Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7: System und Browser sehr langsam: G-Service als ursache? (https://www.trojaner-board.de/148080-windows-7-system-browser-sehr-langsam-g-service-ursache.html)

baroness 17.01.2014 00:10
Windows 7: System und Browser sehr langsam: G-Service als ursache?
 
trojaner board



Hallo, ich hoffe ihr könnt mir helfen.

Vor kurzem sind mir an meinem Laptop einige Störungen aufgefallen (läuft sehr langsam obwohl erst kürzlich formatiert, I-net Seiten laden sehr langsam, starke CPU Auslastung etc). Bei einem Blick auf meine laufenden Prozesse ist mir das Programm G-Service aufgefallen. Da es mir unbekannt war hab ich erstmal drauf losgegoogled: siehe da, seltenere Art von malware/Virus (ohne genaue angaben).
Angeraten wurde den Prozess in den Diensten erstmal zu deaktivieren. Das habe ich getan. Danach hab ich mehrmals verschiedenste Virenscanner drüber laufen lassen: avast!antivir, Spyware Terminator, Malwarebytes sowie anti-rootkit von malwarebytes. KEINE FUNDE.

Da ich nicht unbedingt nochmal formatieren möchte wende ich mich an euch.
System: Windows 7/64bit

--> Defogger angewendet
--> Farbar Recovery Scan
--> GMER
alle im Anhang

GMER hat eine Fehlermeldung rausgegeben, fund: rootkit


Vielen Dank schonmal!

schrauber 17.01.2014 08:19
Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.


So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

baroness 17.01.2014 12:08
FRST


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-01-2014 03
Ran by Amanda (administrator) on ASUS on 16-01-2014 23:39:56
Running from C:\Users\Amanda\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe
() C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe
(COMPANYVERS_NAME) C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUS) C:\Windows\AsScrPro.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
( ) C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\Amanda\Downloads\Defogger.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] - C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe [485448 2013-12-25] ( )
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
MountPoints2: {5bb31dc7-522a-11e3-8e06-5404a626fb5c} - "F:\WD SmartWare.exe" autoplay=true
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [226920 2011-02-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [192616 2011-02-08] (NVIDIA Corporation)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM-x32 - DefaultScope {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKLM-x32 - {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
SearchScopes: HKCU - DefaultScope {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - {721061fb-eb79-4568-a03c-3ce26d68dae9} URL = hxxp://www.firetab.org/?type=ds3se&p={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll ()
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default
FF SearchEngineOrder.user_pref("browser.search.order.2", "");: user_pref("browser.search.order.2", "");
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @RadioRage_4j.com/Plugin - C:\Program Files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll (Mindspark)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Amanda\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FireJump - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\firejump@firejump.net [2013-12-04]
FF Extension: ProxTube - Unblock YouTube - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Heart Button - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ffextension@weheartit.com.xpi [2013-11-20]
FF Extension: Tumblr Savior - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi [2013-11-28]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-28]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2013-12-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-20]
FF HKLM-x32\...\Firefox\Extensions: [dnshelp@dnshelp.com] - C:\Users\Amanda\AppData\Roaming\Helper
FF Extension: Helper - C:\Users\Amanda\AppData\Roaming\Helper [2013-12-04]
FF HKCU\...\Firefox\Extensions: [firejump@firejump.net] - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\firejump@firejump.net
FF Extension: FireJump - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\firejump@firejump.net [2013-12-04]

Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.2.7_0 [2014-01-16]
CHR Extension: (Google Docs) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0 [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0 [2014-01-16]
CHR Extension: (YouTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0 [2014-01-16]
CHR Extension: (Google Search) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0 [2014-01-16]
CHR Extension: (AdBlock) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.18_0 [2014-01-16]
CHR Extension: (avast! Online Security) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2005.45_0 [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_0 [2014-01-16]
CHR Extension: (Gmail) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1 [2014-01-16]
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\Amanda\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-11-20]

==================== Services (Whitelisted) =================

R2 AddonsHelper; C:\Users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [896512 2013-12-04] ()
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 hshld; C:\Program Files (x86)\Hotspot Shield\bin\cmw_srv.exe [920872 2013-12-18] (AnchorFree Inc.)
S3 HssTrayService; C:\Program Files (x86)\Hotspot Shield\bin\HssTrayService.EXE [78512 2013-12-17] ()
R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [555304 2013-12-18] ()
R2 RadioRage_4jService; C:\Program Files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe [88648 2013-12-25] (COMPANYVERS_NAME)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-20] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2013-12-17] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-07] (Windows (R) Win 7 DDK provider)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-11-13] (Anchorfree Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-16 23:39 - 2014-01-16 23:40 - 00018870 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:33 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-16 23:32 - 2014-01-16 23:33 - 02076160 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 14:53 - 2014-01-16 19:32 - 00000112 _____ C:\Windows\setupact.log
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:52 - 2014-01-16 14:52 - 00000320 _____ C:\Windows\PFRO.log
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:45 - 2014-01-16 22:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 01:45 - 2014-01-16 19:37 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 01:45 - 2014-01-16 01:51 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:45 - 2014-01-16 01:51 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:45 - 2014-01-16 01:47 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:43 - 2014-01-16 01:44 - 00819144 _____ (Google Inc.) C:\Users\Amanda\Downloads\ChromeSetup.exe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 12:28 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:28 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-12 19:29 - 2014-01-12 23:04 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 19:27 - 2014-01-12 21:08 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-12 23:04 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 19:25 - 2014-01-12 19:26 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 19:18 - 2014-01-12 19:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-08 23:43 - 2014-01-09 00:05 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:14 - 2014-01-08 23:15 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 23:10 - 2014-01-10 03:08 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 22:49 - 2014-01-08 22:50 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:04 - 2014-01-08 22:21 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:26 - 2014-01-07 22:45 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-16 21:45 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com                                                ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\sh4ldr
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-07 15:54 - 2014-01-07 15:57 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:47 - 2014-01-07 15:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Amanda\Downloads\sh-remover.exe
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-04 12:45 - 2013-12-17 22:11 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-12-29 15:32 - 2013-12-29 21:30 - 00000000 ____D C:\Windows\Minidump
2013-12-27 19:03 - 2013-12-28 19:23 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:02 - 2014-01-04 12:44 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-25 02:01 - 2014-01-14 15:32 - 00000000 ____D C:\ProgramData\Hotspot Shield
2013-12-25 02:00 - 2014-01-04 12:45 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Hotspot Shield
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Program Files (x86)\RadioRage_4j
2013-12-25 01:35 - 2013-12-25 01:53 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:15 - 2013-12-23 13:49 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2007-09-10 08:50 - 00527360 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS
2013-12-20 20:23 - 2007-09-05 17:01 - 00008704 _____ (PixArt Imaging Inc.) C:\Windows\system32\CoInst_070910.dll
2013-12-20 20:23 - 2007-08-27 11:36 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.ax
2013-12-20 20:23 - 2007-03-20 16:44 - 00000566 _____ C:\Windows\SysWOW64\SP7302.ini
2013-12-20 20:23 - 2006-10-12 11:57 - 00014336 _____ (PixArt Imaging Inc.) C:\Windows\SysWOW64\P7302USD.dll
2013-12-20 19:49 - 2014-01-14 23:50 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2013-12-20 19:48 - 2013-12-20 19:49 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 23:05 - 2013-12-18 23:05 - 00027362 _____ C:\Users\Amanda\Documents\cc_20131218_230541.reg
2013-12-18 15:29 - 2013-12-18 15:29 - 00505578 _____ C:\Users\Amanda\Documents\ticket.xps

==================== One Month Modified Files and Folders =======

2014-01-16 23:40 - 2014-01-16 23:39 - 00018870 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:33 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-16 23:33 - 2014-01-16 23:32 - 02076160 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:31 - 2013-11-20 22:03 - 00000000 ____D C:\Users\Amanda
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 23:21 - 2013-11-21 22:30 - 02058326 _____ C:\Windows\WindowsUpdate.log
2014-01-16 22:56 - 2014-01-16 01:45 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 21:45 - 2014-01-07 15:58 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-16 19:41 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-16 19:41 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-16 19:37 - 2014-01-16 01:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 19:37 - 2013-11-20 22:03 - 00000000 ___HD C:\ASUS.DAT
2014-01-16 19:32 - 2014-01-16 14:53 - 00000112 _____ C:\Windows\setupact.log
2014-01-16 19:32 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-16 19:30 - 2013-11-20 23:08 - 00000000 ____D C:\Users\Amanda\AppData\Local\Last.fm
2014-01-16 19:30 - 2013-11-20 23:03 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Winamp
2014-01-16 14:54 - 2013-11-21 22:46 - 00001430 _____ C:\Windows\system32\ServiceFilter.ini
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:53 - 2009-07-14 05:45 - 00305344 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 14:52 - 2014-01-16 14:52 - 00000320 _____ C:\Windows\PFRO.log
2014-01-16 03:03 - 2013-11-27 12:44 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:03 - 2013-11-20 23:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 03:00 - 2013-11-27 12:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 01:51 - 2014-01-16 01:45 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:51 - 2014-01-16 01:45 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:47 - 2014-01-16 01:45 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:47 - 2011-04-13 03:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-16 01:44 - 2014-01-16 01:43 - 00819144 _____ (Google Inc.) C:\Users\Amanda\Downloads\ChromeSetup.exe
2014-01-15 12:56 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\LEBENSLAUF--Bewerbungen
2014-01-15 12:31 - 2013-11-20 22:35 - 00000000 ____D C:\Users\Amanda\AppData\Local\Adobe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 00:18 - 2011-02-19 05:24 - 00708282 _____ C:\Windows\system32\perfh007.dat
2014-01-15 00:18 - 2011-02-19 05:24 - 00151886 _____ C:\Windows\system32\perfc007.dat
2014-01-15 00:18 - 2009-07-14 06:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:06 - 2013-12-07 22:51 - 00000000 ____D C:\Users\Amanda\Desktop\Luni
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-14 23:56 - 2013-11-25 22:15 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\vlc
2014-01-14 23:50 - 2013-12-20 19:49 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2014-01-14 15:32 - 2013-12-25 02:01 - 00000000 ____D C:\ProgramData\Hotspot Shield
2014-01-13 16:45 - 2013-11-20 22:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-13 15:38 - 2009-07-14 06:08 - 00032572 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 23:04 - 2014-01-12 19:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 23:04 - 2014-01-12 19:26 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 21:08 - 2014-01-12 19:27 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-12 19:25 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:19 - 2014-01-12 19:18 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-10 03:08 - 2014-01-08 23:10 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-09 00:05 - 2014-01-08 23:43 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:15 - 2014-01-08 23:14 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 22:50 - 2014-01-08 22:49 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:21 - 2014-01-08 22:04 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:45 - 2014-01-07 22:26 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 16:05 - 2013-11-21 22:46 - 00002458 _____ C:\Windows\system32\AutoRunFilter.ini
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com                                                ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:57 - 2014-01-07 15:54 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\sh4ldr
2014-01-07 15:55 - 2014-01-07 15:55 - 00000000 ____D C:\Program Files\Enigma Software Group
2014-01-07 15:47 - 2014-01-07 15:47 - 00728960 _____ (Enigma Software Group USA, LLC.) C:\Users\Amanda\Downloads\sh-remover.exe
2014-01-07 15:45 - 2013-12-04 21:14 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\DesktopIconForAmazon
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-05 20:35 - 2013-11-20 23:42 - 00000000 ____D C:\Program Files\Adobe
2014-01-05 20:35 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-04 12:45 - 2013-12-25 02:00 - 00000000 ____D C:\Program Files (x86)\Hotspot Shield
2014-01-04 12:44 - 2013-12-25 02:02 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-30 20:27 - 2013-11-22 23:53 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-29 21:30 - 2013-12-29 15:32 - 00000000 ____D C:\Windows\Minidump
2013-12-28 19:23 - 2013-12-27 19:03 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Hotspot Shield
2013-12-25 02:00 - 2013-12-25 02:00 - 00000000 ____D C:\Program Files (x86)\RadioRage_4j
2013-12-25 01:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-25 01:53 - 2013-12-25 01:35 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:49 - 2013-12-23 13:15 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:32 - 2013-11-21 22:48 - 00000000 ____D C:\ProgramData\CyberLink
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-21 12:23 - 2013-11-20 22:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:25 - 2009-07-14 03:34 - 00000536 _____ C:\Windows\win.ini
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2013-11-21 22:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 19:49 - 2013-12-20 19:48 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-20 13:47 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-12-18 23:05 - 2013-12-18 23:05 - 00027362 _____ C:\Users\Amanda\Documents\cc_20131218_230541.reg
2013-12-18 15:29 - 2013-12-18 15:29 - 00505578 _____ C:\Users\Amanda\Documents\ticket.xps
2013-12-17 22:11 - 2014-01-04 12:45 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-10 18:17

