\cs\Downloads\gmer_2.1.19163.exe

2013-11-17 15:41 - 2013-11-17 15:42 - 00021870 _____ C:\Users\cs\Desktop\AdditionSunday.txt

2013-11-17 15:40 - 2013-11-17 15:42 - 00035298 _____ C:\Users\cs\Desktop\FRSTsunday.txt

2013-11-17 15:40 - 2013-11-17 15:40 - 00000000 ____D C:\FRST

2013-11-17 15:37 - 2013-11-17 15:39 - 01958026 _____ (Farbar) C:\Users\cs\Downloads\FRST64.exe

2013-11-17 15:19 - 2013-11-17 15:19 - 00000466 _____ C:\Users\cs\Desktop\defogger_disable.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 _____ C:\Users\cs\defogger_reenable

2013-11-17 15:14 - 2013-11-17 15:15 - 00050477 _____ C:\Users\cs\Desktop\Defogger.exe

2013-11-17 15:09 - 2013-11-17 15:10 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt

2013-11-17 14:53 - 2013-11-17 16:31 - 00001418 _____ C:\Users\cs\Desktop\TrPost.txt

2013-11-17 06:25 - 2013-11-17 06:26 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-17 06:23 - 2013-11-17 06:24 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe

2013-11-17 06:06 - 2013-11-18 10:54 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-11-17 06:06 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-15 16:32 - 2013-11-16 14:24 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-15 16:31 - 2013-11-16 13:14 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-11-15 16:28 - 2013-11-16 14:24 - 00000000 ____D C:\Users\cs\Desktop\mbar

2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe

2013-11-15 13:45 - 2013-11-15 15:46 - 00015372 _____ C:\Users\cs\Desktop\Charts241113.txt

2013-11-14 15:31 - 2013-10-12 08:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-11-14 15:31 - 2013-10-12 08:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-11-14 15:31 - 2013-10-12 08:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-11-14 15:31 - 2013-10-12 08:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-11-14 15:31 - 2013-10-12 07:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-11-14 15:31 - 2013-10-12 07:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-11-14 15:31 - 2013-10-12 06:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-11-14 15:31 - 2013-10-12 06:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-11-14 15:31 - 2013-10-12 05:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-11-14 15:31 - 2013-10-12 05:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-14 14:10 - 2013-10-05 20:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-14 14:10 - 2013-10-05 19:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-14 14:09 - 2013-10-03 02:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-14 14:09 - 2013-10-03 02:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-14 14:09 - 2013-09-28 01:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-14 14:09 - 2013-09-25 02:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2013-11-14 14:09 - 2013-09-25 02:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2013-11-14 14:09 - 2013-09-25 02:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2013-11-14 14:09 - 2013-09-25 02:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2013-11-14 14:09 - 2013-09-25 02:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2013-11-14 14:09 - 2013-09-25 02:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-14 14:09 - 2013-09-25 02:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2013-11-14 14:09 - 2013-09-25 02:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2013-11-14 14:09 - 2013-09-25 01:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2013-11-14 14:09 - 2013-09-25 01:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-14 14:09 - 2013-09-25 01:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2013-11-14 14:09 - 2013-09-25 01:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2013-11-14 14:09 - 2013-09-25 01:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2013-11-14 14:09 - 2013-07-04 12:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2013-11-14 14:07 - 2013-10-04 02:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll

2013-11-14 14:07 - 2013-10-04 02:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll

2013-11-14 14:07 - 2013-10-04 02:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-14 14:07 - 2013-10-04 01:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-14 14:07 - 2013-10-04 01:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-14 14:07 - 2013-10-04 01:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll

2013-11-14 14:06 - 2013-10-12 02:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll

2013-11-14 14:06 - 2013-10-12 02:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-14 14:06 - 2013-10-12 02:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL

2013-11-14 14:06 - 2013-10-12 02:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll

2013-11-14 14:06 - 2013-10-12 02:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL

2013-11-09 14:59 - 2013-11-09 15:14 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

2013-10-24 18:16 - 2013-09-04 12:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
 

==================== One Month Modified Files and Folders =======
 

2013-11-18 11:18 - 2013-11-18 11:17 - 00016813 _____ C:\Users\cs\Downloads\FRST.txt

2013-11-18 11:15 - 2013-11-18 11:15 - 00002251 _____ C:\Users\cs\Desktop\JRT.txt

2013-11-18 11:06 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-18 11:06 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-18 11:05 - 2013-11-18 11:05 - 00000000 ____D C:\windows\ERUNT

2013-11-18 10:59 - 2012-07-28 09:25 - 00000828 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

2013-11-18 10:58 - 2013-11-18 10:04 - 00000112 _____ C:\windows\setupact.log

2013-11-18 10:58 - 2012-09-23 15:10 - 00000142 _____ C:\windows\ODBC.INI

2013-11-18 10:58 - 2009-07-14 05:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-11-18 10:57 - 2012-07-28 09:20 - 01977771 _____ C:\windows\WindowsUpdate.log

2013-11-18 10:56 - 2013-11-18 10:33 - 00000000 ____D C:\AdwCleaner

2013-11-18 10:54 - 2013-11-17 06:06 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-11-18 10:31 - 2013-11-18 10:31 - 01034531 _____ (Thisisu) C:\Users\cs\Desktop\JRT.exe

2013-11-18 10:29 - 2013-11-18 10:29 - 01085542 _____ C:\Users\cs\Desktop\adwcleaner.exe

2013-11-18 10:04 - 2013-11-18 10:04 - 00000000 _____ C:\windows\setuperr.log

2013-11-17 18:24 - 2013-11-17 18:24 - 00000000 ____D C:\ProgramData\Toshiba

2013-11-17 18:23 - 2013-11-17 18:23 - 00000000 ____D C:\Users\cs\AppData\Roaming\Toshiba

2013-11-17 18:14 - 2013-11-17 18:14 - 00029907 _____ C:\Users\cs\Desktop\Combofixlg.txt

2013-11-17 18:12 - 2013-11-17 18:12 - 00029905 _____ C:\ComboFix.txt

2013-11-17 18:12 - 2013-11-17 18:00 - 00000000 ____D C:\Qoobox

2013-11-17 18:12 - 2009-07-14 03:20 - 00000000 __RHD C:\Users\Default

2013-11-17 18:11 - 2012-09-23 13:09 - 00000000 ___RD C:\Users\cs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-17 18:11 - 2012-07-28 09:57 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-17 18:11 - 2012-07-28 09:57 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-17 18:10 - 2013-11-17 17:59 - 00000000 ____D C:\windows\erdnt

2013-11-17 18:09 - 2009-07-14 02:34 - 00000215 _____ C:\windows\system.ini

2013-11-17 17:54 - 2013-11-17 17:53 - 05146587 ____R (Swearware) C:\Users\cs\Desktop\ComboFix.exe

2013-11-17 16:31 - 2013-11-17 14:53 - 00001418 _____ C:\Users\cs\Desktop\TrPost.txt

2013-11-17 15:55 - 2012-07-28 09:25 - 00000830 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

