| switch123 | 24.01.2014 01:03 |
Windows: BKA-Virus im Browser
hallo, seit vorgestern werde ich von einer tumblr Seite, die ich vorher immer ohne Probleme öffnen konnte, immer wenn ich meinen Computer starte auf die BKA-Seite weitergeleitet. Die Seite kommt sowohl im Firefox als auch im Chrome. Die Browser lassen sich dann nur noch mit dem Taskmanager beenden. Wenn ich dann den Browser neustarte funktioniert wieder alles und ich kann auch wieder auf die tumblr Seite zugreifen. Avira hat nichts gefunden. Malwarebytes wurde von Avira blockiert. Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:44 on 23/01/2014 (Laura_Admin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014 02
Ran by Laura (ATTENTION: The logged in user is not administrator) on MAGGIE on 23-01-2014 23:46:47
Running from C:\Users\Laura\Desktop\Neuer Ordner
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(Wacom Technology, Corp.) C:\Windows\System32\WTablet\Pen_TabletUser.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Spotify Ltd) C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(Dropbox, Inc.) C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\ink\InputPersonalization.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvUseMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeBtMng.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosLeSrvProvider.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\TosBtHSP.exe
(Wacom Technology, Corp.) C:\Program Files\WTouch\WTouchUser.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [] - [x]
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12446824 2012-02-01] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2867984 2011-12-23] (Synaptics Incorporated)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-02-06] (SRS Labs, Inc.)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-09-23] (TOSHIBA Corporation)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1548208 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-11-26] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-03-07] (Toshiba Europe GmbH)
HKLM\...\Run: [LogMeIn GUI] - C:\Program Files (x86)\LogMeIn\x64\LogMeInSystray.exe [57928 2012-06-08] (LogMeIn, Inc.)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-01-20] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-02] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] - C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-05] (Intel Corporation)
HKLM-x32\...\Run: [TSleepSrv] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [253312 2011-11-21] (TOSHIBA)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [CanonSolutionMenuEx] - C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] - C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS5.5ServiceManager] - C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe [1523360 2011-01-12] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [Adobe Acrobat Speed Launcher] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe [41336 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe [840568 2013-09-03] (Adobe Systems Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-11-15] ()
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Laura\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://t.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x212A1F26A0E0CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKLM-x32 - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TEUA;
SearchScopes: HKCU - {AEE17A01-F07D-4110-B520-CECBE6DD0C09} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: SmartSelect Class - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Toolbar: HKLM-x32 - Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\IEPlugin\contributeieplugin.dll (Adobe Systems, Inc.)
Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU - No Name - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - No File
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.10 192.168.1.130
Tcpip\..\Interfaces\{851F8DFE-A14D-48CE-BAAF-AF193F5F5B1B}: [NameServer]192.168.1.10 192.168.1.130
FireFox:
========
FF ProfilePath: C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default
FF Homepage: hxxp://www.google.de/
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "http", "178.219.201.131"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_43.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_43.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw_1204144.dll No File
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()
FF Plugin-x32: Adobe Acrobat - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: adobe.com/AdobeAAMDetect - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: YouTube Unblocker - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\youtubeunblocker@unblocker.yt [2014-01-22]
FF Extension: Flashblock - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} [2014-01-22]
FF Extension: DownloadHelper - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-01-22]
FF Extension: Chrome View - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\chromeview@systemantics.net.xpi [2014-01-22]
FF Extension: Media Hint - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\mediahint@jetpack.xpi [2014-01-22]
FF Extension: ZIP File Wizard Free - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{1be13464-8e12-4d18-8601-bbae1257b460}.xpi [2014-01-22]
FF Extension: Locale Switcher - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{338e0b96-2285-4424-b4c8-e25560750fa3}.xpi [2014-01-22]
FF Extension: NoScript - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-01-23]
FF Extension: {828814c3-7178-41b7-a60b-15969f642ba3} - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{828814c3-7178-41b7-a60b-15969f642ba3}.xpi [2014-01-22]
FF Extension: View Cookies - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{8F6A6FD9-0619-459f-B9D0-81DE065D4E21}.xpi [2014-01-22]
FF Extension: Password Exporter - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.xpi [2014-01-22]
FF Extension: Adblock Plus - C:\Users\Laura\AppData\Roaming\Mozilla\Firefox\Profiles\n05ewih5.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-22]
FF HKLM-x32\...\Firefox\Extensions: [{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}] - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9}
FF Extension: Adobe Contribute Toolbar - C:\Program Files (x86)\Adobe\Adobe Contribute CS5.1\Plugins\FirefoxPlugin\{01A8CA0A-4C96-465b-A49B-65C46FAD54F9} [2013-01-05]
FF HKLM-x32\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2013-01-05]
Chrome:
=======
CHR HomePage: hxxp://www.google.de/
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.83\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_265.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Nero Kwik Media Helper) - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (Adblock Plus) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2013-01-02]
CHR Extension: (FlashBlock) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl [2013-01-02]
CHR Extension: (Google Wallet) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]
CHR Extension: (YouTube Unblocker) - C:\Users\Laura\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2013-12-17]
==================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440376 2013-12-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440376 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lmhosts; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn\x64\LMIGuardianSvc.exe [376144 2014-01-22] (LogMeIn, Inc.)