==================== End Of Log ============================
--- --- ---

baroness 17.01.2014 12:09
Addition:

Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-01-2014 03
Ran by Amanda at 2014-01-16 23:40:26
Running from C:\Users\Amanda\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe Flash Player 10 ActiveX (x32 Version: 10.1.85.3 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.152 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (x32 Version: 7.0 - Adobe Systems, Inc.)
Adobe Photoshop Lightroom 5.2 64-bit (Version: 5.2.1 - Adobe)
Adobe Reader XI (11.0.06) - Deutsch (x32 Version: 11.0.06 - Adobe Systems Incorporated)
Alcor Micro USB Card Reader (x32 Version: 1.8.17.26026 - Alcor Micro Corp.)
Alcor Micro USB Card Reader (x32 Version: 1.8.17.26026 - Alcor Micro Corp.) Hidden
Apple Application Support (x32 Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
ASUS AI Recovery (x32 Version: 1.0.13 - ASUS)
ASUS FancyStart (x32 Version: 1.1.0 - ASUSTeK Computer Inc.)
ASUS LifeFrame3 (x32 Version: 3.0.21 - ASUS)
ASUS Live Update (x32 Version: 2.5.9 - ASUS)
ASUS Power4Gear Hybrid (Version: 1.1.43 - ASUS)
ASUS SmartLogon (x32 Version: 1.0.0011 - ASUS)
ASUS Virtual Camera (x32 Version: 1.0.21 - asus)
ASUS WebStorage (x32 Version: 3.0.84.161 - eCareme Technologies, Inc.)
AsusScr_K3 Series_ENG_Basic (x32 Version: 1.0.0001 - ASUS)
AsusVibe2.0 (x32 Version: 2.0.4.617 - ASUSTEK)
ATK Package (x32 Version: 1.0.0008 - ASUS)
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Bookworm Deluxe (x32 Version:  - Oberon Media Inc.)
CCleaner (Version: 4.07 - Piriform)
Cisco EAP-FAST Module (x32 Version: 2.2.14 - Cisco Systems, Inc.)
Cisco LEAP Module (x32 Version: 1.0.19 - Cisco Systems, Inc.)
Cisco PEAP Module (x32 Version: 1.1.6 - Cisco Systems, Inc.)
ComicRack v0.9.175 (Version: v0.9.175 - cYo Soft)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Cooking Dash (x32 Version:  - Oberon Media Inc.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Fast Boot (Version: 1.0.8 - ASUS)
FireJump (x32 Version: 1.0.2.8 - FireJump.net)
Free YouTube to MP3 Converter version 3.12.17.1127 (x32 Version: 3.12.17.1127 - DVDVideoSoft Ltd.)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Game Park Console (x32 Version: 6.2.1.1 - Oberon Media, Inc.)
G-Filter (HKCU Version:  - G-Filter)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Hotel Dash Suite Success (x32 Version:  - Oberon Media Inc.)
Hotspot Shield 3.23 (x32 Version: 3.23 - AnchorFree Inc.)
IC 445C Webcam (x32 Version: 1.0.0.19 - Micro Innovations)
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2291 - Intel Corporation)
Intel(R) Turbo Boost Technology Monitor 2.0 (Version: 2.1.23.0 - Intel)
IrfanView (remove only) (x32 Version: 4.36 - Irfan Skiljan)
iTunes (Version: 11.1.3.8 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Last.fm Scrobbler 2.1.36 (x32 Version:  - Last.fm)
Luxor 3 (x32 Version:  - Oberon Media Inc.)
Mahjongg dimensions (x32 Version:  - Oberon Media Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Neat Image v7.5.0 Demo Standalone (Version:  - Neat Image team, ABSoft)
Nuance PDF Reader (x32 Version: 6.00.0041 - Nuance Communications, Inc.)
NVIDIA Control Panel 266.86 (Version: 266.86 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 266.86 (Version: 266.86 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.39.0 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.0.18 (Version: 1.0.18 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.0.18 - NVIDIA Corporation) Hidden
Plants vs Zombies (x32 Version:  - Oberon Media Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Ralink RT2860 Wireless LAN Card (x32 Version: 1.5.9.0 - Ralink)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6324 - Realtek Semiconductor Corp.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
SpyHunter (Version: 4.16.5.4290 - Enigma Software Group USA, LLC)
Spyware Terminator 2012 (x32 Version: 3.0.0.82 - Crawler.com)
Synaptics Pointing Device Driver (Version: 15.2.16.1 - Synaptics Incorporated)
syncables desktop SE (x32 Version: 5.5.746.11492 - syncables)
Unity Web Player (HKCU Version:  - Unity Technologies ApS)
Update for 2007 Microsoft Office System (KB967642) (x32 Version:  - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32 Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (x32 Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (x32 Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (x32 Version:  - Microsoft)
VLC media player 2.1.1 (x32 Version: 2.1.1 - VideoLAN)
WD SmartWare (Version: 1.2.0.8 - Western Digital)
Winamp (x32 Version: 5.66  - Nullsoft, Inc)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Family Safety (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (x32 Version: 2.31.1 - ASUS)
Wireless Console 3 (x32 Version: 3.0.19 - ASUS)
World of Goo (x32 Version:  - Oberon Media Inc.)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (x32 Version: 15.4.5722.2 - Microsoft Corporation)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (x32 Version: 15.4.5722.2 - Microsoft Corporation)
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة (x32 Version: 15.4.5722.2 - Microsoft Corporation)
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (x32 Version: 15.4.5722.2 - Microsoft Corporation)

==================== Restore Points  =========================

08-01-2014 20:49:12 Removed Apple Application Support
08-01-2014 21:25:58 Installed iTunes
08-01-2014 22:08:41 Windows Update
09-01-2014 02:00:10 Windows Update
10-01-2014 02:00:13 Windows Update
14-01-2014 12:27:37 Windows Update
16-01-2014 02:00:18 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1856DB4E-A6C0-4398-BCF6-3A5CA75640D3} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2010-08-17] (ASUS)
Task: {30E77911-BD4F-41AD-94B1-5B78E3179CD9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {3AB838F1-C3A4-47A1-9DA9-5D8495C6283E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-22] (Piriform Ltd)
Task: {63A2F692-FCEC-4FD4-8B0E-0D81B0E02E06} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-12-02] (ASUS)
Task: {8F6433FD-5615-4157-BDFA-4991FD3F5854} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2010-11-15] (ASUS)
Task: {AF06E188-982B-4716-B3B9-AB1DEA939DE7} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {B635173B-6D24-402F-8212-304B170EBDC6} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-11-20] (AVAST Software)
Task: {BD456F48-DD99-43ED-9583-58EC92B9C766} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16] (Google Inc.)
Task: {D1DB345F-E058-48D0-9481-A161E27709D4} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16] (Google Inc.)
Task: {E2409936-C589-4BCF-8D52-3736A0196F7B} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-07-15 01:11 - 2010-07-15 01:11 - 00031360 _____ () C:\Program Files\P4G\DevMng.dll
2011-05-31 04:23 - 2011-01-27 01:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-16 14:54 - 2014-01-16 12:10 - 02155008 _____ () C:\Program Files\AVAST Software\Avast\defs\14011600\algo.dll
2014-01-16 23:33 - 2014-01-16 19:12 - 02155008 _____ () C:\Program Files\AVAST Software\Avast\defs\14011601\algo.dll
2013-12-18 19:11 - 2013-12-18 19:11 - 00908584 _____ () C:\Program Files (x86)\Hotspot Shield\bin\af_proxy.dll
2013-12-18 19:15 - 2013-12-18 19:15 - 00506664 _____ () C:\Program Files (x86)\Hotspot Shield\bin\HssRep.dll
2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2013-11-20 22:22 - 2013-11-20 22:22 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-01-16 01:47 - 2014-01-11 11:28 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libglesv2.dll
2014-01-16 01:47 - 2014-01-11 11:28 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\libegl.dll
2014-01-16 01:47 - 2014-01-11 11:29 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll
2014-01-16 01:47 - 2014-01-11 11:29 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll
2014-01-16 01:47 - 2014-01-11 11:28 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:D20FFA63

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (01/16/2014 07:32:58 PM) (Source: WDSmartWareBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
  bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
  bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
  bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
  --- Ende der internen Ausnahmestapelüberwachung ---
  bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
  bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
  bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
  bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
  bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
  bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.  bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
  bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
  bei RemoteServerService.WDSmartWareBackgroundService.OnStart(String[] args)

Error: (01/16/2014 05:49:50 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5023

Error: (01/16/2014 05:49:50 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5023

Error: (01/16/2014 05:49:50 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/16/2014 05:49:49 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4024

Error: (01/16/2014 05:49:49 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4024

Error: (01/16/2014 05:49:49 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (01/16/2014 05:49:48 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3010

Error: (01/16/2014 05:49:48 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3010

Error: (01/16/2014 05:49:48 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (01/16/2014 07:32:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (01/16/2014 07:32:28 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.

Error: (01/16/2014 02:53:36 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (01/16/2014 02:53:36 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Apple Mobile Device erreicht.

Error: (01/16/2014 01:22:27 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/16/2014 01:22:27 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/16/2014 01:22:26 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/16/2014 01:22:26 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/16/2014 01:22:25 AM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.

Error: (01/16/2014 00:36:32 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Apple Mobile Device" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 31%
Total physical RAM: 8104.14 MB
Available physical RAM: 5536.73 MB
Total Pagefile: 16206.47 MB
Available Pagefile: 13273.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:250.05 GB) (Free:110.53 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:321.12 GB) (Free:129.21 GB) NTFS
Drive e: (MIRANDA_S2) (CDROM) (Total:7.1 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: AA9693FE)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=250 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=321 GB) - (Type=OF Extended)

==================== End Of Log ============================

GMER
Code:
GMER 2.1.19322 - hxxp://www.gmer.net
Rootkit scan 2014-01-17 00:00:30
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JEDO 596,17GB
Running: hvrqjjul.exe; Driver: C:\Users\Amanda\AppData\Local\Temp\fxldrpoc.sys


---- User code sections - GMER 2.1 ----

.text    C:\Windows\system32\wininit.exe[740] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\WINLOGON.EXE[788] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SERVICES.EXE[836] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\LSASS.EXE[844] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                        0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[944] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\NVVSVC.EXE[148] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                        0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[352] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[504] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[636] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[656] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[736] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1164] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\FBAGENT.EXE[1372] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\Windows\system32\WLANExt.exe[1380] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe[1444] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                      0000000076bca2ba 1 byte [62]
.text    C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe[1460] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                            0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\NVVSVC.EXE[1472] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe[1732] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                        0000000076bca2ba 1 byte [62]
.text    C:\Windows\System32\spoolsv.exe[2008] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1068] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\Users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe[1668] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112  0000000076bca2ba 1 byte [62]
.text    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1652] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                        0000000076bca2ba 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[1824] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\CMW_SRV.EXE[1804] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\CMW_SRV.EXE[1804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                              0000000076771465 2 bytes [77, 76]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\CMW_SRV.EXE[1804] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                            00000000767714bb 2 bytes [77, 76]
.text    ...                                                                                                                                                                                              * 2
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\HSSWD.EXE[160] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                  0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\HSSWD.EXE[160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                0000000076771465 2 bytes [77, 76]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\HSSWD.EXE[160] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                00000000767714bb 2 bytes [77, 76]
.text    ...                                                                                                                                                                                              * 2
.text    C:\PROGRA~2\RADIOR~1\bar\1.bin\4jbarsvc.exe[2132] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                          0000000076bca2ba 1 byte [62]
.text    C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe[2192] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                            0000000076f8eecd 1 byte [62]
.text    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[2272] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                      0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe[2336] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189                                    0000000076f8eecd 1 byte [62]
.text    C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\WINDOWS LIVE\WLIDSVC.EXE[2852] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                              0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[3444] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                      0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\NVIDIA CORPORATION\NVIDIA UPDATUS\DAEMONU.EXE[3636] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\NVIDIA CORPORATION\NVIDIA UPDATUS\DAEMONU.EXE[3636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                              0000000076771465 2 bytes [77, 76]
.text    C:\PROGRAM FILES (X86)\NVIDIA CORPORATION\NVIDIA UPDATUS\DAEMONU.EXE[3636] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                              00000000767714bb 2 bytes [77, 76]
.text    ...                                                                                                                                                                                              * 2
.text    C:\WINDOWS\SYSTEM32\SVCHOST.EXE[3376] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE[1816] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                  0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\SEARCHINDEXER.EXE[1924] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4064] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                      0000000076bca2ba 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\TASKHOST.EXE[2184] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                    0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\DWM.EXE[2016] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                          0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\EXPLORER.EXE[3280] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                              0000000076f8eecd 1 byte [62]
.text    C:\Windows\AsScrPro.exe[3544] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                              0000000076bca2ba 1 byte [62]
.text    C:\Windows\AsScrPro.exe[3544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                                            0000000076771465 2 bytes [77, 76]
.text    C:\Windows\AsScrPro.exe[3544] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                                          00000000767714bb 2 bytes [77, 76]
.text    ...                                                                                                                                                                                              * 2
.text    C:\Windows\System32\igfxtray.exe[4012] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                    0000000076f8eecd 1 byte [62]
.text    C:\Windows\System32\hkcmd.exe[3268] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                        0000000076f8eecd 1 byte [62]
.text    C:\Windows\System32\igfxpers.exe[1124] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                    0000000076f8eecd 1 byte [62]
.text    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[4108] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe[4200] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                              0000000076f8eecd 1 byte [62]
.text    C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPENH.EXE[4284] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                        0000000076f8eecd 1 byte [62]
.text    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe[4404] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                0000000076bca2ba 1 byte [62]
.text    C:\Windows\PixArt\PAC7302\Monitor.exe[4580] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                                0000000076bca2ba 1 byte [62]
.text    C:\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe[4652] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                    0000000076f8eecd 1 byte [62]
.text    C:\PROGRAM FILES\REALTEK\AUDIO\HDA\RAVCPL64.EXE[4968] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\PROGRAM FILES (X86)\ASUS\ATK PACKAGE\ATK MEDIA\DMEDIA.EXE[5056] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                        0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\ASUS\ATK PACKAGE\ATK HOTKEY\HCONTROLUSER.EXE[1304] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                  0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\ASUS\WIRELESS CONSOLE 3\WCOURIER.EXE[4480] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                          0000000076bca2ba 1 byte [62]
.text    C:\Program Files\AVAST Software\Avast\AvastUI.exe[4680] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                    0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\AF_PROXY_CMD.EXE[5276] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                          0000000076bca2ba 1 byte [62]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\AF_PROXY_CMD.EXE[5276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                        0000000076771465 2 bytes [77, 76]
.text    C:\PROGRAM FILES (X86)\HOTSPOT SHIELD\BIN\AF_PROXY_CMD.EXE[5276] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                        00000000767714bb 2 bytes [77, 76]
.text    ...                                                                                                                                                                                              * 2
.text    C:\WINDOWS\SYSTEM32\STIKYNOT.EXE[5140] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189                                                                                                    0000000076f8eecd 1 byte [62]
.text    C:\WINDOWS\SYSTEM32\AUDIODG.EXE[5896] C:\Windows\System32\kernel32.dll!GetBinaryTypeW + 189                                                                                                      0000000076f8eecd 1 byte [62]
.text    C:\Users\Amanda\Downloads\hvrqjjul.exe[7100] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112                                                                                              0000000076bca2ba 1 byte [62]