2013-11-17 15:51 - 2013-11-17 15:51 - 00377856 _____ C:\Users\cs\Downloads\gmer_2.1.19163.exe

2013-11-17 15:42 - 2013-11-17 15:41 - 00021870 _____ C:\Users\cs\Desktop\AdditionSunday.txt

2013-11-17 15:42 - 2013-11-17 15:40 - 00035298 _____ C:\Users\cs\Desktop\FRSTsunday.txt

2013-11-17 15:40 - 2013-11-17 15:40 - 00000000 ____D C:\FRST

2013-11-17 15:39 - 2013-11-17 15:37 - 01958026 _____ (Farbar) C:\Users\cs\Downloads\FRST64.exe

2013-11-17 15:19 - 2013-11-17 15:19 - 00000466 _____ C:\Users\cs\Desktop\defogger_disable.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 _____ C:\Users\cs\defogger_reenable

2013-11-17 15:19 - 2012-09-23 13:09 - 00000000 ____D C:\Users\cs

2013-11-17 15:15 - 2013-11-17 15:14 - 00050477 _____ C:\Users\cs\Desktop\Defogger.exe

2013-11-17 15:10 - 2013-11-17 15:09 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt

2013-11-17 14:50 - 2012-10-01 04:47 - 00000000 ____D C:\__Chr

2013-11-17 14:02 - 2013-10-05 06:47 - 00000000 _____ C:\windows\system32\vireng.log

2013-11-17 06:26 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-17 06:24 - 2013-11-17 06:23 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe

2013-11-17 06:06 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-17 06:06 - 2012-09-23 14:19 - 00000000 ____D C:\Users\cs\AppData\Local\Adobe

2013-11-17 06:06 - 2012-05-10 23:59 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-17 06:06 - 2012-05-10 23:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-11-16 14:24 - 2013-11-15 16:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-16 14:24 - 2013-11-15 16:28 - 00000000 ____D C:\Users\cs\Desktop\mbar

2013-11-16 13:14 - 2013-11-15 16:31 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-11-16 11:28 - 2009-07-14 05:08 - 00032620 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe

2013-11-15 15:46 - 2013-11-15 13:45 - 00015372 _____ C:\Users\cs\Desktop\Charts241113.txt

2013-11-15 13:35 - 2012-05-11 08:24 - 00000000 ____D C:\windows\Panther

2013-11-14 15:31 - 2012-10-18 18:54 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\SysWOW64\Macromed

2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\system32\Macromed

2013-11-09 17:39 - 2010-11-21 07:16 - 00000000 ___RD C:\Users\Public\Recorded TV

2013-11-09 17:39 - 2009-07-14 03:20 - 00000000 ____D C:\windows\registration

2013-11-09 15:14 - 2013-11-09 14:59 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

2013-11-09 13:46 - 2013-02-14 20:04 - 00111536 _____ C:\Users\cs\Desktop\Trial.txt

2013-11-06 20:14 - 2012-11-16 10:12 - 00000000 ____D C:\Users\cs\AppData\Local\CutePDF Writer

2013-11-04 07:50 - 2012-09-23 15:52 - 00009189 _____ C:\Users\cs\Desktop\Notes.txt

2013-11-02 10:09 - 2009-07-14 05:13 - 00726444 _____ C:\windows\system32\PerfStringBackup.INI
 

Some content of TEMP:

====================

C:\Users\cs\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-25 18:31
 

==================== End Of Log ============================

--- --- ---

--- --- ---

danke und gruesse

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

hallo, sieht's denn bis jetzt gut aus? habe die schritte ausgefuehrt und hier sind die logfiles:

ESET

Code:

ESETSmartInstaller@High as downloader log:

all ok

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.6920

# api_version=3.0.2

# EOSSerial=26a2a9291c5b2a4e9b977708528e92c2

# engine=15940

# end=finished

# remove_checked=false

# archives_checked=true

# unwanted_checked=false

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2013-11-19 12:57:02

# local_time=2013-11-19 12:57:02 (+0000, GMT Standard Time)

# country="United Kingdom"

# lang=1033

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode=5893 16776573 100 94 7351 137330872 0 0

# compatibility_mode=8450 16777213 100 99 7403 70621777 0 0

# scanned=145171

# found=1

# cleaned=0

# scan_time=6687

sh=EB49A8DF253ED73334C5490385297F0AAC6A7CEE ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\cs\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\31ff4eba-63e3a3d4"

security check

Code:

 Results of screen317's Security Check version 0.99.76  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 10  
 ``````````````Antivirus/Firewall Check:`````````````` 

 Windows Firewall Disabled!  

Sophos Anti-Virus   

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware Version 1.75.0.1300  

 Java 7 Update 45  

 Adobe Reader 10.1.0 Adobe Reader out of Date!  

 Mozilla Firefox (25.0.1) 
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamservice.exe  

 Malwarebytes Anti-Malware mbamgui.exe  

 Sophos Sophos Anti-Virus SavService.exe  

 Sophos Sophos Anti-Virus SAVAdminService.exe  

 Sophos Sophos Anti-Virus Web Intelligence swi_service.exe 

 Malwarebytes' Anti-Malware mbamscheduler.exe   

 Sophos Sophos Client Firewall SCFManager.exe  

 Sophos Sophos Client Firewall SCFService.exe  
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 
 ````````````````````End of Log``````````````````````

FRST

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-11-2013

Ran by cs (administrator) on TOSHIBA on 19-11-2013 13:19:56

Running from C:\Users\cs\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal
 

==================== Processes (Whitelisted) =================
 

(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe

(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\TECO\Teco.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe

(TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe

(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe

() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe

(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Conexant Systems Inc.) C:\windows\system32\CxAudMsg64.exe

(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe

(TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe

(TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\windows\system32\UI0Detect.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe

(Sophos Limited) C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe

(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SACpl.exe [1654400 2012-02-22] (Conexant Systems, Inc.)

HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223180 2012-03-22] ()

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)

HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [378968 2011-12-21] (Alcor Micro Corp.)

HKLM\...\Run: [TPwrMain] - C:\Program Files\Toshiba\Power Saver\TPwrMain.exe [590256 2011-09-23] (TOSHIBA Corporation)

HKLM\...\Run: [TCrdMain] - C:\Program Files\Toshiba\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [Teco] - C:\Program Files\Toshiba\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)

HKLM\...\Run: [TosWaitSrv] - C:\Program Files\Toshiba\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)

HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon

HKLM\...\Run: [TosSENotify] - C:\Program Files\Toshiba\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)

HKLM\...\Run: [TosVolRegulator] - C:\Program Files\Toshiba\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)

HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)

HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [150992 2012-05-11] (Toshiba Europe GmbH)

HKLM\...\Run: [HotKeysCmds] - C:\windows\system32\hkcmd.exe [ ] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)

HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)

HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)

HKLM-x32\...\Run: [ToshibaServiceStation] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-12] (TOSHIBA Corporation)

HKLM-x32\...\Run: [Sophos AutoUpdate Monitor] - C:\Program Files (x86)\Sophos\AutoUpdate\ALMon.exe [900160 2012-07-06] (Sophos Limited)

HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)

HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-01-30] (DivX, LLC)

HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()

HKLM-x32\...\Run: [BlackBerryAutoUpdate] - C:\Program Files (x86)\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe [623888 2009-05-12] (Research In Motion Limited)

HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)

HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe [847960 2012-03-06] (TOSHIBA)

AppInit_DLLs: C:\Program Files (x86)\Sophos\Sophos Anti-Virus\sophos_detoured_x64.dll [218256 2013-10-09] (Sophos Limited)

AppInit_DLLs-x32: C:\PROGRA~2\Sophos\SOPHOS~1\sophos_detoured.dll,C:\PROGRA~2\Sophos\SOPHOS~1\SOPHOS~1.DLL [221840 2013-10-09] (Sophos Limited)
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKCU - DefaultScope {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 

SearchScopes: HKCU - {BCF0B725-3877-4033-BE68-92718645BF7E} URL = 

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog9 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp.dll [87616] (Sophos Limited)

Winsock: Catalog9-x64 01 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 02 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 03 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 04 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 05 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 06 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 07 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 08 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Winsock: Catalog9-x64 19 C:\ProgramData\Sophos\Web Intelligence\swi_ifslsp_64.dll [127040] (Sophos Limited)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF ProfilePath: C:\Users\cs\AppData\Roaming\Mozilla\Firefox\Profiles\qs20zjet.default

FF Homepage: https://www.ixquick.com/

FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)

FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
 

==================== Services (Whitelisted) =================
 

R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [127320 2012-03-15] ()

R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [162648 2012-03-15] (Intel Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 SAVAdminService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SAVAdminService.exe [216640 2012-11-12] (Sophos Limited)

R2 SAVService; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\SavService.exe [139840 2012-06-15] (Sophos Limited)

R2 Sophos AutoUpdate Service; C:\Program Files (x86)\Sophos\AutoUpdate\ALsvc.exe [232512 2012-07-06] (Sophos Limited)

R2 Sophos Client Firewall; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFService.exe [89112 2011-10-19] (Sophos Limited)

R2 Sophos Client Firewall Manager; C:\Program Files (x86)\Sophos\Sophos Client Firewall\SCFManager.exe [150552 2011-10-19] (Sophos Limited)

R2 swi_service; C:\Program Files (x86)\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe [2869824 2012-11-12] (Sophos Limited)

S2 swi_update_64; C:\ProgramData\Sophos\Web Intelligence\swi_update_64.exe [1998400 2012-11-12] (Sophos Limited)

S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
 

==================== Drivers (Whitelisted) ====================
 

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [28416 2008-05-20] (Research In Motion Limited)

R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [31744 2009-01-09] (Research in Motion Ltd)

R1 SAVOnAccess; C:\Windows\System32\DRIVERS\savonaccess.sys [144672 2012-04-24] (Sophos Limited)

R1 scfdriver; C:\windows\system32\Drivers\scfdriver.sys [102688 2011-08-25] (Sophos Limited)

R1 scfndis; C:\Windows\System32\DRIVERS\scfndis.sys [55072 2011-08-25] (Sophos Limited)

R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)

S4 SophosBootDriver; C:\Windows\System32\DRIVERS\SophosBootDriver.sys [25608 2011-08-25] (Sophos Plc)

S3 Tosrfcom; No ImagePath

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [x]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2013-11-19 13:19 - 2013-11-19 13:20 - 00017474 _____ C:\Users\cs\Desktop\FRST.txt

2013-11-19 13:18 - 2013-11-19 13:18 - 01957964 _____ (Farbar) C:\Users\cs\Desktop\FRST64.exe

2013-11-19 11:01 - 2013-11-19 11:01 - 02347384 _____ (ESET) C:\Users\cs\Desktop\esetsmartinstaller_enu.exe

2013-11-19 10:56 - 2013-11-19 10:56 - 00891184 _____ C:\Users\cs\Desktop\SecurityCheck.exe

2013-11-19 10:44 - 2013-11-19 10:44 - 00000056 _____ C:\windows\setupact.log

2013-11-19 10:44 - 2013-11-19 10:44 - 00000000 _____ C:\windows\setuperr.log

2013-11-18 13:48 - 2013-11-18 15:31 - 00014937 _____ C:\Users\cs\Desktop\Charts011213.txt

2013-11-18 12:12 - 2013-11-18 12:12 - 00000000 ____D C:\ProgramData\Oracle

2013-11-18 12:11 - 2013-11-18 12:11 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-11-18 12:11 - 2013-11-18 12:11 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-11-18 12:11 - 2013-11-18 12:11 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-11-18 12:11 - 2013-11-18 12:11 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-18 11:17 - 2013-11-18 11:18 - 00037256 _____ C:\Users\cs\Downloads\FRST.txt

2013-11-18 11:15 - 2013-11-18 11:15 - 00002251 _____ C:\Users\cs\Desktop\JRT.txt

2013-11-18 11:05 - 2013-11-18 11:05 - 00000000 ____D C:\windows\ERUNT

2013-11-18 10:33 - 2013-11-18 10:56 - 00000000 ____D C:\AdwCleaner

2013-11-18 10:31 - 2013-11-18 10:31 - 01034531 _____ (Thisisu) C:\Users\cs\Desktop\JRT.exe

2013-11-18 10:29 - 2013-11-18 10:29 - 01085542 _____ C:\Users\cs\Desktop\adwcleaner.exe

2013-11-17 18:24 - 2013-11-17 18:24 - 00000000 ____D C:\ProgramData\Toshiba

2013-11-17 18:23 - 2013-11-17 18:23 - 00000000 ____D C:\Users\cs\AppData\Roaming\Toshiba

2013-11-17 18:14 - 2013-11-17 18:14 - 00029907 _____ C:\Users\cs\Desktop\Combofixlg.txt

2013-11-17 18:12 - 2013-11-17 18:12 - 00029905 _____ C:\ComboFix.txt

2013-11-17 18:00 - 2013-11-17 18:12 - 00000000 ____D C:\Qoobox

2013-11-17 18:00 - 2011-06-26 06:45 - 00256000 _____ C:\windows\PEV.exe

2013-11-17 18:00 - 2010-11-07 17:20 - 00208896 _____ C:\windows\MBR.exe

2013-11-17 18:00 - 2009-04-20 04:56 - 00060416 _____ C:\windows\NIRCMD.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00098816 _____ C:\windows\sed.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00080412 _____ C:\windows\grep.exe

2013-11-17 18:00 - 2000-08-31 00:00 - 00068096 _____ C:\windows\zip.exe

2013-11-17 17:59 - 2013-11-17 18:10 - 00000000 ____D C:\windows\erdnt

2013-11-17 17:53 - 2013-11-17 17:54 - 05146587 ____R (Swearware) C:\Users\cs\Desktop\ComboFix.exe

2013-11-17 15:51 - 2013-11-17 15:51 - 00377856 _____ C:\Users\cs\Downloads\gmer_2.1.19163.exe