R2 LMIMaint; C:\Program Files (x86)\LogMeIn\x64\RaMaint.exe [226640 2014-01-22] (LogMeIn, Inc.)
R2 LogMeIn; C:\Program Files (x86)\LogMeIn\x64\LogMeIn.exe [407424 2012-06-08] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 WTouchService; C:\Program Files\WTouch\WTouchService.exe [127272 2009-07-15] (Wacom Technology, Corp.)
==================== Drivers (Whitelisted) ====================
S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [31744 2012-06-05] (Google Inc)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [314016 2013-05-16] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [43680 2013-05-16] ()
R2 LMIInfo; C:\Program Files (x86)\LogMeIn\x64\RaInfo.sys [16056 2013-05-29] (LogMeIn, Inc.)
S4 LMIRfsClientNP; No ImagePath
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 SmbDrv; C:\Windows\System32\DRIVERS\Smb_driver.sys [21264 2011-12-23] (Synaptics Incorporated)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2011-03-01] (Microsoft Corporation)
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-01-23 23:46 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-23 23:45 - 2014-01-23 23:46 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-23 23:42 - 2014-01-23 23:43 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-23 23:41 - 2014-01-23 23:44 - 00000000 _____ C:\Users\Laura_Admin\defogger_reenable
2014-01-23 19:01 - 2014-01-23 19:04 - 00000000 ___SD C:\32788R22FWJFW
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\windows\erdnt
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\Qoobox
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-22 17:00 - 2014-01-22 17:00 - 01037068 _____ (Thisisu) C:\Users\Laura\Downloads\JRT.exe
2014-01-22 16:48 - 2014-01-22 16:50 - 00000000 ____D C:\AdwCleaner
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 13:33 - 2014-01-23 15:25 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-15 09:42 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 09:42 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 09:42 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 09:42 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:48 - 2014-01-20 15:51 - 00000000 ____D C:\Program Files (x86)\Steam
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-25 18:47 - 2013-12-25 18:47 - 00000000 ____D C:\Program Files\DivX
==================== One Month Modified Files and Folders =======
2014-01-23 23:46 - 2014-01-23 23:46 - 00000000 ____D C:\FRST
2014-01-23 23:46 - 2014-01-23 23:45 - 00000000 ____D C:\Users\Laura\Desktop\Neuer Ordner
2014-01-23 23:44 - 2014-01-23 23:41 - 00000000 _____ C:\Users\Laura_Admin\defogger_reenable
2014-01-23 23:44 - 2012-08-22 12:31 - 00000000 ____D C:\Users\Laura_Admin
2014-01-23 23:43 - 2014-01-23 23:42 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Skype
2014-01-23 23:42 - 2012-08-22 13:29 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Skype
2014-01-23 23:42 - 2012-08-22 12:36 - 00118064 _____ C:\Users\Laura_Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-23 23:42 - 2012-08-22 12:36 - 00001432 _____ C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-23 23:42 - 2012-08-22 12:36 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-01-23 23:42 - 2012-08-22 12:31 - 00000000 ___RD C:\Users\Laura_Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-23 23:42 - 2012-03-07 01:21 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-23 23:38 - 2013-10-01 18:35 - 00000593 _____ C:\windows\system32\Drivers\etc\hosts.ics
2014-01-23 23:34 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-23 23:34 - 2009-07-14 05:45 - 00024608 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-23 23:29 - 2012-06-14 17:30 - 01488063 _____ C:\windows\WindowsUpdate.log
2014-01-23 23:27 - 2013-12-06 14:29 - 00000000 ___RD C:\Users\Laura\Dropbox