---- Services - GMER 2.1 ----

Service  C:\Windows\system32\drivers\aswFsBlk.sys (*** hidden *** )                                                                                                                                      [AUTO] aswFsBlk                                                                                                                                                                                                                                                                                                    <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswMonFlt.sys (*** hidden *** )                                                                                                                                      [AUTO] aswMonFlt                                                                                                                                                                                                                                                                                                  <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswRdr2.sys (*** hidden *** )                                                                                                                                        [SYSTEM] aswRdr                                                                                                                                                                                                                                                                                                    <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswRvrt.sys (*** hidden *** )                                                                                                                                        [BOOT] aswRvrt                                                                                                                                                                                                                                                                                                    <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswSnx.sys (*** hidden *** )                                                                                                                                        [SYSTEM] aswSnx                                                                                                                                                                                                                                                                                                    <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswSP.sys (*** hidden *** )                                                                                                                                          [SYSTEM] aswSP                                                                                                                                                                                                                                                                                                    <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswTdi.sys (*** hidden *** )                                                                                                                                        [SYSTEM] aswTdi                                                                                                                                                                                                                                                                                                    <-- ROOTKIT !!!
Service  C:\Windows\system32\drivers\aswVmm.sys (*** hidden *** )                                                                                                                                        [BOOT] aswVmm                                                                                                                                                                                                                                                                                                      <-- ROOTKIT !!!
Service  C:\Program Files\AVAST Software\Avast\AvastSvc.exe (*** hidden *** )                                                                                                                            [AUTO] avast! Antivirus                                                                                                                                                                                                                                                                                            <-- ROOTKIT !!!

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type                                                                                                                                            2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start                                                                                                                                            2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl                                                                                                                                    1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag                                                                                                                                              2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ImagePath                                                                                                                                        \??\C:\Windows\system32\drivers\aswFsBlk.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName                                                                                                                                      aswFsBlk
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group                                                                                                                                            FSFilter Activity Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService                                                                                                                                  FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description                                                                                                                                      Avast! Mini-filter Driver
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances                                                                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance                                                                                                                        aswFsBlk Instance
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance                                                                                                                     
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                                                            388400
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                                                                0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk                                                                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type                                                                                                                                            2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start                                                                                                                                          2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl                                                                                                                                    1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath                                                                                                                                      \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName                                                                                                                                    aswMonFlt
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group                                                                                                                                          FSFilter Anti-Virus
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService                                                                                                                                FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description                                                                                                                                    avast! mini-filter driver (aswMonFlt)
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances                                                                                                                                     
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance                                                                                                                      aswMonFlt Instance
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                                                          320700
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                                                              0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt                                                                                                                                               
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl                                                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath                                                                                                                                          \??\C:\Windows\system32\drivers\aswRdr2.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName                                                                                                                                        aswRdr
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group                                                                                                                                              PNP_TDI
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService                                                                                                                                    tcpip?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description                                                                                                                                        avast! WFP Redirect driver
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters                                                                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                                                                     
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                                                                      nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRdr                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start                                                                                                                                            0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl                                                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName                                                                                                                                      avast! Revert
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters                                                                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter                                                                                                                            113
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter                                                                                                                            2543045
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot                                                                                                                            \Device\Harddisk0\Partition2\Windows
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown                                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596                                                                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@                                                                                                                            Commited
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@BootTimeout                                                                                                                0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@TickTimeout                                                                                                                0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@CreationTime                                                                                                                0xE9 0xFF 0xE1 0xD1 ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@SetupOperations                                                                                                            MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll",TRUE)?MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.sum.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll.sum",TRUE)?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@StartBootCounter                                                                                                            42
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\1387285596@StartTickCounter                                                                                                            1382758
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswRvrt                                                                                                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type                                                                                                                                              2
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl                                                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ImagePath                                                                                                                                          \??\C:\Windows\system32\drivers\aswSnx.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName                                                                                                                                        aswSnx
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group                                                                                                                                              FSFilter Virtualization
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService                                                                                                                                    FltMgr?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description                                                                                                                                        avast! virtualization driver (aswSnx)
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances                                                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance                                                                                                                          aswSnx Instance
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance                                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                                                                137600
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags                                                                                                                    0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters                                                                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder                                                                                                                          \??\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder                                                                                                                              \??\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSnx                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type                                                                                                                                                1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl                                                                                                                                        1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@ImagePath                                                                                                                                          \??\C:\Windows\system32\drivers\aswSP.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName                                                                                                                                        aswSP
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description                                                                                                                                        avast! Self Protection
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters                                                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield                                                                                                                              0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder                                                                                                                            \??\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder                                                                                                                              \??\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder                                                                                                                      \??\C:\Program Files
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder                                                                                                                            \??\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@NoWelcomeScreen                                                                                                                          1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswSP                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl                                                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag                                                                                                                                                10
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ImagePath                                                                                                                                          \??\C:\Windows\system32\drivers\aswTdi.sys
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName                                                                                                                                        aswTdi
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group                                                                                                                                              PNP_TDI
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService                                                                                                                                    tcpip?
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description                                                                                                                                        aswTdi
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswTdi                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type                                                                                                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start                                                                                                                                              0
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl                                                                                                                                      1
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName                                                                                                                                        avast! VM Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description                                                                                                                                        avast! VM Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters                                                                                                                                       
Reg      HKLM\SYSTEM\CurrentControlSet\services\aswVmm                                                                                                                                                   
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type                                                                                                                                    288
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start                                                                                                                                    2
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl                                                                                                                            1
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath                                                                                                                                "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName                                                                                                                              avast! Antivirus
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group                                                                                                                                    ShellSvcGroup
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService                                                                                                                          aswMonFlt?RpcSS?
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64                                                                                                                                    1
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName                                                                                                                              LocalSystem
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType                                                                                                                          1
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description                                                                                                                              Verwaltet und implementiert die avast! Antivirus Dienste auf diesem Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus Container sowie die Zeitplan.
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus\Parameters                                                                                                                             
Reg      HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus                                                                                                                                         
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e                                                                                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type                                                                                                                                                2
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start                                                                                                                                                2
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl                                                                                                                                        1
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag                                                                                                                                                  2
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ImagePath                                                                                                                                            \??\C:\Windows\system32\drivers\aswFsBlk.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName                                                                                                                                          aswFsBlk
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group                                                                                                                                                FSFilter Activity Monitor
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService                                                                                                                                      FltMgr?
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description                                                                                                                                          Avast! Mini-filter Driver
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)                                                                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance                                                                                                                            aswFsBlk Instance
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)                                                                                                 
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude                                                                                                                388400
Reg      HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags                                                                                                                    0
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type                                                                                                                                                2
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start                                                                                                                                              2
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl                                                                                                                                        1
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath                                                                                                                                          \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName                                                                                                                                        aswMonFlt
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group                                                                                                                                              FSFilter Anti-Virus
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService                                                                                                                                    FltMgr?
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description                                                                                                                                        avast! mini-filter driver (aswMonFlt)
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)                                                                                                                 
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance                                                                                                                          aswMonFlt Instance
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)                                                                                               
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude                                                                                                              320700
Reg      HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags                                                                                                                  0
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Type                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Start                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl                                                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath                                                                                                                                              \??\C:\Windows\system32\drivers\aswRdr2.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName                                                                                                                                            aswRdr
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Group                                                                                                                                                  PNP_TDI
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService                                                                                                                                        tcpip?
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr@Description                                                                                                                                            avast! WFP Redirect driver
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)                                                                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault                                                                                                                         
Reg      HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault                                                                                                                          nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll,bmnet.dll,winsflt.dll
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start                                                                                                                                                0
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl                                                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName                                                                                                                                          avast! Revert
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)                                                                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter                                                                                                                                113
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter                                                                                                                                2543045
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot                                                                                                                                \Device\Harddisk0\Partition2\Windows
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown                                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596 (not active ControlSet)                                                                                                       
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@                                                                                                                                Commited
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@BootTimeout                                                                                                                    0
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@TickTimeout                                                                                                                    0
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@CreationTime                                                                                                                    0xE9 0xFF 0xE1 0xD1 ...
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@SetupOperations                                                                                                                MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll",TRUE)?MoveFile("\??\c:\program files\avast software\avast\setup\instup.dll.sum.1387285596","\??\c:\program files\avast software\avast\setup\instup.dll.sum",TRUE)?
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@StartBootCounter                                                                                                                42
Reg      HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\1387285596@StartTickCounter                                                                                                                1382758
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Type                                                                                                                                                  2
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Start                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl                                                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@ImagePath                                                                                                                                              \??\C:\Windows\system32\drivers\aswSnx.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName                                                                                                                                            aswSnx
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Group                                                                                                                                                  FSFilter Virtualization
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService                                                                                                                                        FltMgr?
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx@Description                                                                                                                                            avast! virtualization driver (aswSnx)
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)                                                                                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance                                                                                                                              aswSnx Instance
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)                                                                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude                                                                                                                    137600
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags                                                                                                                        0
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)                                                                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder                                                                                                                              \??\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder                                                                                                                                  \??\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@Type                                                                                                                                                    1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@Start                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl                                                                                                                                            1
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@ImagePath                                                                                                                                              \??\C:\Windows\system32\drivers\aswSP.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName                                                                                                                                            aswSP
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP@Description                                                                                                                                            avast! Self Protection
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)                                                                                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield                                                                                                                                  0
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder                                                                                                                                \??\C:\Program Files\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder                                                                                                                                  \??\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder                                                                                                                          \??\C:\Program Files
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder                                                                                                                                \??\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg      HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@NoWelcomeScreen                                                                                                                              1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Type                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Start                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl                                                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag                                                                                                                                                    10
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@ImagePath                                                                                                                                              \??\C:\Windows\system32\drivers\aswTdi.sys
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName                                                                                                                                            aswTdi
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Group                                                                                                                                                  PNP_TDI
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService                                                                                                                                        tcpip?
Reg      HKLM\SYSTEM\ControlSet002\services\aswTdi@Description                                                                                                                                            aswTdi
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@Type                                                                                                                                                  1
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@Start                                                                                                                                                  0
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl                                                                                                                                          1
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName                                                                                                                                            avast! VM Monitor
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm@Description                                                                                                                                            avast! VM Monitor
Reg      HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)                                                                                                                   
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type                                                                                                                                        288
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start                                                                                                                                        2
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl                                                                                                                                1
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath                                                                                                                                    "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName                                                                                                                                  avast! Antivirus
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group                                                                                                                                        ShellSvcGroup
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService                                                                                                                              aswMonFlt?RpcSS?
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64                                                                                                                                        1
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName                                                                                                                                  LocalSystem
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType                                                                                                                              1
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description                                                                                                                                  Verwaltet und implementiert die avast! Antivirus Dienste auf diesem Computer. Dies beinhaltet den Echtzeit-Schutz, den Virus Container sowie die Zeitplan.
Reg      HKLM\SYSTEM\ControlSet002\services\avast! Antivirus\Parameters (not active ControlSet)                                                                                                         
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet)                                                                                                 