2013-11-17 15:41 - 2013-11-17 15:42 - 00021870 _____ C:\Users\cs\Desktop\AdditionSunday.txt

2013-11-17 15:40 - 2013-11-17 15:42 - 00035298 _____ C:\Users\cs\Desktop\FRSTsunday.txt

2013-11-17 15:40 - 2013-11-17 15:40 - 00000000 ____D C:\FRST

2013-11-17 15:19 - 2013-11-17 15:19 - 00000466 _____ C:\Users\cs\Desktop\defogger_disable.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 _____ C:\Users\cs\defogger_reenable

2013-11-17 15:14 - 2013-11-17 15:15 - 00050477 _____ C:\Users\cs\Desktop\Defogger.exe

2013-11-17 15:09 - 2013-11-17 15:10 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt

2013-11-17 14:53 - 2013-11-17 16:31 - 00001418 _____ C:\Users\cs\Desktop\TrPost.txt

2013-11-17 06:25 - 2013-11-18 12:10 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-17 06:25 - 2013-11-17 06:26 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-17 06:23 - 2013-11-17 06:24 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe

2013-11-17 06:06 - 2013-11-19 12:54 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-11-17 06:06 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-15 16:32 - 2013-11-16 14:24 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-15 16:31 - 2013-11-16 13:14 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-11-15 16:28 - 2013-11-16 14:24 - 00000000 ____D C:\Users\cs\Desktop\mbar

2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe

2013-11-15 13:45 - 2013-11-18 13:50 - 00006264 _____ C:\Users\cs\Desktop\Charts241113.txt

2013-11-14 15:31 - 2013-10-12 08:45 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2013-11-14 15:31 - 2013-10-12 08:45 - 01364992 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2013-11-14 15:31 - 2013-10-12 08:45 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2013-11-14 15:31 - 2013-10-12 08:43 - 19269632 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 15404544 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2013-11-14 15:31 - 2013-10-12 08:43 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2013-11-14 15:31 - 2013-10-12 07:03 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2013-11-14 15:31 - 2013-10-12 07:03 - 01138176 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 14355968 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 13761024 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2013-11-14 15:31 - 2013-10-12 07:02 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2013-11-14 15:31 - 2013-10-12 06:35 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2013-11-14 15:31 - 2013-10-12 06:08 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2013-11-14 15:31 - 2013-10-12 05:44 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe

2013-11-14 15:31 - 2013-10-12 05:15 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe

2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:57 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-14 14:10 - 2013-10-05 20:25 - 01474048 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll

2013-11-14 14:10 - 2013-10-05 19:57 - 01168384 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll

2013-11-14 14:09 - 2013-10-03 02:23 - 00404480 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll

2013-11-14 14:09 - 2013-10-03 02:00 - 00311808 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll

2013-11-14 14:09 - 2013-09-28 01:09 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2013-11-14 14:09 - 2013-09-25 02:26 - 00154560 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys

2013-11-14 14:09 - 2013-09-25 02:26 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys

2013-11-14 14:09 - 2013-09-25 02:23 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll

2013-11-14 14:09 - 2013-09-25 02:23 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll

2013-11-14 14:09 - 2013-09-25 02:23 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll

2013-11-14 14:09 - 2013-09-25 02:22 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2013-11-14 14:09 - 2013-09-25 02:21 - 01447936 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2013-11-14 14:09 - 2013-09-25 02:21 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2013-11-14 14:09 - 2013-09-25 01:58 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2013-11-14 14:09 - 2013-09-25 01:57 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2013-11-14 14:09 - 2013-09-25 01:57 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2013-11-14 14:09 - 2013-09-25 01:56 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2013-11-14 14:09 - 2013-09-25 01:03 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe

2013-11-14 14:09 - 2013-07-04 12:18 - 00458712 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys

2013-11-14 14:07 - 2013-10-04 02:28 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\SmartcardCredentialProvider.dll

2013-11-14 14:07 - 2013-10-04 02:25 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\credui.dll

2013-11-14 14:07 - 2013-10-04 02:24 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll

2013-11-14 14:07 - 2013-10-04 01:58 - 00152576 _____ (Microsoft Corporation) C:\windows\SysWOW64\SmartcardCredentialProvider.dll

2013-11-14 14:07 - 2013-10-04 01:56 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll

2013-11-14 14:07 - 2013-10-04 01:56 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\credui.dll

2013-11-14 14:06 - 2013-10-12 02:30 - 00830464 _____ (Microsoft Corporation) C:\windows\system32\nshwfp.dll

2013-11-14 14:06 - 2013-10-12 02:29 - 00859648 _____ (Microsoft Corporation) C:\windows\system32\IKEEXT.DLL

2013-11-14 14:06 - 2013-10-12 02:29 - 00324096 _____ (Microsoft Corporation) C:\windows\system32\FWPUCLNT.DLL

2013-11-14 14:06 - 2013-10-12 02:03 - 00656896 _____ (Microsoft Corporation) C:\windows\SysWOW64\nshwfp.dll

2013-11-14 14:06 - 2013-10-12 02:01 - 00216576 _____ (Microsoft Corporation) C:\windows\SysWOW64\FWPUCLNT.DLL

2013-11-09 14:59 - 2013-11-09 15:14 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

2013-10-24 18:16 - 2013-09-04 12:12 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys

2013-10-24 18:16 - 2013-09-04 12:11 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
 

==================== One Month Modified Files and Folders =======
 

2013-11-19 13:20 - 2013-11-19 13:19 - 00017474 _____ C:\Users\cs\Desktop\FRST.txt

2013-11-19 13:18 - 2013-11-19 13:18 - 01957964 _____ (Farbar) C:\Users\cs\Desktop\FRST64.exe

2013-11-19 12:54 - 2013-11-17 06:06 - 00000830 _____ C:\windows\Tasks\Adobe Flash Player Updater.job

2013-11-19 12:29 - 2012-07-28 09:20 - 02040767 _____ C:\windows\WindowsUpdate.log

2013-11-19 11:01 - 2013-11-19 11:01 - 02347384 _____ (ESET) C:\Users\cs\Desktop\esetsmartinstaller_enu.exe

2013-11-19 10:59 - 2012-09-28 06:54 - 00000000 ____D C:\Users\cs\AppData\Local\Sophos

2013-11-19 10:59 - 2012-09-23 15:10 - 00000142 _____ C:\windows\ODBC.INI

2013-11-19 10:56 - 2013-11-19 10:56 - 00891184 _____ C:\Users\cs\Desktop\SecurityCheck.exe

2013-11-19 10:52 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-11-19 10:52 - 2009-07-14 04:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-11-19 10:45 - 2012-07-28 09:25 - 00000828 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job

2013-11-19 10:45 - 2009-07-14 05:08 - 00000006 ____H C:\windows\Tasks\SA.DAT

2013-11-19 10:44 - 2013-11-19 10:44 - 00000056 _____ C:\windows\setupact.log

2013-11-19 10:44 - 2013-11-19 10:44 - 00000000 _____ C:\windows\setuperr.log

2013-11-18 15:31 - 2013-11-18 13:48 - 00014937 _____ C:\Users\cs\Desktop\Charts011213.txt