2014-01-23 23:27 - 2013-12-06 14:26 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Dropbox
2014-01-23 23:25 - 2012-08-31 15:10 - 00000000 ____D C:\Users\Laura\AppData\Roaming\WTablet
2014-01-23 23:24 - 2009-07-14 06:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-23 23:24 - 2009-07-14 05:51 - 00141865 _____ C:\windows\setupact.log
2014-01-23 19:17 - 2012-03-07 01:21 - 00001124 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-23 19:04 - 2014-01-23 19:01 - 00000000 ___SD C:\32788R22FWJFW
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\windows\erdnt
2014-01-23 19:01 - 2014-01-23 19:01 - 00000000 ____D C:\Qoobox
2014-01-23 17:53 - 2014-01-23 17:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Malwarebytes
2014-01-23 17:49 - 2010-11-21 04:47 - 00115436 _____ C:\windows\PFRO.log
2014-01-23 15:26 - 2014-01-23 15:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-23 15:25 - 2014-01-22 13:33 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Laura\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-23 15:20 - 2014-01-23 15:20 - 00000000 ____D C:\Users\Laura\AppData\Local\LogMeInIgnition
2014-01-23 09:31 - 2012-08-22 17:16 - 00000000 ____D C:\Users\Laura\AppData\Local\Adobe
2014-01-23 09:30 - 2012-08-22 13:17 - 00000000 ____D C:\ProgramData\LogMeIn
2014-01-22 17:00 - 2014-01-22 17:00 - 01037068 _____ (Thisisu) C:\Users\Laura\Downloads\JRT.exe
2014-01-22 16:50 - 2014-01-22 16:48 - 00000000 ____D C:\AdwCleaner
2014-01-22 16:48 - 2013-07-04 19:03 - 01236282 _____ C:\Users\Laura\Downloads\adwcleaner.exe
2014-01-22 16:46 - 2012-08-22 15:57 - 00000000 ____D C:\Users\Laura\Desktop\Alles Mögliche
2014-01-22 16:45 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Spotify
2014-01-22 16:23 - 2012-09-13 15:09 - 00000000 ____D C:\Program Files (x86)\DivX
2014-01-22 16:23 - 2012-09-13 15:08 - 00000000 ____D C:\ProgramData\DivX
2014-01-22 16:21 - 2013-08-26 12:19 - 00993600 _____ (DivX, LLC) C:\Users\Laura\Downloads\DivXInstaller.exe
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\Users\Laura_Admin\AppData\Roaming\Malwarebytes
2014-01-22 13:34 - 2014-01-22 13:34 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-22 07:50 - 2012-08-22 13:17 - 00000000 ____D C:\Program Files (x86)\LogMeIn
2014-01-22 07:49 - 2012-08-22 13:17 - 00107368 _____ (LogMeIn, Inc.) C:\windows\system32\LMIRfsClientNP.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00092488 _____ (LogMeIn, Inc.) C:\windows\system32\LMIinit.dll
2014-01-22 07:49 - 2012-08-22 13:17 - 00035656 _____ (LogMeIn, Inc.) C:\windows\system32\LMIport.dll
2014-01-20 18:51 - 2012-10-08 14:53 - 00000000 ____D C:\Users\Laura\AppData\Local\Spotify
2014-01-20 15:51 - 2014-01-07 17:48 - 00000000 ____D C:\Program Files (x86)\Steam
2014-01-19 13:27 - 2012-03-07 01:44 - 00000000 ____D C:\ProgramData\McAfee
2014-01-19 13:27 - 2012-03-07 01:05 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-01-19 13:27 - 2012-03-07 01:05 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-01-19 13:26 - 2012-08-23 07:38 - 00000000 ____D C:\Users\Laura_Admin\AppData\Local\Adobe
2014-01-17 10:30 - 2012-03-07 01:22 - 00002186 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2014-01-17 00:22 - 2013-12-06 19:09 - 00001027 _____ C:\Users\Laura\Desktop\Dropbox.lnk
2014-01-17 00:22 - 2013-12-06 19:08 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-01-17 00:22 - 2012-08-22 13:28 - 00000000 ___RD C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-16 16:42 - 2009-07-14 05:45 - 05009400 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-16 09:37 - 2013-08-15 02:01 - 00000000 ____D C:\windows\system32\MRT
2014-01-16 09:37 - 2012-08-23 00:17 - 00000000 ____D C:\ProgramData\Microsoft Help