---- EOF - GMER 2.1 ----

schrauber 18.01.2014 07:17
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

baroness 18.01.2014 17:12
Code:
ComboFix 14-01-16.03 - Amanda 18.01.2014  16:49:28.1.8 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8104.5813 [GMT 1:00]
ausgeführt von:: c:\users\Amanda\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\RadioRage_4j
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jauxstb64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbar.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbarsvc.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbrmon64.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jbrstub64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdatact.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jdlghk64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jfeedmg.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhighin.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhkstub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhtmlmu.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jhttpct.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jidle.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmedint.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jmlbtn.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jPlugin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jradio.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jregfft.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jreghk.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jscript.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskin.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jskplay.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jSrchMn.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jsrchmr.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\4jtpinst.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\BOOTSTRAP.JS
c:\program files (x86)\RadioRage_4j\bar\1.bin\CHROME.MANIFEST
c:\program files (x86)\RadioRage_4j\bar\1.bin\chrome\4jffxtbr.jar
c:\program files (x86)\RadioRage_4j\bar\1.bin\CREXT.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\CrExtP4j.exe
c:\program files (x86)\RadioRage_4j\bar\1.bin\DPNMNGR.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\EXEMANAGER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\FF-NativeMessagingDispatcher.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\Hpg64.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\INSTALL.RDF
c:\program files (x86)\RadioRage_4j\bar\1.bin\installKeys.js
c:\program files (x86)\RadioRage_4j\bar\1.bin\LOGO.BMP
c:\program files (x86)\RadioRage_4j\bar\1.bin\NP4jStub.dll
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EPMSUP.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EXTEX.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8EXTPEX.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8HTML.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8RES.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\T8TICKER.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\UNIFIEDLOGGING.DLL
c:\program files (x86)\RadioRage_4j\bar\1.bin\VERIFY.DLL
c:\program files (x86)\RadioRage_4j\bar\gen1\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\IE9Mesg\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\Message\COMMON.T8S
c:\program files (x86)\RadioRage_4j\bar\Settings\s_pid.dat
c:\programdata\ASUS
c:\programdata\ASUS\LifeFrame\config0.cfg
c:\programdata\ASUS\LifeFrame\config1.cfg
c:\programdata\ASUS\LifeFrame\config2.cfg
c:\programdata\ASUS\LifeFrame\config3.cfg
c:\programdata\ASUS\LifeFrame\config4.cfg
c:\programdata\ASUS\LifeFrame\config5.cfg
c:\programdata\ASUS\LifeFrame\tmp0.img
c:\programdata\ASUS\LifeFrame\tmp1.img
c:\programdata\ASUS\LifeFrame\tmp2.img
c:\programdata\ASUS\LifeFrame\tmp3.img
c:\programdata\ASUS\LifeFrame\tmp4.img
c:\programdata\ASUS\LifeFrame\tmp5.img
c:\programdata\DNSErrorHelper\bhO.dll
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-12-18 bis 2014-01-18  ))))))))))))))))))))))))))))))
.
.
2014-01-18 15:54 . 2014-01-18 15:54        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2014-01-18 15:54 . 2014-01-18 15:54        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-01-17 11:09 . 2013-12-04 03:28        10315576        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CC1921C2-2CA6-4B9B-91BA-6E962B4ED219}\mpengine.dll
2014-01-16 23:56 . 2014-01-17 00:37        117464        ----a-w-        c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-01-16 22:33 . 2014-01-16 22:33        --------        d-----w-        C:\FRST
2014-01-16 00:45 . 2014-01-16 00:47        --------        d-----w-        c:\users\Amanda\AppData\Local\Google
2014-01-15 11:29 . 2014-01-15 11:29        --------        d-----w-        c:\programdata\McAfee
2014-01-15 11:28 . 2013-11-27 01:41        53248        ----a-w-        c:\windows\system32\drivers\usbehci.sys
2014-01-15 11:28 . 2013-11-27 01:41        343040        ----a-w-        c:\windows\system32\drivers\usbhub.sys
2014-01-15 11:28 . 2013-11-27 01:41        99840        ----a-w-        c:\windows\system32\drivers\usbccgp.sys
2014-01-15 11:28 . 2013-11-27 01:41        325120        ----a-w-        c:\windows\system32\drivers\usbport.sys
2014-01-15 11:28 . 2013-11-27 01:41        25600        ----a-w-        c:\windows\system32\drivers\usbohci.sys
2014-01-15 11:28 . 2013-11-27 01:41        30720        ----a-w-        c:\windows\system32\drivers\usbuhci.sys
2014-01-15 11:28 . 2013-11-27 01:41        7808        ----a-w-        c:\windows\system32\drivers\usbd.sys
2014-01-15 11:28 . 2013-11-26 10:32        3156480        ----a-w-        c:\windows\system32\win32k.sys
2014-01-15 11:28 . 2013-11-26 11:40        376768        ----a-w-        c:\windows\system32\drivers\netio.sys
2014-01-14 23:02 . 2014-01-14 23:02        --------        d-----w-        c:\users\Amanda\AppData\Local\Apps
2014-01-12 18:29 . 2014-01-17 00:52        --------        d-----w-        c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-01-12 18:27 . 2014-01-16 23:56        89304        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys
2014-01-12 18:20 . 2014-01-12 18:20        --------        d-----w-        c:\users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 18:20 . 2014-01-12 18:20        --------        d-----w-        c:\programdata\Malwarebytes
2014-01-12 18:20 . 2014-01-12 18:20        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2014-01-12 18:20 . 2013-04-04 13:50        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys
2014-01-12 17:55 . 2014-01-12 17:55        --------        d-----w-        c:\windows\system32\IO
2014-01-08 23:33 . 2014-01-08 23:33        --------        d-----w-        c:\users\Amanda\AppData\Roaming\cYo
2014-01-08 23:33 . 2014-01-08 23:33        --------        d-----w-        c:\users\Amanda\AppData\Local\cYo
2014-01-08 22:14 . 2014-01-08 22:15        --------        d-----w-        c:\program files\ComicRack
2014-01-08 21:27 . 2012-08-21 12:01        33240        ----a-w-        c:\windows\system32\drivers\GEARAspiWDM.sys
2014-01-08 21:26 . 2014-01-08 21:26        --------        d-----w-        c:\program files\iPod
2014-01-08 21:26 . 2014-01-08 21:27        --------        d-----w-        c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 21:26 . 2014-01-08 21:27        --------        d-----w-        c:\program files\iTunes
2014-01-08 21:26 . 2014-01-08 21:27        --------        d-----w-        c:\program files (x86)\iTunes
2014-01-08 21:25 . 2014-01-08 21:25        --------        d-----w-        c:\program files (x86)\Apple Software Update
2014-01-08 21:25 . 2014-01-08 21:25        --------        d-----w-        c:\program files\Common Files\Apple
2014-01-08 21:25 . 2014-01-08 21:25        --------        d-----w-        c:\program files\Bonjour
2014-01-08 21:25 . 2014-01-08 21:25        --------        d-----w-        c:\program files (x86)\Bonjour
2014-01-08 21:25 . 2014-01-08 21:26        --------        d-----w-        c:\program files (x86)\Common Files\Apple
2014-01-07 14:58 . 2014-01-07 14:58        51496        ----a-w-        c:\windows\system32\drivers\stflt.sys
2014-01-07 14:58 . 2014-01-17 16:10        --------        d-----w-        c:\programdata\Spyware Terminator
2014-01-07 14:58 . 2014-01-07 14:58        --------        d-----w-        c:\users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 14:58 . 2014-01-07 14:58        --------        d-----w-        c:\program files (x86)\Spyware Terminator
2014-01-07 14:54 . 2014-01-17 17:56        --------        d-----w-        c:\windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 14:54 . 2014-01-07 14:54        --------        d-----w-        c:\program files (x86)\Common Files\Wise Installation Wizard
2014-01-04 11:45 . 2013-12-17 21:11        44744        ----a-w-        c:\windows\system32\drivers\hssdrv6.sys
2013-12-26 02:00 . 2013-12-26 02:00        --------        d-----w-        c:\windows\SysWow64\Wat
2013-12-26 02:00 . 2013-12-26 02:00        --------        d-----w-        c:\windows\system32\Wat
2013-12-25 01:01 . 2014-01-14 14:32        --------        d-----w-        c:\programdata\Hotspot Shield
2013-12-25 01:00 . 2014-01-04 11:45        --------        d-----w-        c:\program files (x86)\Hotspot Shield
2013-12-25 01:00 . 2013-12-25 01:00        --------        d-----w-        c:\users\Amanda\AppData\Roaming\Hotspot Shield
2013-12-25 00:35 . 2013-12-25 00:35        --------        d-----w-        c:\users\Amanda\AppData\Roaming\ACStealth4
2013-12-25 00:35 . 2013-12-25 00:53        --------        d-----w-        c:\program files (x86)\ArchiCrypt Stealth 4
2013-12-23 12:32 . 2013-12-23 12:32        --------        d-----w-        c:\users\Amanda\AppData\Roaming\CyberLink
2013-12-23 12:32 . 2013-12-23 12:32        --------        d-----w-        c:\users\Public\CyberLink
2013-12-23 12:15 . 2013-12-23 12:49        --------        d-----w-        c:\program files\Lightroom Tutorial
2013-12-23 12:14 . 2013-12-23 12:14        --------        d-----w-        c:\programdata\Canneverbe Limited
2013-12-23 12:13 . 2013-12-23 12:13        --------        d-----w-        c:\users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 12:11 . 2013-12-23 12:11        --------        d-----w-        c:\users\Amanda\AppData\Roaming\GalileoPress
2013-12-20 19:23 . 2007-09-10 07:50        527360        ----a-w-        c:\windows\system32\drivers\PAC7302.SYS
2013-12-20 19:23 . 2007-09-05 16:01        8704        ----a-w-        c:\windows\system32\CoInst_070910.dll
2013-12-20 19:23 . 2013-12-20 19:23        --------        d-----w-        c:\program files (x86)\Common Files\PAC7302
2013-12-20 19:23 . 2013-12-20 19:23        --------        d-----w-        c:\windows\PixArt
2013-12-20 19:23 . 2013-12-20 19:23        --------        d-----w-        c:\program files (x86)\Micro Innovations
2013-12-20 19:23 . 2007-08-27 10:36        129024        ----a-w-        c:\windows\SysWow64\SP7302.ax
2013-12-20 19:23 . 2006-10-12 10:57        14336        ----a-w-        c:\windows\SysWow64\P7302USD.dll
2013-12-20 19:23 . 2013-12-20 19:23        --------        d-----w-        c:\users\Amanda\AppData\Roaming\InstallShield
2013-12-20 18:49 . 2014-01-14 22:50        --------        d-----w-        c:\users\Amanda\AppData\Roaming\Skype
2013-12-20 18:48 . 2013-12-20 18:48        --------        d-----w-        c:\program files (x86)\Common Files\Skype
2013-12-20 18:48 . 2013-12-20 18:48        --------        d-----r-        c:\program files (x86)\Skype
2013-12-20 18:48 . 2013-12-20 18:49        --------        d-----w-        c:\programdata\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-16 02:00 . 2013-11-27 11:44        86054176        ----a-w-        c:\windows\system32\MRT.exe
2013-11-28 03:09 . 2013-11-20 21:48        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-28 03:09 . 2013-11-20 21:48        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-26 11:54 . 2013-12-12 02:02        23183360        ----a-w-        c:\windows\system32\mshtml.dll
2013-11-26 10:19 . 2013-12-12 02:02        2724864        ----a-w-        c:\windows\system32\mshtml.tlb
2013-11-26 10:18 . 2013-12-12 02:02        4096        ----a-w-        c:\windows\system32\ieetwcollectorres.dll
2013-11-26 09:48 . 2013-12-12 02:02        66048        ----a-w-        c:\windows\system32\iesetup.dll
2013-11-26 09:46 . 2013-12-12 02:02        48640        ----a-w-        c:\windows\system32\ieetwproxystub.dll
2013-11-26 09:41 . 2013-12-12 02:02        2764288        ----a-w-        c:\windows\system32\iertutil.dll
2013-11-26 09:29 . 2013-12-12 02:02        53760        ----a-w-        c:\windows\system32\jsproxy.dll
2013-11-26 09:27 . 2013-12-12 02:02        33792        ----a-w-        c:\windows\system32\iernonce.dll
2013-11-26 09:23 . 2013-12-12 02:02        2724864        ----a-w-        c:\windows\SysWow64\mshtml.tlb
2013-11-26 09:21 . 2013-12-12 02:02        574976        ----a-w-        c:\windows\system32\ieui.dll
2013-11-26 09:18 . 2013-12-12 02:02        139264        ----a-w-        c:\windows\system32\ieUnatt.exe
2013-11-26 09:18 . 2013-12-12 02:02        111616        ----a-w-        c:\windows\system32\ieetwcollector.exe
2013-11-26 09:16 . 2013-12-12 02:02        708608        ----a-w-        c:\windows\system32\jscript9diag.dll
2013-11-26 08:57 . 2013-12-12 02:02        218624        ----a-w-        c:\windows\system32\ie4uinit.exe
2013-11-26 08:35 . 2013-12-12 02:02        5769216        ----a-w-        c:\windows\system32\jscript9.dll
2013-11-26 08:28 . 2013-12-12 02:02        553472        ----a-w-        c:\windows\SysWow64\jscript9diag.dll
2013-11-26 08:16 . 2013-12-12 02:02        4243968        ----a-w-        c:\windows\SysWow64\jscript9.dll