2013-11-18 13:50 - 2013-11-15 13:45 - 00006264 _____ C:\Users\cs\Desktop\Charts241113.txt

2013-11-18 12:12 - 2013-11-18 12:12 - 00000000 ____D C:\ProgramData\Oracle

2013-11-18 12:11 - 2013-11-18 12:11 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2013-11-18 12:11 - 2013-11-18 12:11 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2013-11-18 12:11 - 2013-11-18 12:11 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2013-11-18 12:11 - 2013-11-18 12:11 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2013-11-18 12:11 - 2012-05-10 23:48 - 00000000 ____D C:\Program Files (x86)\Java

2013-11-18 12:10 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-11-18 11:18 - 2013-11-18 11:17 - 00037256 _____ C:\Users\cs\Downloads\FRST.txt

2013-11-18 11:15 - 2013-11-18 11:15 - 00002251 _____ C:\Users\cs\Desktop\JRT.txt

2013-11-18 11:05 - 2013-11-18 11:05 - 00000000 ____D C:\windows\ERUNT

2013-11-18 10:56 - 2013-11-18 10:33 - 00000000 ____D C:\AdwCleaner

2013-11-18 10:56 - 2013-03-15 22:49 - 00000000 ____D C:\Users\cs\AppData\Roaming\Uniblue

2013-11-18 10:56 - 2013-03-15 22:49 - 00000000 ____D C:\Program Files (x86)\Uniblue

2013-11-18 10:31 - 2013-11-18 10:31 - 01034531 _____ (Thisisu) C:\Users\cs\Desktop\JRT.exe

2013-11-18 10:29 - 2013-11-18 10:29 - 01085542 _____ C:\Users\cs\Desktop\adwcleaner.exe

2013-11-17 18:24 - 2013-11-17 18:24 - 00000000 ____D C:\ProgramData\Toshiba

2013-11-17 18:23 - 2013-11-17 18:23 - 00000000 ____D C:\Users\cs\AppData\Roaming\Toshiba

2013-11-17 18:14 - 2013-11-17 18:14 - 00029907 _____ C:\Users\cs\Desktop\Combofixlg.txt

2013-11-17 18:12 - 2013-11-17 18:12 - 00029905 _____ C:\ComboFix.txt

2013-11-17 18:12 - 2013-11-17 18:00 - 00000000 ____D C:\Qoobox

2013-11-17 18:12 - 2009-07-14 03:20 - 00000000 __RHD C:\Users\Default

2013-11-17 18:11 - 2012-09-23 13:09 - 00000000 ___RD C:\Users\cs\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-17 18:11 - 2012-07-28 09:57 - 00000000 ____D C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-17 18:11 - 2012-07-28 09:57 - 00000000 ____D C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2013-11-17 18:10 - 2013-11-17 17:59 - 00000000 ____D C:\windows\erdnt

2013-11-17 18:09 - 2009-07-14 02:34 - 00000215 _____ C:\windows\system.ini

2013-11-17 17:54 - 2013-11-17 17:53 - 05146587 ____R (Swearware) C:\Users\cs\Desktop\ComboFix.exe

2013-11-17 16:31 - 2013-11-17 14:53 - 00001418 _____ C:\Users\cs\Desktop\TrPost.txt

2013-11-17 15:55 - 2012-07-28 09:25 - 00000830 _____ C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job

2013-11-17 15:51 - 2013-11-17 15:51 - 00377856 _____ C:\Users\cs\Downloads\gmer_2.1.19163.exe

2013-11-17 15:42 - 2013-11-17 15:41 - 00021870 _____ C:\Users\cs\Desktop\AdditionSunday.txt

2013-11-17 15:42 - 2013-11-17 15:40 - 00035298 _____ C:\Users\cs\Desktop\FRSTsunday.txt

2013-11-17 15:40 - 2013-11-17 15:40 - 00000000 ____D C:\FRST

2013-11-17 15:19 - 2013-11-17 15:19 - 00000466 _____ C:\Users\cs\Desktop\defogger_disable.log

2013-11-17 15:19 - 2013-11-17 15:19 - 00000000 _____ C:\Users\cs\defogger_reenable

2013-11-17 15:19 - 2012-09-23 13:09 - 00000000 ____D C:\Users\cs

2013-11-17 15:15 - 2013-11-17 15:14 - 00050477 _____ C:\Users\cs\Desktop\Defogger.exe

2013-11-17 15:10 - 2013-11-17 15:09 - 00003839 _____ C:\Users\cs\Desktop\Schritte1.txt

2013-11-17 14:50 - 2012-10-01 04:47 - 00000000 ____D C:\__Chr

2013-11-17 14:02 - 2013-10-05 06:47 - 00000000 _____ C:\windows\system32\vireng.log

2013-11-17 06:26 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Roaming\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00001122 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Users\cs\AppData\Local\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\ProgramData\Mozilla

2013-11-17 06:25 - 2013-11-17 06:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-11-17 06:24 - 2013-11-17 06:23 - 00282904 _____ (Mozilla) C:\Users\cs\Downloads\Firefox Setup Stub 25.0.1.exe

2013-11-17 06:06 - 2013-11-17 06:06 - 00003768 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater

2013-11-17 06:06 - 2012-09-23 14:19 - 00000000 ____D C:\Users\cs\AppData\Local\Adobe

2013-11-17 06:06 - 2012-05-10 23:59 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe

2013-11-17 06:06 - 2012-05-10 23:59 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-11-16 14:24 - 2013-11-15 16:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-11-16 14:24 - 2013-11-15 16:28 - 00000000 ____D C:\Users\cs\Desktop\mbar

2013-11-16 13:14 - 2013-11-15 16:31 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2013-11-16 11:28 - 2009-07-14 05:08 - 00032620 _____ C:\windows\Tasks\SCHEDLGU.TXT

2013-11-15 16:28 - 2013-11-15 16:28 - 12576792 _____ (Malwarebytes Corp.) C:\Users\cs\Downloads\mbar-1.07.0.1007.exe

2013-11-15 13:35 - 2012-05-11 08:24 - 00000000 ____D C:\windows\Panther

2013-11-14 15:31 - 2012-10-18 18:54 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-11-14 14:57 - 2013-11-14 14:57 - 00001084 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Users\cs\AppData\Roaming\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\ProgramData\Malwarebytes

2013-11-14 14:57 - 2013-11-14 14:57 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-11-14 14:55 - 2013-11-14 14:55 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\cs\Downloads\mbam-setup-1.75.0.1300.exe

2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\SysWOW64\Macromed

2013-11-09 17:39 - 2012-05-10 23:59 - 00000000 ____D C:\windows\system32\Macromed

2013-11-09 17:39 - 2010-11-21 07:16 - 00000000 ___RD C:\Users\Public\Recorded TV

2013-11-09 17:39 - 2009-07-14 03:20 - 00000000 ____D C:\windows\registration

2013-11-09 15:14 - 2013-11-09 14:59 - 00000000 ____D C:\Users\cs\AppData\Roaming\Sepo