2014-01-16 09:34 - 2012-08-22 14:00 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-15 13:43 - 2013-09-17 22:43 - 00000000 ____D C:\Users\Laura\Desktop\uni
2014-01-11 00:17 - 2009-07-14 04:20 - 00000000 ____D C:\windows\system32\NDF
2014-01-09 00:06 - 2012-08-22 13:28 - 00118064 _____ C:\Users\Laura\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-08 23:32 - 2014-01-08 23:32 - 00001101 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-08 23:32 - 2013-01-05 00:18 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-07 18:28 - 2014-01-07 18:28 - 00000000 ____D C:\Users\Laura\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam
2014-01-07 17:49 - 2014-01-07 17:49 - 00000928 _____ C:\Users\Public\Desktop\Steam.lnk
2014-01-07 17:49 - 2012-08-22 13:28 - 00000000 ____D C:\Users\Laura
2014-01-03 18:14 - 2009-07-14 06:08 - 00032632 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-12-30 23:54 - 2013-07-04 18:44 - 907171148 _____ C:\windows\MEMORY.DMP
2013-12-30 23:54 - 2013-07-04 18:44 - 00000000 ____D C:\windows\Minidump
2013-12-30 23:53 - 2009-07-14 04:20 - 00000000 ____D C:\windows\LiveKernelReports
2013-12-29 18:22 - 2011-02-11 09:21 - 00654400 _____ C:\windows\system32\perfh007.dat
2013-12-29 18:22 - 2011-02-11 09:21 - 00130240 _____ C:\windows\system32\perfc007.dat
2013-12-29 18:22 - 2009-07-14 06:13 - 01498742 _____ C:\windows\system32\PerfStringBackup.INI
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\Documents\Amazon Music Importer
2013-12-29 17:19 - 2013-12-29 17:19 - 00000000 ____D C:\Users\Laura\AppData\Roaming\com.amazon.music.uploader
2013-12-29 17:18 - 2013-12-29 17:18 - 09629432 _____ C:\Users\Laura\Downloads\AmazonMusicImporterInstaller-2.1.0._V371017662_.exe
2013-12-29 17:18 - 2013-12-29 17:18 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-12-29 17:00 - 2013-12-29 17:00 - 36152456 _____ (Amazon) C:\Users\Laura\Downloads\AmazonCloudPlayerInstaller_399.exe
2013-12-25 18:47 - 2013-12-25 18:47 - 00000000 ____D C:\Program Files\DivX
Some content of TEMP:
====================
C:\Users\Laura\AppData\Local\Temp\AskSLib.dll
C:\Users\Laura\AppData\Local\Temp\avgnt.exe
C:\Users\Laura\AppData\Local\Temp\DivXSetup.exe
C:\Users\Laura\AppData\Local\Temp\drm_dyndata_7320010.dll
C:\Users\Laura\AppData\Local\Temp\i4jdel0.exe
C:\Users\Laura\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Laura\AppData\Local\Temp\Shockwave_Installer_FF.exe
C:\Users\Laura\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Laura_Admin\AppData\Local\Temp\AskSLib.dll
C:\Users\Laura_Admin\AppData\Local\Temp\AutoRun.exe
C:\Users\Laura_Admin\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Laura_Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Laura_Admin\AppData\Local\Temp\iview435_setup.exe
C:\Users\Laura_Admin\AppData\Local\Temp\iv_uninstall.exe
C:\Users\Laura_Admin\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Laura_Admin\AppData\Local\Temp\msvcp60.dll
C:\Users\Laura_Admin\AppData\Local\Temp\ose00000.exe
C:\Users\Laura_Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\Laura_Admin\AppData\Local\Temp\twapi-2.0a2.dll
C:\Users\Laura_Admin\AppData\Local\Temp\VP6Install.exe
C:\Users\Laura_Admin\AppData\Local\Temp\VP6VFW.dll
C:\Users\Laura_Admin\AppData\Local\Temp\_is7384.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== End Of Log ============================
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-01-2014 02
Ran by Laura at 2014-01-23 23:47:50
Running from C:\Users\Laura\Desktop\Neuer Ordner
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Acrobat X Pro - English, Français, Deutsch (x32 Version: 10.1.8 - Adobe Systems)
Adobe AIR (x32 Version: 3.4.0.2710 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 3.4.0.2710 - Adobe Systems Incorporated) Hidden
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.)