2013-11-26 08:02 . 2013-12-12 02:02        1995264        ----a-w-        c:\windows\system32\inetcpl.cpl
2013-11-26 07:48 . 2013-12-12 02:02        12996608        ----a-w-        c:\windows\system32\ieframe.dll
2013-11-26 07:32 . 2013-12-12 02:02        1928192        ----a-w-        c:\windows\SysWow64\inetcpl.cpl
2013-11-26 07:07 . 2013-12-12 02:02        2334208        ----a-w-        c:\windows\system32\wininet.dll
2013-11-26 06:40 . 2013-12-12 02:02        1395200        ----a-w-        c:\windows\system32\urlmon.dll
2013-11-26 06:34 . 2013-12-12 02:02        817664        ----a-w-        c:\windows\system32\ieapfltr.dll
2013-11-26 06:33 . 2013-12-12 02:02        1820160        ----a-w-        c:\windows\SysWow64\wininet.dll
2013-11-26 03:08 . 2013-11-26 03:08        940032        ----a-w-        c:\windows\system32\MsSpellCheckingFacility.exe
2013-11-26 03:08 . 2013-11-26 03:08        194048        ----a-w-        c:\windows\SysWow64\elshyph.dll
2013-11-26 03:08 . 2013-11-26 03:08        942592        ----a-w-        c:\windows\system32\jsIntl.dll
2013-11-26 03:08 . 2013-11-26 03:08        90112        ----a-w-        c:\windows\system32\SetIEInstalledDate.exe
2013-11-26 03:08 . 2013-11-26 03:08        86016        ----a-w-        c:\windows\SysWow64\iesysprep.dll
2013-11-26 03:08 . 2013-11-26 03:08        86016        ----a-w-        c:\windows\system32\RegisterIEPKEYs.exe
2013-11-26 03:08 . 2013-11-26 03:08        84992        ----a-w-        c:\windows\system32\mshtmled.dll
2013-11-26 03:08 . 2013-11-26 03:08        83968        ----a-w-        c:\windows\system32\MshtmlDac.dll
2013-11-26 03:08 . 2013-11-26 03:08        81408        ----a-w-        c:\windows\system32\icardie.dll
2013-11-26 03:08 . 2013-11-26 03:08        774144        ----a-w-        c:\windows\system32\jscript.dll
2013-11-26 03:08 . 2013-11-26 03:08        77312        ----a-w-        c:\windows\system32\tdc.ocx
2013-11-26 03:08 . 2013-11-26 03:08        74240        ----a-w-        c:\windows\SysWow64\SetIEInstalledDate.exe
2013-11-26 03:08 . 2013-11-26 03:08        71680        ----a-w-        c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-11-26 03:08 . 2013-11-26 03:08        645120        ----a-w-        c:\windows\SysWow64\jsIntl.dll
2013-11-26 03:08 . 2013-11-26 03:08        626176        ----a-w-        c:\windows\system32\msfeeds.dll
2013-11-26 03:08 . 2013-11-26 03:08        62464        ----a-w-        c:\windows\SysWow64\tdc.ocx
2013-11-26 03:08 . 2013-11-26 03:08        62464        ----a-w-        c:\windows\system32\pngfilt.dll
2013-11-26 03:08 . 2013-11-26 03:08        61952        ----a-w-        c:\windows\SysWow64\MshtmlDac.dll
2013-11-26 03:08 . 2013-11-26 03:08        61952        ----a-w-        c:\windows\SysWow64\iesetup.dll
2013-11-26 03:08 . 2013-11-26 03:08        616104        ----a-w-        c:\windows\system32\ieapfltr.dat
2013-11-26 03:08 . 2013-11-26 03:08        548352        ----a-w-        c:\windows\system32\vbscript.dll
2013-11-26 03:08 . 2013-11-26 03:08        52224        ----a-w-        c:\windows\system32\msfeedsbs.dll
2013-11-26 03:08 . 2013-11-26 03:08        51200        ----a-w-        c:\windows\SysWow64\ieetwproxystub.dll
2013-11-26 03:08 . 2013-11-26 03:08        48640        ----a-w-        c:\windows\SysWow64\mshtmler.dll
2013-11-26 03:08 . 2013-11-26 03:08        48640        ----a-w-        c:\windows\system32\mshtmler.dll
2013-11-26 03:08 . 2013-11-26 03:08        48128        ----a-w-        c:\windows\system32\imgutil.dll
2013-11-26 03:08 . 2013-11-26 03:08        454656        ----a-w-        c:\windows\SysWow64\vbscript.dll
2013-11-26 03:08 . 2013-11-26 03:08        453120        ----a-w-        c:\windows\system32\dxtmsft.dll
2013-11-26 03:08 . 2013-11-26 03:08        413696        ----a-w-        c:\windows\system32\html.iec
2013-11-26 03:08 . 2013-11-26 03:08        40448        ----a-w-        c:\windows\system32\JavaScriptCollectionAgent.dll
2013-11-26 03:08 . 2013-11-26 03:08        36352        ----a-w-        c:\windows\SysWow64\imgutil.dll
2013-11-26 03:08 . 2013-11-26 03:08        34816        ----a-w-        c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-11-26 03:08 . 2013-11-26 03:08        337408        ----a-w-        c:\windows\SysWow64\html.iec
2013-11-26 03:08 . 2013-11-26 03:08        30208        ----a-w-        c:\windows\system32\licmgr10.dll
2013-11-26 03:08 . 2013-11-26 03:08        296960        ----a-w-        c:\windows\system32\dxtrans.dll
2013-11-26 03:08 . 2013-11-26 03:08        263376        ----a-w-        c:\windows\system32\iedkcs32.dll
2013-11-26 03:08 . 2013-11-26 03:08        247808        ----a-w-        c:\windows\system32\msls31.dll
2013-11-26 03:08 . 2013-11-26 03:08        24576        ----a-w-        c:\windows\SysWow64\licmgr10.dll
2013-11-26 03:08 . 2013-11-26 03:08        243200        ----a-w-        c:\windows\system32\webcheck.dll
2013-11-26 03:08 . 2013-11-26 03:08        235520        ----a-w-        c:\windows\system32\url.dll
2013-11-26 03:08 . 2013-11-26 03:08        235008        ----a-w-        c:\windows\system32\elshyph.dll
2013-11-26 03:08 . 2013-11-26 03:08        195584        ----a-w-        c:\windows\system32\msrating.dll
2013-11-26 03:08 . 2013-11-26 03:08        182272        ----a-w-        c:\windows\SysWow64\msls31.dll
2013-11-26 03:08 . 2013-11-26 03:08        167424        ----a-w-        c:\windows\system32\iexpress.exe
2013-11-26 03:08 . 2013-11-26 03:08        151552        ----a-w-        c:\windows\SysWow64\iexpress.exe
2013-11-26 03:08 . 2013-11-26 03:08        147968        ----a-w-        c:\windows\system32\occache.dll
2013-11-26 03:08 . 2013-11-26 03:08        143872        ----a-w-        c:\windows\system32\wextract.exe
2013-11-26 03:08 . 2013-11-26 03:08        139264        ----a-w-        c:\windows\SysWow64\wextract.exe
2013-11-26 03:08 . 2013-11-26 03:08        13824        ----a-w-        c:\windows\system32\mshta.exe
2013-11-26 03:08 . 2013-11-26 03:08        135680        ----a-w-        c:\windows\system32\iepeers.dll
2013-11-26 03:08 . 2013-11-26 03:08        13312        ----a-w-        c:\windows\SysWow64\mshta.exe
2013-11-26 03:08 . 2013-11-26 03:08        13312        ----a-w-        c:\windows\system32\msfeedssync.exe
2013-11-26 03:08 . 2013-11-26 03:08        131072        ----a-w-        c:\windows\system32\IEAdvpack.dll
2013-11-26 03:08 . 2013-11-26 03:08        1228800        ----a-w-        c:\windows\system32\mshtmlmedia.dll
2013-11-26 03:08 . 2013-11-26 03:08        112128        ----a-w-        c:\windows\SysWow64\ieUnatt.exe
2013-11-26 03:08 . 2013-11-26 03:08        111616        ----a-w-        c:\windows\SysWow64\IEAdvpack.dll
2013-11-26 03:08 . 2013-11-26 03:08        105984        ----a-w-        c:\windows\system32\iesysprep.dll
2013-11-26 03:08 . 2013-11-26 03:08        1051136        ----a-w-        c:\windows\SysWow64\mshtmlmedia.dll
2013-11-26 03:08 . 2013-11-26 03:08        101376        ----a-w-        c:\windows\system32\inseng.dll
2013-11-23 18:26 . 2013-12-12 01:26        417792        ----a-w-        c:\windows\SysWow64\WMPhoto.dll
2013-11-23 17:47 . 2013-12-12 01:26        465920        ----a-w-        c:\windows\system32\WMPhoto.dll
2013-11-22 02:41 . 2013-11-22 02:41        9728        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        9728        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        648192        ----a-w-        c:\windows\system32\d3d10level9.dll
2013-11-22 02:41 . 2013-11-22 02:41        604160        ----a-w-        c:\windows\SysWow64\d3d10level9.dll
2013-11-22 02:41 . 2013-11-22 02:41        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        5632        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        5632        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        522752        ----a-w-        c:\windows\system32\XpsGdiConverter.dll
2013-11-22 02:41 . 2013-11-22 02:41        4096        ---ha-w-        c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        4096        ---ha-w-        c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-11-22 02:41 . 2013-11-22 02:41        3928064        ----a-w-        c:\windows\system32\d2d1.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoogleChromeAutoLaunch_B5BA1AC00E9D5F3D11339DA34D270473"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-01-11 866584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-04-13 2018032]
"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe" [2011-02-23 731472]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2010-08-17 5732992]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2010-09-24 1601536]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2009-05-20 222504]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2013-11-20 3568312]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-01 152392]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2013-11-20 113664]
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-4-13 548528]
FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_94E3CE3704FE82FBF49A6A.exe -d [2013-11-21 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 AddonsHelper;AddonsHelper;c:\users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe;c:\users\Amanda\AppData\Local\Temp\OCS\Downloads\db6c8e043b5806271c5ea5ad27b5c968\8a2438a7aa1e858526caff1f4deab159\AddonsHelper.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel(R) Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\DRIVERS\hssdrv6.sys;c:\windows\SYSNATIVE\DRIVERS\hssdrv6.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys;c:\windows\SYSNATIVE\drivers\aswFsBlk.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 hshld;Hotspot Shield Service;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe;c:\program files (x86)\Hotspot Shield\bin\cmw_srv.exe [x]
S2 HssWd;Hotspot Shield Monitoring Service;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe;c:\program files (x86)\Hotspot Shield\bin\hsswd.exe [x]
S2 RadioRage_4jService;RadioRageService;c:\progra~2\RADIOR~1\bar\1.bin\4jbarsvc.exe;c:\progra~2\RADIOR~1\bar\1.bin\4jbarsvc.exe [x]
S2 sp_rsdrv2;Spyware Terminator Driver Filter;c:\windows\system32\DRIVERS\stflt.sys;c:\windows\SYSNATIVE\DRIVERS\stflt.sys [x]
S2 ST2012_Svc;Spyware Terminator 2012 Realtime Shield Service;c:\program files (x86)\Spyware Terminator\st_rsser64.exe;c:\program files (x86)\Spyware Terminator\st_rsser64.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 WDDMService;WD SmartWare Drive Manager Service;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe;c:\program files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe [x]
S2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe;c:\program files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-01-16 00:47        1211672        ----a-w-        c:\program files (x86)\Google\Chrome\Application\32.0.1700.76\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16 00:45]
.
2014-01-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-01-16 00:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2013-11-20 21:22        326944        ----a-w-        c:\program files\AVAST Software\Avast\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2010-09-02 08:41        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2010-09-02 08:41        220160        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-02-10 167960]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-10 418328]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-03-01 2189416]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2010-08-11 324096]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"PAC7302_Monitor"="c:\windows\PixArt\PAC7302\Monitor.exe" [2006-11-03 319488]
"SpywareTerminatorShield"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorShield.exe" [2013-04-03 2777736]
"SpywareTerminatorUpdater"="c:\program files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe" [2013-04-03 3684488]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>127.0.0.1;localhost;10.*;192.168.*;127.0.0.1:895;127.0.0.1:896;*.local
uInternet Settings,ProxyServer = http=127.0.0.1:8555;https=127.0.0.1:8555
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - ExtSQL: 2013-11-20 22:22; wrc@avast.com; c:\program files\AVAST Software\Avast\WebRep\FF
FF - ExtSQL: 2013-11-21 00:05; ffextension@weheartit.com; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\ffextension@weheartit.com.xpi
FF - ExtSQL: 2013-11-22 00:55; youtubeunblocker@unblocker.yt; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\youtubeunblocker@unblocker.yt
FF - ExtSQL: 2013-11-28 03:24; jid1-W5guVoyeUR0uBg@jetpack; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi
FF - ExtSQL: 2013-11-28 21:14; {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF - ExtSQL: 2013-12-04 21:14; ich@maltegoetz.de; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\ich@maltegoetz.de
FF - ExtSQL: 2013-12-20 02:37; {c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi
FF - ExtSQL: !HIDDEN! 2013-12-04 21:14; firejump@firejump.net; c:\users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\extensions\firejump@firejump.net
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{9B6B03F1-16CF-4491-BBBB-E872802DD717} - c:\programdata\DNSErrorHelper\bho.dll
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\SYSTEM32\STIKYNOT.EXE
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe
HKLM-Run-RadioRage Home Page Guard 64 bit - c:\progra~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-18  16:56:18
ComboFix-quarantined-files.txt  2014-01-18 15:56
.
Vor Suchlauf: 12 Verzeichnis(se), 119.487.881.216 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 119.329.918.976 Bytes frei
.
- - End Of File - - ED4F1550CA802F2568E4D9808853EB71