2013-11-09 13:46 - 2013-02-14 20:04 - 00111536 _____ C:\Users\cs\Desktop\Trial.txt

2013-11-06 20:14 - 2012-11-16 10:12 - 00000000 ____D C:\Users\cs\AppData\Local\CutePDF Writer

2013-11-04 07:50 - 2012-09-23 15:52 - 00009189 _____ C:\Users\cs\Desktop\Notes.txt

2013-11-02 10:09 - 2009-07-14 05:13 - 00726444 _____ C:\windows\system32\PerfStringBackup.INI
 

Some content of TEMP:

====================

C:\Users\cs\AppData\Local\Temp\fp_pl_pfs_installer.exe

C:\Users\cs\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 

LastRegBack: 2013-10-25 18:31
 

==================== End Of Log ============================

--- --- ---

--- --- ---

[/CODE]

FRST addition

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-11-2013

Ran by cs at 2013-11-19 13:21:27

Running from C:\Users\cs\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

AV: Sophos Anti-Virus (Enabled - Up to date) {65FBD860-96D8-75EF-C7ED-7BE27E6C498A}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Sophos Anti-Virus (Enabled - Up to date) {DE9A3984-B0E2-7A61-FD5D-409005EB0337}

FW: Sophos Client Firewall (Enabled) {5DC05945-DCB7-74B7-ECB2-D2D780BF0EF1}
 

==================== Installed Programs ======================
 

ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)

Adobe AIR (x32 Version: 2.0.3.13070)

Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.152)

Adobe Reader X (10.1.0) MUI (x32 Version: 10.1.0)

Alcor Micro USB Card Reader (x32 Version: 4.3.17.00279)

Atheros Bluetooth Filter Driver Package (Version: 1.0.0.12)

Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13)

Atheros Driver Installation Program (x32 Version: 9.2)

BBC iPlayer Desktop (x32 Version: 3.0.7)

BlackBerry Desktop Software 5.0 (x32 Version: 5.0.0.8)

BlackBerry® Media Sync (x32 Version: 2.0.20)

Bluetooth Stack for Windows by Toshiba (Version: v9.00.00(T))

CCleaner (Version: 3.22)

Conexant HD Audio (Version: 8.51.2.64)

CutePDF Writer 3.0 (Version:  3.0)

D3DX10 (x32 Version: 15.4.2368.0902)

DivX Setup (x32 Version: 2.6.1.24)

High-Definition Video Playback (x32 Version: 11.1.10500.2.65)

Intel(R) Manageability Engine Firmware Recovery Agent (x32 Version: 1.0.0.35342)

Intel(R) Management Engine Components (x32 Version: 8.0.4.1441)

Intel(R) Processor Graphics (x32 Version: 8.15.10.2752)

Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032)

Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.220)

Intel® Trusted Connect Service Client (Version: 1.23.605.1)

Java 7 Update 45 (x32 Version: 7.0.450)

Java Auto Updater (x32 Version: 2.1.9.8)

Junk Mail filter update (x32 Version: 15.4.3502.0922)

Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)

Mesh Runtime (x32 Version: 15.4.5722.2)

Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office 2007 Service Pack 3 (SP3) (x32)

Microsoft Office 2010 (x32 Version: 14.0.4763.1000)

Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)

Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000)

Microsoft Silverlight (Version: 5.1.20913.0)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)

Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)

Mozilla Firefox 25.0.1 (x86 en-US) (x32 Version: 25.0.1)

Mozilla Maintenance Service (x32 Version: 25.0.1)

MSVCRT (x32 Version: 15.4.2862.0708)

MSVCRT_amd64 (x32 Version: 15.4.2862.0708)

MSXML 4.0 SP3 Parser (KB2721691) (x32 Version: 4.30.2114.0)

MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0)

MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)

Nero 11 Essentials (x32 Version: 11.0.00300)

Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0)

Nero BackItUp 11 (x32 Version: 6.0.18000.19.100)

Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200)

Nero Backup Drivers (Version: 1.0.11100.8.0)

Nero BurnRights 11 (x32 Version: 5.0.10300.4.100)

Nero BurnRights 11 Help (CHM) (x32 Version: 11.0.10100)

Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27)

Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300)

Nero Core Components 11 (x32 Version: 11.0.15500.1.16)

Nero Express 11 (x32 Version: 11.0.11900.24.100)

Nero Express 11 Help (CHM) (x32 Version: 11.0.10300)

Nero Kwik Media (x32 Version: 1.10.24800.146.100)

Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200)

Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100)

Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400)

Nero Update (x32 Version: 11.0.11400.27.0)

nero.prerequisites.msi (x32 Version: 11.0.20008)

PlayReady PC Runtime amd64 (Version: 1.3.0)

Premium Sound HD (Version: 1.12.1800)

Skype™ 5.10 (x32 Version: 5.10.116)

Sophos Anti-Virus (x32 Version: 10.0.11)

Sophos AutoUpdate (x32 Version: 2.7.4.317)

Sophos Client Firewall (x32 Version: 2.9.1)

Synaptics Pointing Device Driver (Version: 15.3.39.0)

TOSHIBA Assist (x32 Version: 4.2.3.1)

TOSHIBA Disc Creator (Version: 2.1.0.11 for x64)

TOSHIBA eco Utility (Version: 1.3.10.64)

TOSHIBA Hardware Setup (Version: 4.11.03.00)

TOSHIBA Hardware Setup (x32 Version: 4.11.03.00)

TOSHIBA HDD Protection (Version: 2.2.2.15)

TOSHIBA HDD/SSD Alert (Version: 3.1.64.11)

Toshiba Manuals (x32 Version: 10.04)

TOSHIBA Media Controller (x32 Version: 1.0.87.5)

TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.7)

TOSHIBA Online Product Information (x32 Version: 4.02.0000)

TOSHIBA PC Health Monitor (Version: 1.7.15.64)

TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4)

TOSHIBA Recovery Media Creator (x32 Version: 2.1.6.52020009)

TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.1.0.0)

TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2004)

TOSHIBA Service Station (x32 Version: 2.2.13)

TOSHIBA Sleep Utility (x32 Version: 1.4.0022.000104)

TOSHIBA Supervisor Password (Version: 4.11.03.00)

TOSHIBA Supervisor Password (x32 Version: 4.11.03.00)

TOSHIBA TEMPRO (x32 Version: 3.35)

TOSHIBA Value Added Package (Version: 1.6.0021.640203)

TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203)

TOSHIBA Web Camera Application (x32 Version: 2.0.3.35)

Update for 2007 Microsoft Office System (KB967642) (x32)

Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)

Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)

Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)

Update for Microsoft Office Access 2007 Help (KB963663) (x32)

Update for Microsoft Office Excel 2007 Help (KB963678) (x32)

Update for Microsoft Office Infopath 2007 Help (KB963662) (x32)

Update for Microsoft Office OneNote 2007 Help (KB963670) (x32)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)

Update for Microsoft Office Outlook 2007 Help (KB963677) (x32)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2825642) 32-Bit Edition (x32)

Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32)