Adobe Community Help (x32 Version: 3.4.980 - Adobe Systems Incorporated.) Hidden
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated)
Adobe Content Viewer (x32 Version: 1.4.0 - Adobe Systems Incorporated) Hidden
Adobe Creative Suite 5.5 Master Collection (x32 Version: 5.5 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (x32 Version: 11.3.300.271 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.43 - Adobe Systems Incorporated)
Adobe Photoshop Elements 7.0 (x32 Version: 7.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 7.0 (x32 Version: 7.0.0.3 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.8) MUI (x32 Version: 10.1.8 - Adobe Systems Incorporated)
Adobe Story (x32 Version: 1.0.571 - Adobe Systems Incorporated)
Adobe Story (x32 Version: 1.0.571 - Adobe Systems Incorporated) Hidden
Adobe Widget Browser (x32 Version: 2.0 Build 230 - Adobe Systems Incorporated.)
Adobe Widget Browser (x32 Version: 2.0.230 - Adobe Systems Incorporated.) Hidden
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.98 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
Amazon Kindle (HKCU Version: - Amazon)
AMD APP SDK Runtime (Version: 10.0.851.6 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (Version: 3.0.859.0 - Advanced Micro Devices, Inc.)
Assassin's Creed (x32 Version: 1.02 - Ubisoft)
Assassin's Creed II (x32 Version: 1.01 - Ubisoft)
Atheros Bluetooth Filter Driver Package (Version: 1.0.0.12 - Atheros Communications)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13 - Atheros Communications Inc.)
Atheros Driver Installation Program (x32 Version: 9.2 - Atheros)
Avira Free Antivirus (x32 Version: 14.0.2.286 - Avira)
Bamboo (x32 Version: - Wacom Technology Corp.)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bluetooth Stack for Windows by Toshiba (Version: v9.00.00(T) - TOSHIBA CORPORATION)
Cake Mania (x32 Version: 2.2.0.98 - WildTangent) Hidden
Canon Easy-PhotoPrint EX (x32 Version: - )
Canon Easy-WebPrint EX (x32 Version: - )
Canon IJ Network Scanner Selector EX (x32 Version: - )
Canon IJ Network Tool (x32 Version: - )
Canon MG5300 series Benutzerregistrierung (x32 Version: - )
Canon MG5300 series MP Drivers (Version: - )
Canon MP Navigator EX 5.0 (x32 Version: - )
Canon My Printer (x32 Version: - )
Canon Solution Menu EX (x32 Version: - )
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2012.0120.0419.7502 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2012.0120.420.7502 - Advanced Micro Devices, Inc.) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2 - Microsoft Corporation)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Die Sims™ 2 Deluxe (x32 Version: - )
DivX-Setup (x32 Version: 2.6.1.90 - DivX, LLC)
Dropbox (HKCU Version: 2.4.11 - Dropbox, Inc.)
First PDF (x32 Version: - )
Free Audio Converter version 5.0.24.419 (x32 Version: 5.0.24.419 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.2.419 (x32 Version: 3.12.2.419 - DVDVideoSoft Ltd.)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
GeoGebra (HKCU Version: 4.0.41.0 - International GeoGebra Institute)
GIMP 2.8.4 (Version: 2.8.4 - The GIMP Team)
Google Chrome (x32 Version: 32.0.1700.76 - Google Inc.)