schrauber 19.01.2014 10:25
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

baroness 19.01.2014 14:00
Malwarebytes kein Fund

Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.19.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
Amanda :: ASUS [Administrator]

19.01.2014 13:07:08
mbam-log-2014-01-19 (13-07-08).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 240276
Laufzeit: 5 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Adwarecleaner hat Hotspotshield dateien mit aufgelistet und gelöscht, HSS ist aber meines Wissens nach nix gefährliches, ich würde es auch gern in Zukunft wieder nutzen...

Code:
# AdwCleaner v3.017 - Bericht erstellt am 19/01/2014 um 13:21:38
# Aktualisiert 12/01/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Amanda - ASUS
# Gestartet von : C:\Users\Amanda\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : AddonsHelper
Dienst Gelöscht : hshld
[#] Dienst Gelöscht : hsstrayservice
Dienst Gelöscht : hsswd
[#] Dienst Gelöscht : RadioRage_4jService

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\DNSErrorHelper
Ordner Gelöscht : C:\ProgramData\hotspot shield
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hotspot shield
Ordner Gelöscht : C:\Program Files (x86)\hotspot shield
Ordner Gelöscht : C:\Users\Amanda\AppData\LocalLow\RadioRage_4j
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\HELPER
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\hotspot shield
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\firejump@firejump.net

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [dnshelp@dnshelp.com]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [firejump@firejump.net]
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.FeedManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.FeedManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLMenu
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLMenu.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLPanel
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.HTMLPanel.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.MultipleButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.MultipleButton.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.PseudoTransparentPlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.PseudoTransparentPlugin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.Radio
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.Radio.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.RadioSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.RadioSettings.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ScriptButton
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ScriptButton.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.SettingsPlugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.SettingsPlugin.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ThirdPartyInstaller
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\RadioRage_4j.ThirdPartyInstaller.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@RadioRage_4j.com/Plugin
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00A2B7C6-7487-4B99-9F6C-1FDF57FE130B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{11D4B723-18CA-48C6-BA13-965488F19A70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{53855564-CF81-410C-9C1C-321C7E067816}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{581C7D7D-F809-4E03-A631-74C069D5F04A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{78BA36C9-6036-482B-B48D-ECCA6F964B84}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9638B7D6-11F5-4406-B387-327642A11FFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D740AD89-BAF4-47D5-9B5E-343D30F07A7A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DFEB941C-8B58-4899-97C3-88FE394E1285}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E23760BE-23A3-4CEF-9304-66AF079F53DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E6AD866F-EA06-476A-8432-ED943683FAB1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ECEF0D95-32FA-48D3-8A2D-D6453B5B7361}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F69FE1BE-09C3-460C-AC89-8CCD9D3DF1CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F706E19B-6C14-4272-BA98-2F16636A898D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{0978C5FA-83C0-4118-A54F-99DACCEECB8C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1ED65BE2-AE84-46CB-8EA6-1C2B86ADF768}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{1FDAD7F1-B87C-4E79-9150-DE235FF80B3A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A50E810-71EB-43A8-A665-19ED8CCD1630}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4DD9EB5D-8657-4856-A804-535841B09D73}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{569A9014-22E3-4F11-A243-CA4E3D95ADED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{597494DA-C59F-4EDF-B2D1-CE137E2DB9E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{5E5E0B49-1A81-4ACC-BD6B-FF5F4EFEF01A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B872D222-3F52-4CD9-A4BE-9D69EE4F293D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{581C7D7D-F809-4E03-A631-74C069D5F04A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{60B34F47-3FDD-46F8-AB6C-AAABEA55C3D6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{68122F44-3A4A-4EDB-B28F-0C0E07F89BD0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9638B7D6-11F5-4406-B387-327642A11FFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F706E19B-6C14-4272-BA98-2F16636A898D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{53855564-CF81-410C-9C1C-321C7E067816}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{721061FB-EB79-4568-A03C-3CE26D68DAE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{721061FB-EB79-4568-A03C-3CE26D68DAE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A25AA6E2-1CDE-4D0F-A5D4-4898D7FB3C86}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A5C9CB1C-1C0A-45A2-81CC-1DD342D0A478}
Schlüssel Gelöscht : HKCU\Software\anchorfree
Schlüssel Gelöscht : HKCU\Software\FLEXnet
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\RadioRage_4j
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\hotspotshield
Schlüssel Gelöscht : HKLM\Software\RadioRage_4j
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{206a7328-437f-4bd9-b53e-12bfee24d588}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\hotspotshield
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RadioRage_4jbar Uninstall Firefox

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\prefs.js ]


-\\ Google Chrome v32.0.1700.76

[ Datei : C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [8381 octets] - [19/01/2014 13:17:26]
AdwCleaner[S0].txt - [7949 octets] - [19/01/2014 13:21:38]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8009 octets] ##########