Update for Microsoft Office Publisher 2007 Help (KB963667) (x32)

Update for Microsoft Office Script Editor Help (KB963671) (x32)

Update for Microsoft Office Word 2007 Help (KB963665) (x32)

VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)

welcome (x32 Version: 11.0.22500.0.0)

Windows Live Communications Platform (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3502.0922)

Windows Live Essentials (x32 Version: 15.4.3538.0513)

Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)

Windows Live Installer (x32 Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3538.0513)

Windows Live Mail (x32 Version: 15.4.3502.0922)

Windows Live Mesh (x32 Version: 15.4.3502.0922)

Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)

Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)

Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)

Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)

Windows Live Messenger (x32 Version: 15.4.3538.0513)

Windows Live MIME IFilter (Version: 15.4.3502.0922)

Windows Live Movie Maker (x32 Version: 15.4.3502.0922)

Windows Live Photo Common (x32 Version: 15.4.3502.0922)

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)

Windows Live Remote Client (Version: 15.4.5722.2)

Windows Live Remote Client Resources (Version: 15.4.5722.2)

Windows Live Remote Service (Version: 15.4.5722.2)

Windows Live Remote Service Resources (Version: 15.4.5722.2)

Windows Live SOXE (x32 Version: 15.4.3502.0922)

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)

Windows Live UX Platform (x32 Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)

Windows Live Writer (x32 Version: 15.4.3502.0922)

Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)

Windows Liven sähköposti (x32 Version: 15.4.3502.0922)

Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
 

==================== Restore Points  =========================
 

01-11-2013 15:20:43 Windows Update

06-11-2013 05:51:18 Windows Update

09-11-2013 17:36:55 Restore Operation

14-11-2013 14:02:43 Windows Update

14-11-2013 15:28:02 Windows Update

17-11-2013 18:00:26 ComboFix created restore point

18-11-2013 12:08:58 Removed Java(TM) 6 Update 30

18-11-2013 12:10:53 Installed Java 7 Update 45

19-11-2013 10:50:18 Windows Update
 

==================== Hosts content: ==========================
 

2009-07-14 02:34 - 2013-11-17 18:09 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts

127.0.0.1       localhost
 

==================== Scheduled Tasks (whitelisted) =============
 

Task: {1932333D-E3F0-4C3D-9012-69351C5D5959} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)

Task: {2637A22B-A305-4ED3-8BEE-306F884768CE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-11-17] (Adobe Systems Incorporated)

Task: {3361ED9C-34B6-4601-9F05-C9D838436073} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

Task: {95D15B3C-4FD9-4959-B637-4E815555DDC1} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)

Task: {BBB2122A-84F7-468F-BD07-34C8008A38E3} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation)

Task: {FF1D667B-2D0A-4870-B8E5-454E9D3B039D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-08-22] (Piriform Ltd)

Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-08-22 22:19 - 2011-08-22 22:19 - 11204992 _____ () C:\Program Files\Toshiba\FlashCards\BlackPng.dll

2010-12-15 22:19 - 2010-12-15 22:19 - 00124320 _____ () C:\Program Files\Toshiba\TECO\MUIHelp.dll

2012-03-27 00:33 - 2012-03-27 00:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2012-05-11 00:25 - 2011-12-15 13:55 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll

2011-11-26 01:51 - 2011-11-26 01:51 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll

2013-02-13 02:38 - 2013-02-13 02:38 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll

2012-07-28 09:25 - 2012-03-06 22:27 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
 

==================== Alternate Data Streams (whitelisted) =========
 
 

==================== Safe Mode (whitelisted) ===================
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAVService => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos Client Firewall => ""="service"

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Sophos Client Firewall Manager => ""="service"
 

==================== Faulty Device Manager Devices =============
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (11/19/2013 01:06:59 PM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:01:58 AM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:01:58 AM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:01:55 AM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:01:55 AM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:01:42 AM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:01:33 AM) (Source: SideBySide) (User: )

Description: Activation context generation failed for "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.

A component version required by the application conflicts with another component version already active.

Conflicting components are:.

Component 1: C:\windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.

Component 2: C:\windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 

Error: (11/19/2013 11:00:12 AM) (Source: Customer Experience Improvement Program) (User: )

Description: 80004005
 

Error: (11/19/2013 10:46:17 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 

Error: (11/19/2013 10:45:31 AM) (Source: Windows Search Service) (User: )

Description: The index cannot be initialized.
 
 

Details:

        The content index catalog is corrupt.  (HRESULT : 0xc0041801) (0xc0041801)
 
 

System errors:

=============

Error: (11/19/2013 10:45:34 AM) (Source: Service Control Manager) (User: )

Description: The Windows Search service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 30000 milliseconds: Restart the service.
 

Error: (11/19/2013 10:45:34 AM) (Source: WMPNetworkSvc) (User: )

Description: WMPNetworkSvc0x80004005
 

Error: (11/19/2013 10:45:31 AM) (Source: Service Control Manager) (User: )

Description: The Windows Search service terminated with service-specific error %%-1073473535.
 

Error: (11/18/2013 03:43:40 PM) (Source: DCOM) (User: )

Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
 

Microsoft Office Sessions:

=========================
 

CodeIntegrity Errors:

===================================

  Date: 2013-11-17 18:08:44.762

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 

  Date: 2013-11-17 18:08:44.669

  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 

==================== Memory info =========================== 
 

Percentage of memory in use: 50%

Total physical RAM: 3996.36 MB

Available physical RAM: 1973.51 MB

Total Pagefile: 7990.9 MB

Available Pagefile: 5833.23 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (TI30878800B) (Fixed) (Total:448.8 GB) (Free:349.55 GB) NTFS ==>[System with boot components (obtained from reading drive)]
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: DEC2C14C)

Partition 1: (Active) - (Size=1 GB) - (Type=27)

Partition 2: (Not Active) - (Size=449 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=15 GB) - (Type=17)
 

==================== End Of Log ============================

ich hoffe alles ist so verlaufen wie es sein sollte, danke und gruesse

Adobe updaten.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Fertig :)

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Hallo Schrauber,

ich habe die abschliessenden Schritte auch alle durchgefuehrt und alles sieht fast ok aus - danke auf jeden fall fuer die Hilfe!

Wegen adobe - ist da dieser flash player gemeint? Bitte um Hinweise was ich da genau updaten soll, weil ich kenne mich nicht so super aus. In den letzten Tagen habe ich aber flash player und shockwave player (glaube ich) updates gemacht - weil von firefox so geraten.

Ich hatte ja oben schonmal von dieser ''Adware or PUA NirCmd' geschrieben die Sophos vor ein paar Tagen erkannt und weggepackt hatte. Als ich heute Nachmittag nach den letzten Schritten Neustart machte, habe ich Sophos nochmal durchlaufen lassen und es wurde wieder diese NirCmd erkannt und in Quarantaene gepackt.
Danach waehrend eines Quickscans mit malwarebytes kam das gleiche von Sophos nochmal ohne dass malwarebytes selbst irgendwas fand.

Wie bekomme ich diese adware am besten noch weg?

Und das troj / zbotmem-b jetzt einfach so in der Quarantaene von sophos verbleibt ist ok so? (Sitzt da naemlich noch so drin wie gehabt)

Danke auch fuer die Tipps und die Links mit den Programmen. Viele Gruesse

wo genau findet Sophos das?

Hallo, ich habe gerade die Eintraege im sophos anti-virus log durchgesehen und mal die von heute nachmittag rauskopiert - weil wurde eben gerade wieder gefunden.

Code:

****************** Sophos Anti-Virus Log - 21/11/2013 15:32:11 **************
 

    ...

20131120 143322        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143323        File "C:\32788R22FWJFW\NirCmdC.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143325        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143325        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143325        File "C:\32788R22FWJFW\nir.pif" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143346        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143346        On-access scanner has denied access to location "C:\32788R22FWJFW\iexplore.exe" for user NT AUTHORITY\SYSTEM

20131120 143347        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143347        On-access scanner has denied access to location "C:\32788R22FWJFW\iexplore.exe" for user toshiba\cs

20131120 143347        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143347        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user NT AUTHORITY\SYSTEM

20131120 143348        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143348        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user toshiba\cs

20131120 143348        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143348        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user NT AUTHORITY\SYSTEM

20131120 143349        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143349        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143400        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143400        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143404        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143404        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143407        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143407        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143409        File "C:\32788R22FWJFW\nir.pif" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143409        On-access scanner has denied access to location "C:\32788R22FWJFW\nir.pif" for user toshiba\cs

20131120 143411        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143411        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user toshiba\cs

20131120 143411        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143411        On-access scanner has denied access to location "C:\32788R22FWJFW\iexplore.exe" for user toshiba\cs

20131120 143412        File "C:\32788R22FWJFW\nir.pif" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143412        On-access scanner has denied access to location "C:\32788R22FWJFW\nir.pif" for user toshiba\cs

20131120 143412        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143412        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143412        File "C:\32788R22FWJFW\NirCmdC.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143412        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmdC.3XE" for user toshiba\cs

20131120 143415        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143415        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143415        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143415        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143417        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143417        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user toshiba\cs

20131120 143421        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143421        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user toshiba\cs

20131120 143422        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143422        On-access scanner has denied access to location "C:\32788R22FWJFW\iexplore.exe" for user toshiba\cs

20131120 143423        File "C:\32788R22FWJFW\nir.pif" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143423        On-access scanner has denied access to location "C:\32788R22FWJFW\nir.pif" for user toshiba\cs

20131120 143423        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143423        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143423        File "C:\32788R22FWJFW\NirCmdC.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143423        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmdC.3XE" for user toshiba\cs

20131120 143426        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143426        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user toshiba\cs

20131120 143426        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143426        On-access scanner has denied access to location "C:\32788R22FWJFW\iexplore.exe" for user toshiba\cs

20131120 143427        File "C:\32788R22FWJFW\nir.pif" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143427        On-access scanner has denied access to location "C:\32788R22FWJFW\nir.pif" for user toshiba\cs

20131120 143427        File "C:\32788R22FWJFW\NirCmd.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143427        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmd.3XE" for user toshiba\cs

20131120 143427        File "C:\32788R22FWJFW\NirCmdC.3XE" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143427        On-access scanner has denied access to location "C:\32788R22FWJFW\NirCmdC.3XE" for user toshiba\cs

20131120 143653        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143653        On-access scanner has denied access to location "C:\32788R22FWJFW\firefox.exe" for user toshiba\cs

20131120 143658        File "C:\Windows\NIRCMD.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 143658        On-access scanner has denied access to location "C:\Windows\NIRCMD.exe" for user toshiba\cs

20131120 144010        Using detection data version 4.95G (detection engine 3.48.0). This version can detect 5980894 items.

20131120 144011        User (NT AUTHORITY\LOCAL SERVICE) has started on-access scanning for this machine.

20131120 144349        Scan 'Scan my computer' started.

20131120 145010        File "C:\32788R22FWJFW\firefox.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 145010        File "C:\32788R22FWJFW\iexplore.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 145011        File "C:\32788R22FWJFW\nir.pif" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 145012        File "C:\Windows\NIRCMD.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 152139        File "C:\Users\cs\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 152200        File "C:\Users\cs\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 152230        Adware or PUA 'NirCmd' has been detected.

20131120 152230        Scan 'Scan my computer' completed.

20131120 152230        Summary of results for scan 'Scan my computer':

                Items scanned: 152403

                Errors: 0

                Items quarantined: 1

                Items dealt with: 0

20131120 153001        File "C:\Windows\NIRCMD.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 153001        On-access scanner has denied access to location "C:\Windows\NIRCMD.exe" for user toshiba\cs

20131120 153001        File "C:\Windows\NIRCMD.exe" belongs to adware or PUA 'NirCmd' (of type Other).

20131120 153001        On-access scanner has denied access to location "C:\Windows\NIRCMD.exe" for user toshiba\cs

    ...

      (85 items)

Ich hoffe das hilft, ich weiss sonst nicht wo ich nachsehen sollte wo sophos das findet.

Gruesse

Alle samt Fehlerkennungen. Das sind unsere benutzen Tools.

Ok, ich hatte aber die Tools entsprechend der letzten Schritte entfernt und zumindest alle Desktop files der Tools sind weg (logs und exes). Die geposteten Log Eintraege von sophos liegen alle zeitlich danach.

Und ich waere dankbar wenn ich nochmal kurz Rueckmeldung bekommen kann wegen des originalen trojaner Fundes der nach wie vor in der Sophos Quarantaene sitzt mit Zusatz 'kann nur manuell entfernt werden'.
Der Trojaner ist also definitiv bereinigt und der Quarantaene Eintrag ist bedeutungslos?

Du solltest das alles aus der Quarantäne löschen können. Du hast also Delfix laufen lassen?

hallo Schrauber,

ja Delfix hatte ich genau nach der Anleitung auch laufen lassen und alle Tools wurden auch entfernt - fast. Mir fiel naemlich heute morgen ein, dass ich mir die GMER exe auch runtergeladen hatte, ohne sie aber zu installieren.
Lag also noch im Download Ordner und habe ich dann heute morgen manuell geloescht und den NirCmd Eintrag aus der sophos Quarantaene auch.

Danach dann nochmal erst sophos und dann malwarebytes quickscan durchlaufen lassen, beides ohne Funde.

Der troj/zbotmem-b Eintrag sitzt aber eben weiterhin so in der Quarantaene wie gehabt - mit dem Vermerk 'No actions - manual cleanup required'. Dass wir uns nicht falsch verstehen, seit dem ersten Auftauchen wurde es nicht nochmal als gefunden gemeldet. Weder als Nachricht noch als Ergebnis der zig Scans seitdem.

Ich weiss nicht, inwieweit das jetzt noch was bedeutet oder bleibt der Eintrag einfach so bestehen obwohl alles bereinigt ist. Der Vermerk 'No actions - manual cleanup required' steht auch seit dem ersten Auftauchen und Verschieben in Quarantaene so dabei.

viele Gruesse