Junkware removal tool, hat ebenfalls Hotspotshield dateien entfernt :-/

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Amanda on 19.01.2014 at 13:41:46,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\hotspot shield"
Successfully deleted: [Folder] "C:\Program Files (x86)\hotspot shield"



~~~ FireFox

Emptied folder: C:\Users\Amanda\AppData\Roaming\mozilla\firefox\profiles\p56h4w7p.default\minidumps [16 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.01.2014 at 13:54:04,40
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

neues FRST.log


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014
Ran by Amanda (administrator) on ASUS on 19-01-2014 13:55:47
Running from C:\Users\Amanda\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] - "C:\PROGRA~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default
FF SearchEngineOrder.user_pref("browser.search.order.2", "");: user_pref("browser.search.order.2", "");
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Amanda\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Heart Button - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ffextension@weheartit.com.xpi [2013-11-20]
FF Extension: Tumblr Savior - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi [2013-11-28]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-28]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2013-12-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-20]

Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-01-16]
CHR Extension: (Google Docs) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16]
CHR Extension: (YouTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16]
CHR Extension: (Chrome YouTube Downloader) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdjiinahkdjdcdlgfimlcolkjpbooja [2014-01-18]
CHR Extension: (Google-Suche) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16]
CHR Extension: (AdBlock) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-16]
CHR Extension: (avast! Online Security) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16]
CHR Extension: (YouTube Unblocker) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2014-01-17]
CHR Extension: (Google Mail) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16]
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\Amanda\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-11-20]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-20] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2013-12-17] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-07] (Windows (R) Win 7 DDK provider)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-11-13] (Anchorfree Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:54 - 2014-01-19 13:54 - 00000897 _____ C:\Users\Amanda\Desktop\JRT.txt
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:27 - 2014-01-19 13:27 - 00008097 _____ C:\Users\Amanda\Desktop\AdwCleaner[S0].txt
2014-01-19 13:17 - 2014-01-19 13:21 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-19 13:10 - 2014-01-19 13:10 - 01037068 _____ (Thisisu) C:\Users\Amanda\Desktop\JRT.exe
2014-01-19 13:08 - 2014-01-19 13:08 - 01236282 _____ C:\Users\Amanda\Desktop\adwcleaner.exe
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:48 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-18 16:48 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-18 16:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-18 16:47 - 2014-01-18 16:56 - 00000000 ____D C:\Qoobox
2014-01-18 16:47 - 2014-01-18 16:55 - 00000000 ____D C:\Windows\erdnt
2014-01-18 16:43 - 2014-01-18 16:44 - 05167985 ____R (Swearware) C:\Users\Amanda\Desktop\ComboFix.exe
2014-01-18 02:29 - 2014-01-18 02:30 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 01:49 - 2014-01-19 13:55 - 00016000 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:33 - 2014-01-19 13:55 - 00000000 ____D C:\FRST
2014-01-16 23:32 - 2014-01-19 13:55 - 02076672 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 14:53 - 2014-01-19 13:25 - 00000560 _____ C:\Windows\setupact.log
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:52 - 2014-01-18 17:13 - 00000872 _____ C:\Windows\PFRO.log
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:45 - 2014-01-19 13:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 01:45 - 2014-01-19 13:26 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 01:45 - 2014-01-16 01:51 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:45 - 2014-01-16 01:51 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:45 - 2014-01-16 01:47 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 12:28 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:28 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-12 19:29 - 2014-01-17 01:52 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 19:27 - 2014-01-17 00:56 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-17 01:52 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 19:25 - 2014-01-12 19:26 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 19:18 - 2014-01-12 19:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-08 23:43 - 2014-01-09 00:05 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:14 - 2014-01-08 23:15 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 23:10 - 2014-01-10 03:08 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 22:49 - 2014-01-08 22:50 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:04 - 2014-01-08 22:21 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:26 - 2014-01-07 22:45 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-17 17:10 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com                                                ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:55 - 2014-01-17 18:56 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:54 - 2014-01-17 18:56 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-04 12:45 - 2013-12-17 22:11 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-12-29 15:32 - 2013-12-29 21:30 - 00000000 ____D C:\Windows\Minidump
2013-12-27 19:03 - 2013-12-28 19:23 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:02 - 2014-01-04 12:44 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-25 01:35 - 2013-12-25 01:53 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:15 - 2013-12-23 13:49 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2007-09-10 08:50 - 00527360 _____ (PixArt Imaging Inc.) C:\Windows\system32\Drivers\PAC7302.SYS
2013-12-20 20:23 - 2007-09-05 17:01 - 00008704 _____ (PixArt Imaging Inc.) C:\Windows\system32\CoInst_070910.dll
2013-12-20 20:23 - 2007-08-27 11:36 - 00129024 _____ (PixArt Imaging Incorporation) C:\Windows\SysWOW64\SP7302.ax
2013-12-20 20:23 - 2007-03-20 16:44 - 00000566 _____ C:\Windows\SysWOW64\SP7302.ini
2013-12-20 20:23 - 2006-10-12 11:57 - 00014336 _____ (PixArt Imaging Inc.) C:\Windows\SysWOW64\P7302USD.dll
2013-12-20 19:49 - 2014-01-14 23:50 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2013-12-20 19:48 - 2013-12-20 19:49 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-01-19 13:56 - 2014-01-17 01:49 - 00016000 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-19 13:56 - 2014-01-16 01:45 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:55 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-19 13:55 - 2014-01-16 23:32 - 02076672 _____ (Farbar) C:\Users\Amanda\Downloads\FRST64.exe
2014-01-19 13:54 - 2014-01-19 13:54 - 00000897 _____ C:\Users\Amanda\Desktop\JRT.txt
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:35 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-19 13:35 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-19 13:27 - 2014-01-19 13:27 - 00008097 _____ C:\Users\Amanda\Desktop\AdwCleaner[S0].txt
2014-01-19 13:26 - 2014-01-16 01:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-19 13:26 - 2013-11-20 22:03 - 00000000 ___HD C:\ASUS.DAT
2014-01-19 13:25 - 2014-01-16 14:53 - 00000560 _____ C:\Windows\setupact.log
2014-01-19 13:25 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-19 13:24 - 2013-11-21 22:30 - 01197542 _____ C:\Windows\WindowsUpdate.log
2014-01-19 13:21 - 2014-01-19 13:17 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-19 13:10 - 2014-01-19 13:10 - 01037068 _____ (Thisisu) C:\Users\Amanda\Desktop\JRT.exe
2014-01-19 13:09 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\Random cool shit
2014-01-19 13:08 - 2014-01-19 13:08 - 01236282 _____ C:\Users\Amanda\Desktop\adwcleaner.exe
2014-01-19 04:45 - 2013-11-25 22:15 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\vlc
2014-01-19 00:12 - 2013-11-20 23:08 - 00000000 ____D C:\Users\Amanda\AppData\Local\Last.fm
2014-01-18 17:13 - 2014-01-16 14:52 - 00000872 _____ C:\Windows\PFRO.log
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:56 - 2014-01-18 16:47 - 00000000 ____D C:\Qoobox
2014-01-18 16:56 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-18 16:55 - 2014-01-18 16:47 - 00000000 ____D C:\Windows\erdnt
2014-01-18 16:54 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-18 16:44 - 2014-01-18 16:43 - 05167985 ____R (Swearware) C:\Users\Amanda\Desktop\ComboFix.exe
2014-01-18 12:08 - 2013-11-21 22:46 - 00002570 _____ C:\Windows\system32\AutoRunFilter.ini
2014-01-18 02:30 - 2014-01-18 02:29 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 18:56 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-17 18:56 - 2014-01-07 15:54 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-17 17:10 - 2014-01-07 15:58 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-17 12:06 - 2013-11-20 22:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-17 01:52 - 2014-01-12 19:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-17 01:52 - 2014-01-12 19:26 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-17 00:56 - 2014-01-12 19:27 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:31 - 2013-11-20 22:03 - 00000000 ____D C:\Users\Amanda
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 19:30 - 2013-11-20 23:03 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Winamp
2014-01-16 14:54 - 2013-11-21 22:46 - 00001430 _____ C:\Windows\system32\ServiceFilter.ini
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:53 - 2009-07-14 05:45 - 00305344 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-11-27 12:44 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:03 - 2013-11-20 23:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 03:00 - 2013-11-27 12:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 01:51 - 2014-01-16 01:45 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:51 - 2014-01-16 01:45 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:47 - 2014-01-16 01:45 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:47 - 2011-04-13 03:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-15 12:56 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\LEBENSLAUF--Bewerbungen
2014-01-15 12:31 - 2013-11-20 22:35 - 00000000 ____D C:\Users\Amanda\AppData\Local\Adobe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 00:18 - 2011-02-19 05:24 - 00708282 _____ C:\Windows\system32\perfh007.dat
2014-01-15 00:18 - 2011-02-19 05:24 - 00151886 _____ C:\Windows\system32\perfc007.dat
2014-01-15 00:18 - 2009-07-14 06:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:06 - 2013-12-07 22:51 - 00000000 ____D C:\Users\Amanda\Desktop\Luni
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-14 23:50 - 2013-12-20 19:49 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2014-01-13 15:38 - 2009-07-14 06:08 - 00032572 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 19:26 - 2014-01-12 19:25 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:19 - 2014-01-12 19:18 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-10 03:08 - 2014-01-08 23:10 - 01620410 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-09 00:05 - 2014-01-08 23:43 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:15 - 2014-01-08 23:14 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 22:50 - 2014-01-08 22:49 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:21 - 2014-01-08 22:04 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:45 - 2014-01-07 22:26 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com                                                ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-05 20:35 - 2013-11-20 23:42 - 00000000 ____D C:\Program Files\Adobe
2014-01-05 20:35 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-04 12:44 - 2013-12-25 02:02 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-30 20:27 - 2013-11-22 23:53 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-29 21:30 - 2013-12-29 15:32 - 00000000 ____D C:\Windows\Minidump
2013-12-28 19:23 - 2013-12-27 19:03 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 01:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-25 01:53 - 2013-12-25 01:35 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:49 - 2013-12-23 13:15 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:32 - 2013-11-21 22:48 - 00000000 ____D C:\ProgramData\CyberLink
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-21 12:23 - 2013-11-20 22:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-12-20 21:10 - 2013-12-20 21:10 - 00921632 _____ C:\PA7302.DAT
2013-12-20 20:25 - 2009-07-14 03:34 - 00000536 _____ C:\Windows\win.ini
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Windows\PixArt
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\InstallShield
2013-12-20 20:23 - 2013-12-20 20:23 - 00000000 ____D C:\Program Files (x86)\Micro Innovations
2013-12-20 20:23 - 2013-11-21 22:37 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-12-20 19:49 - 2013-12-20 19:48 - 00000000 ____D C:\ProgramData\Skype
2013-12-20 19:48 - 2013-12-20 19:48 - 00002699 _____ C:\Users\Public\Desktop\Skype.lnk
2013-12-20 19:48 - 2013-12-20 19:48 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-20 14:58 - 2013-12-20 14:58 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-20 13:47 - 2009-07-14 06:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD

Some content of TEMP:
====================
C:\Users\Amanda\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-10 18:17

==================== End Of Log ============================
--- --- ---

schrauber 20.01.2014 12:09

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

baroness 20.01.2014 23:53
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1f48d1fb3990fc4ea5bb5cd5f4029fc4
# engine=16724
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-01-20 09:01:49
# local_time=2014-01-20 10:01:49 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 71 77 1927358 5272787 0 0
# compatibility_mode=5893 16776573 100 94 298322 141881559 0 0
# compatibility_mode=7937 16777214 28 75 1148594 25296957 0 0
# scanned=287012
# found=4
# cleaned=0
# scan_time=5448
sh=18C17FF38FCDE8AD5B46549A50FFD98A319956B5 ft=1 fh=862260e8ce4a17d6 vn="probably a variant of Win32/Toolbar.MyWebSearch.P application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\4jskin.dll.vir"
sh=F168820EBBB25A99251B35F4328E09BB914DCC9A ft=1 fh=bab93d68c29f066d vn="a variant of Win64/Toolbar.MyWebSearch.A application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegrator64.exe.vir"
sh=A6AD21A19469FB3650387953DDA171CF78464458 ft=1 fh=8261ecd8fca1a29c vn="a variant of Win64/Toolbar.MyWebSearch.A application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\AppIntegratorStub64.dll.vir"
sh=B879BC93FA5D87733EDC9FD055A6AF538A554074 ft=1 fh=a792084cb5dc54a4 vn="a variant of Win64/Toolbar.MyWebSearch.A application" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\RadioRage_4j\bar\1.bin\Hpg64.dll.vir"

Code:
Results of screen317's Security Check version 0.99.79 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
avast! Antivirus 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Spyware Terminator 2012 
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 Adobe Flash Player 10 Flash Player out of Date!
 Adobe Flash Player 11.9.900.152 
 Adobe Reader XI 
 Mozilla Firefox (26.0)
 Google Chrome 32.0.1700.76 
````````Process Check: objlist.exe by Laurent```````` 
 AVAST Software Avast AvastSvc.exe 
 AVAST Software Avast AvastUI.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-01-2014
Ran by Amanda (administrator) on ASUS on 20-01-2014 22:36:32
Running from C:\Users\Amanda\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Crawler.com) C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe
(WDC) C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
(Memeo) C:\Program Files (x86)\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe
(ASUS) C:\Windows\AsScrPro.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\PAC7302\Monitor.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2189416 2011-03-01] (Realtek Semiconductor)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [324096 2010-08-11] (Alcor Micro Corp.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2712360 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [SynAsusAcpi] - C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [97064 2011-03-04] (Synaptics Incorporated)
HKLM\...\Run: [PAC7302_Monitor] - C:\Windows\PixArt\PAC7302\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [RadioRage Home Page Guard 64 bit] - "C:\PROGRA~2\RADIOR~1\bar\1.bin\AppIntegrator64.exe"
HKLM\...\Run: [SpywareTerminatorShield] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorShield.exe [2777736 2013-04-03] (Crawler.com)
HKLM\...\Run: [SpywareTerminatorUpdater] - C:\Program Files (x86)\Spyware Terminator\SpywareTerminatorUpdate.exe [3684488 2013-04-03] (Crawler.com)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] - C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [2018032 2011-04-13] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.84.161\AsusWSPanel.exe [731472 2011-02-23] (ecareme)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5732992 2010-08-17] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [1601536 2010-09-24] ()
HKLM-x32\...\Run: [UpdateLBPShortCut] - C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GoShortCut] - C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-11-20] (AVAST Software)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [GoogleChromeAutoLaunch_B5BA1AC00E9D5F3D11339DA34D270473] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [866584 2014-01-11] (Google Inc.)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\system32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll No File
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default
FF SearchEngineOrder.user_pref("browser.search.order.2", "");: user_pref("browser.search.order.2", "");
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_152.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_152.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 - C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Amanda\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ich@maltegoetz.de [2013-12-11]
FF Extension: YouTube Unblocker - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-16]
FF Extension: Heart Button - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\ffextension@weheartit.com.xpi [2013-11-20]
FF Extension: Tumblr Savior - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\jid1-W5guVoyeUR0uBg@jetpack.xpi [2013-11-28]
FF Extension: SoundCloud Downloader - Technowise - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{c8d3bc80-0810-4d21-a2c2-be5f2b2832ac}.xpi [2013-12-20]
FF Extension: Adblock Plus - C:\Users\Amanda\AppData\Roaming\Mozilla\Firefox\Profiles\p56h4w7p.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-11-28]
FF Extension: Hotspot Shield Extension - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\afproxy@anchorfree.com [2013-12-25]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-11-20]

Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek [2014-01-16]
CHR Extension: (Google Docs) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-16]
CHR Extension: (Google Drive) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-16]
CHR Extension: (YouTube) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-16]
CHR Extension: (Chrome YouTube Downloader) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbdjiinahkdjdcdlgfimlcolkjpbooja [2014-01-18]
CHR Extension: (Google-Suche) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-16]
CHR Extension: (AdBlock) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-01-16]
CHR Extension: (avast! Online Security) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-01-16]
CHR Extension: (Google Wallet) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-16]
CHR Extension: (YouTube Unblocker) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2014-01-17]
CHR Extension: (Google Mail) - C:\Users\Amanda\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-16]
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\Amanda\AppData\LocalLow\proxtube\CHROME\proxtube.crx [2012-04-19]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-11-20]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-11-20] (AVAST Software)
R2 ST2012_Svc; C:\Program Files (x86)\Spyware Terminator\st_rsser64.exe [1149104 2013-04-03] (Crawler.com)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\Windows\system32\drivers\aswFsBlk.sys [38984 2013-11-20] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [84328 2013-11-20] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2013-11-20] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-11-20] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1032416 2013-11-20] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [409832 2013-11-20] (AVAST Software)
R1 aswTdi; C:\Windows\system32\drivers\aswTdi.sys [65264 2013-11-20] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-11-20] ()
R1 HssDRV6; C:\Windows\System32\DRIVERS\hssdrv6.sys [44744 2013-12-17] (AnchorFree Inc.)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 PAC7302; C:\Windows\System32\DRIVERS\PAC7302.SYS [527360 2007-09-10] (PixArt Imaging Inc.)
R2 sp_rsdrv2; C:\Windows\System32\DRIVERS\stflt.sys [51496 2014-01-07] (Windows (R) Win 7 DDK provider)
R3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-11-13] (Anchorfree Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-20 22:36 - 2014-01-20 22:36 - 00016986 _____ C:\Users\Amanda\Desktop\FRST.txt
2014-01-20 22:35 - 2014-01-20 22:35 - 00000911 _____ C:\Users\Amanda\Desktop\checkup.txt
2014-01-20 22:26 - 2014-01-20 22:26 - 00987425 _____ C:\Users\Amanda\Downloads\SecurityCheck.exe
2014-01-20 18:03 - 2014-01-20 18:03 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:17 - 2014-01-19 13:21 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:48 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-18 16:48 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-18 16:48 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-18 16:48 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-18 16:47 - 2014-01-18 16:56 - 00000000 ____D C:\Qoobox
2014-01-18 16:47 - 2014-01-18 16:55 - 00000000 ____D C:\Windows\erdnt
2014-01-18 02:29 - 2014-01-18 02:30 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 01:49 - 2014-01-19 13:56 - 00039110 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:33 - 2014-01-19 13:55 - 00000000 ____D C:\FRST
2014-01-16 23:32 - 2014-01-19 13:55 - 02076672 _____ (Farbar) C:\Users\Amanda\Desktop\FRST64.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 14:53 - 2014-01-20 14:31 - 00000840 _____ C:\Windows\setupact.log
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:52 - 2014-01-18 17:13 - 00000872 _____ C:\Windows\PFRO.log
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:45 - 2014-01-20 21:56 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-16 01:45 - 2014-01-20 12:02 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-16 01:45 - 2014-01-16 01:51 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:45 - 2014-01-16 01:51 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:45 - 2014-01-16 01:47 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 12:28 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2014-01-15 12:28 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-01-15 12:28 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys
2014-01-15 12:28 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-12 19:29 - 2014-01-17 01:52 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-12 19:27 - 2014-01-17 00:56 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-12 19:26 - 2014-01-17 01:52 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-12 19:25 - 2014-01-12 19:26 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-12 19:18 - 2014-01-12 19:19 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-08 23:43 - 2014-01-09 00:05 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:14 - 2014-01-08 23:15 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 23:10 - 2014-01-19 14:03 - 01672414 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-08 22:49 - 2014-01-08 22:50 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:26 - 2014-01-08 22:27 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:04 - 2014-01-08 22:21 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:26 - 2014-01-07 22:45 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-20 12:04 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com                                                ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:55 - 2014-01-17 18:56 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-07 15:54 - 2014-01-17 18:56 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-04 12:45 - 2013-12-17 22:11 - 00044744 _____ (AnchorFree Inc.) C:\Windows\system32\Drivers\hssdrv6.sys
2013-12-29 15:32 - 2013-12-29 21:30 - 00000000 ____D C:\Windows\Minidump
2013-12-27 19:03 - 2013-12-28 19:23 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 02:02 - 2014-01-04 12:44 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-25 01:35 - 2013-12-25 01:53 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:15 - 2013-12-23 13:49 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress

==================== One Month Modified Files and Folders =======

2014-01-20 22:36 - 2014-01-20 22:36 - 00016986 _____ C:\Users\Amanda\Desktop\FRST.txt
2014-01-20 22:35 - 2014-01-20 22:35 - 00000911 _____ C:\Users\Amanda\Desktop\checkup.txt
2014-01-20 22:26 - 2014-01-20 22:26 - 00987425 _____ C:\Users\Amanda\Downloads\SecurityCheck.exe
2014-01-20 22:23 - 2013-11-21 22:30 - 01290627 _____ C:\Windows\WindowsUpdate.log
2014-01-20 21:56 - 2014-01-16 01:45 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-20 18:03 - 2014-01-20 18:03 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-20 14:31 - 2014-01-16 14:53 - 00000840 _____ C:\Windows\setupact.log
2014-01-20 13:34 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\LEBENSLAUF--Bewerbungen
2014-01-20 12:10 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-20 12:10 - 2009-07-14 05:45 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-20 12:04 - 2014-01-07 15:58 - 00000000 ____D C:\ProgramData\Spyware Terminator
2014-01-20 12:02 - 2014-01-16 01:45 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-20 12:02 - 2013-11-20 22:03 - 00000000 ___HD C:\ASUS.DAT
2014-01-20 12:00 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-19 21:39 - 2013-11-20 23:08 - 00000000 ____D C:\Users\Amanda\AppData\Local\Last.fm
2014-01-19 14:03 - 2014-01-08 23:10 - 01672414 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-19 14:03 - 2011-02-19 05:24 - 00711224 _____ C:\Windows\system32\perfh007.dat
2014-01-19 14:03 - 2011-02-19 05:24 - 00152768 _____ C:\Windows\system32\perfc007.dat
2014-01-19 13:56 - 2014-01-17 01:49 - 00039110 _____ C:\Users\Amanda\Downloads\FRST.txt
2014-01-19 13:55 - 2014-01-19 13:55 - 00000000 ____D C:\Users\Amanda\Downloads\FRST-OlderVersion
2014-01-19 13:55 - 2014-01-16 23:33 - 00000000 ____D C:\FRST
2014-01-19 13:55 - 2014-01-16 23:32 - 02076672 _____ (Farbar) C:\Users\Amanda\Desktop\FRST64.exe
2014-01-19 13:41 - 2014-01-19 13:41 - 00000000 ____D C:\Windows\ERUNT
2014-01-19 13:21 - 2014-01-19 13:17 - 00000000 ____D C:\AdwCleaner
2014-01-19 13:16 - 2014-01-19 13:16 - 00000000 ____D C:\Users\Amanda\Downloads\Neuer Ordner
2014-01-19 13:09 - 2013-11-21 19:30 - 00000000 ____D C:\Users\Amanda\Documents\Random cool shit
2014-01-19 04:45 - 2013-11-25 22:15 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\vlc
2014-01-18 17:13 - 2014-01-16 14:52 - 00000872 _____ C:\Windows\PFRO.log
2014-01-18 16:56 - 2014-01-18 16:56 - 00036445 _____ C:\ComboFix.txt
2014-01-18 16:56 - 2014-01-18 16:47 - 00000000 ____D C:\Qoobox
2014-01-18 16:56 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-18 16:55 - 2014-01-18 16:47 - 00000000 ____D C:\Windows\erdnt
2014-01-18 16:54 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-18 12:08 - 2013-11-21 22:46 - 00002570 _____ C:\Windows\system32\AutoRunFilter.ini
2014-01-18 02:30 - 2014-01-18 02:29 - 11235209 _____ C:\Users\Amanda\Downloads\The Walking Dead 4x09 Promo.mp4
2014-01-17 18:56 - 2014-01-07 15:55 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2014-01-17 18:56 - 2014-01-07 15:54 - 00000000 ____D C:\Windows\72AAF4551E54475BB0AB5413C78D0E63.TMP
2014-01-17 12:06 - 2013-11-20 22:22 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update
2014-01-17 01:52 - 2014-01-12 19:29 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-01-17 01:52 - 2014-01-12 19:26 - 00000000 ____D C:\Users\Amanda\Desktop\mbar
2014-01-17 00:56 - 2014-01-12 19:27 - 00089304 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-01-16 23:47 - 2014-01-16 23:47 - 00379904 _____ C:\Users\Amanda\Downloads\hvrqjjul.exe
2014-01-16 23:31 - 2014-01-16 23:31 - 00000474 _____ C:\Users\Amanda\Downloads\defogger_disable.log
2014-01-16 23:31 - 2014-01-16 23:31 - 00000000 _____ C:\Users\Amanda\defogger_reenable
2014-01-16 23:31 - 2013-11-20 22:03 - 00000000 ____D C:\Users\Amanda
2014-01-16 23:30 - 2014-01-16 23:30 - 00050477 _____ C:\Users\Amanda\Downloads\Defogger.exe
2014-01-16 19:30 - 2013-11-20 23:03 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Winamp
2014-01-16 14:54 - 2013-11-21 22:46 - 00001430 _____ C:\Windows\system32\ServiceFilter.ini
2014-01-16 14:53 - 2014-01-16 14:53 - 00000000 _____ C:\Windows\setuperr.log
2014-01-16 14:53 - 2009-07-14 05:45 - 00305344 _____ C:\Windows\system32\FNTCACHE.DAT
2014-01-16 03:03 - 2013-11-27 12:44 - 00000000 ____D C:\Windows\system32\MRT
2014-01-16 03:03 - 2013-11-20 23:52 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 03:00 - 2013-11-27 12:44 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-01-16 01:51 - 2014-01-16 01:45 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-01-16 01:51 - 2014-01-16 01:45 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-01-16 01:47 - 2014-01-16 01:47 - 00002253 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-16 01:47 - 2014-01-16 01:45 - 00000000 ____D C:\Users\Amanda\AppData\Local\Google
2014-01-16 01:47 - 2011-04-13 03:33 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-15 12:31 - 2013-11-20 22:35 - 00000000 ____D C:\Users\Amanda\AppData\Local\Adobe
2014-01-15 12:29 - 2014-01-15 12:29 - 00000000 ____D C:\ProgramData\McAfee
2014-01-15 00:18 - 2009-07-14 06:13 - 01643244 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-15 00:06 - 2013-12-07 22:51 - 00000000 ____D C:\Users\Amanda\Desktop\Luni
2014-01-15 00:02 - 2014-01-15 00:02 - 00000000 ____D C:\Users\Amanda\AppData\Local\Apps\2.0
2014-01-14 23:50 - 2013-12-20 19:49 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Skype
2014-01-13 15:38 - 2009-07-14 06:08 - 00032572 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-12 19:26 - 2014-01-12 19:25 - 12582688 _____ (Malwarebytes Corp.) C:\Users\Amanda\Downloads\mbar-1.07.0.1008.exe
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-12 19:20 - 2014-01-12 19:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-12 19:19 - 2014-01-12 19:18 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Amanda\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-12 18:55 - 2014-01-12 18:55 - 00000000 ____D C:\Windows\system32\IO
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\cYo
2014-01-09 00:33 - 2014-01-09 00:33 - 00000000 ____D C:\Users\Amanda\AppData\Local\cYo
2014-01-09 00:05 - 2014-01-08 23:43 - 40799183 _____ C:\Users\Amanda\Downloads\The Walking Dead 119 (2014) (Digital) (Zone-Empire).cbr
2014-01-08 23:15 - 2014-01-08 23:14 - 00000000 ____D C:\Program Files\ComicRack
2014-01-08 22:50 - 2014-01-08 22:49 - 11791025 _____ C:\Users\Amanda\Downloads\ComicRackSetup09175.exe
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iTunes
2014-01-08 22:27 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files (x86)\iTunes
2014-01-08 22:26 - 2014-01-08 22:26 - 00000000 ____D C:\Program Files\iPod
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Windows\System32\Tasks\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Common Files\Apple
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Bonjour
2014-01-08 22:25 - 2014-01-08 22:25 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2014-01-08 22:21 - 2014-01-08 22:04 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup(1).exe
2014-01-07 22:45 - 2014-01-07 22:26 - 100400976 _____ (Apple Inc.) C:\Users\Amanda\Downloads\iTunes64Setup.exe
2014-01-07 15:58 - 2014-01-07 15:58 - 00051496 _____ (Windows (R) Win 7 DDK provider) C:\Windows\system32\Drivers\stflt.sys
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Spyware Terminator
2014-01-07 15:58 - 2014-01-07 15:58 - 00000000 ____D C:\Program Files (x86)\Spyware Terminator
2014-01-07 15:57 - 2014-01-07 15:57 - 05049344 _____ (Crawler.com                                                ) C:\Users\Amanda\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2014-01-07 15:43 - 2014-01-07 15:43 - 00000000 ____D C:\Windows\pss
2014-01-05 20:35 - 2013-11-20 23:42 - 00000000 ____D C:\Program Files\Adobe
2014-01-05 20:35 - 2013-11-20 23:30 - 00000000 ____D C:\Program Files\Common Files\Adobe
2014-01-04 12:44 - 2013-12-25 02:02 - 00001050 _____ C:\Users\Public\Desktop\Hotspot Shield.lnk
2013-12-30 20:27 - 2013-11-22 23:53 - 00000000 ____D C:\Windows\System32\Tasks\Games
2013-12-29 21:30 - 2013-12-29 15:32 - 00000000 ____D C:\Windows\Minidump
2013-12-28 19:23 - 2013-12-27 19:03 - 00000000 ____D C:\Users\Amanda\Desktop\kat
2013-12-25 18:12 - 2013-12-25 18:12 - 01977432 _____ C:\Users\Amanda\Downloads\winrar-x64-501.exe
2013-12-25 01:59 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\Resources
2013-12-25 01:53 - 2013-12-25 01:35 - 00000000 ____D C:\Program Files (x86)\ArchiCrypt Stealth 4
2013-12-25 01:35 - 2013-12-25 01:35 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\ACStealth4
2013-12-23 13:49 - 2013-12-23 13:15 - 00000000 ____D C:\Program Files\Lightroom Tutorial
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Public\CyberLink
2013-12-23 13:32 - 2013-12-23 13:32 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\CyberLink
2013-12-23 13:32 - 2013-11-21 22:48 - 00000000 ____D C:\ProgramData\CyberLink
2013-12-23 13:14 - 2013-12-23 13:14 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2013-12-23 13:13 - 2013-12-23 13:13 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\Canneverbe Limited
2013-12-23 13:11 - 2013-12-23 13:11 - 00000000 ____D C:\Users\Amanda\AppData\Roaming\GalileoPress
2013-12-21 12:23 - 2013-11-20 22:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

Some content of TEMP:
====================
C:\Users\Amanda\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-19 18:22

==================== End Of Log ============================
--- --- ---

schrauber 21.01.2014 17:29
Fertig :)

Falls Du Lob oder Kritik loswerden möchtest kannst Du das hier tun :)


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.


Alle Zeitangaben in WEZ +1. Es ist jetzt 13:47 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131