Google Earth Plug-in (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
Helium (x32 Version: 1.0.0 - ClockworkMod)
High-Definition Video Playback (x32 Version: 11.1.10500.2.65 - Nero AG) Hidden
Insaniquarium Deluxe (x32 Version: 2.2.0.97 - WildTangent) Hidden
Intel(R) Management Engine Components (x32 Version: 8.0.1.1399 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.1.209 - Intel Corporation)
IrfanView (remove only) (x32 Version: 4.32 - Irfan Skiljan)
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
LogMeIn (x32 Version: 4.1.2504 - LogMeIn, Inc.)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (x32 Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053 - Adobe) Hidden
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000 - Adobe) Hidden
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000 - Adobe) Hidden
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Mozilla Thunderbird 15.0.1 (x86 de) (x32 Version: 15.0.1 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95 - WildTangent) Hidden
Nero 11 Essentials (x32 Version: 11.0.00300 - Nero AG)
Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0 - Nero AG) Hidden
Nero BackItUp 11 (x32 Version: 6.0.18000.19.100 - Nero AG) Hidden
Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200 - Nero AG) Hidden
Nero Backup Drivers (Version: 1.0.11100.8.0 - Nero AG)
Nero BurnRights 11 (x32 Version: 5.0.10300.4.100 - Nero AG) Hidden
Nero BurnRights 11 Help (CHM) (x32 Version: 11.0.10100 - Nero AG) Hidden
Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27 - Nero AG) Hidden
Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300 - Nero AG) Hidden
Nero Core Components 11 (x32 Version: 11.0.15500.1.16 - Nero AG) Hidden
Nero Express 11 (x32 Version: 11.0.11900.24.100 - Nero AG) Hidden
Nero Express 11 Help (CHM) (x32 Version: 11.0.10300 - Nero AG) Hidden
Nero Kwik Media (x32 Version: 1.10.24800.146.100 - Nero AG) Hidden
Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200 - Nero AG) Hidden
Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100 - Nero AG) Hidden
Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11400.27.0 - Nero AG) Hidden
nero.prerequisites.msi (x32 Version: 11.0.20008 - Nero AG) Hidden
No23 Recorder (x32 Version: 2.1.0.3 - No23)
NVIDIA PhysX (x32 Version: 9.09.0203 - NVIDIA Corporation)
OpenOffice.org 3.4 (x32 Version: 3.4.9590 - OpenOffice.org)
PDF Settings CS5 (x32 Version: 10.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (x32 Version: 3.9 - Google, Inc.)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Portal 2 (x32 Version: - Valve)
Premium Sound HD (Version: 1.12.0300 - SRS Labs, Inc.)
PxMergeModule (x32 Version: 1.00.0000 - Your Company Name) Hidden
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6559 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7601.39013 - Realtek Semiconductor Corp.)
Risen (x32 Version: 1.00.0000 - Deep Silver)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
Steam (x32 Version: 1.0.0.0 - Valve Corporation)
Synaptics Pointing Device Driver (Version: 15.3.39.0 - Synaptics Incorporated)
TeamViewer 9 (x32 Version: 9.0.24951 - TeamViewer)
TOSHIBA Assist (x32 Version: 4.2.3.1 - TOSHIBA CORPORATION)
TOSHIBA Disc Creator (Version: 2.1.0.11 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (Version: 1.3.10.64 - TOSHIBA Corporation)
TOSHIBA Hardware Setup (x32 Version: 2.1.0.8 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.11 - TOSHIBA Corporation)
Toshiba Manuals (x32 Version: 10.04 - TOSHIBA)
TOSHIBA Media Controller (x32 Version: 1.0.87.4 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (x32 Version: 1.0.7.7 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (x32 Version: 4.01.0000 - TOSHIBA)
TOSHIBA PC Health Monitor (Version: 1.7.15.64 - TOSHIBA Corporation)
TOSHIBA Places Icon Utility (x32 Version: 1.1.1.4 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (x32 Version: 2.1.6.52020009 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.1.2004 - TOSHIBA Corporation)
TOSHIBA Service Station (x32 Version: 2.2.13 - TOSHIBA)
TOSHIBA Sleep Utility (x32 Version: 1.4.0022.000104 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (x32 Version: 2.1.0.3 - TOSHIBA Corporation)
TOSHIBA TEMPRO (x32 Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (Version: 1.6.0021.640203 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203 - TOSHIBA Corporation)
TOSHIBA Value Added Package (x32 Version: 1.6.0021.640203 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (x32 Version: 2.0.3.33 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (x32 Version: 2.0.3.33 - TOSHIBA Corporation) Hidden
Ubisoft Game Launcher (x32 Version: 1.0.0.0 - UBISOFT)
Update for 2007 Microsoft Office System (KB967642) (x32 Version: - Microsoft)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32 Version: - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32 Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (x32 Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VLC media player 2.0.3 (x32 Version: 2.0.3 - VideoLAN)
VLC media player 2.0.5 (Version: 2.0.5 - VideoLAN)
welcome (x32 Version: 11.0.22500.0.0 - Nero AG) Hidden
WildTangent Games (x32 Version: 1.0.2.5 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.10.15 - WildTangent) Hidden
Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 4.20 (32-Bit) (x32 Version: 4.20.0 - win.rar GmbH)
==================== Restore Points =========================
Could not list Restore Points. Check WMI.
==================== Hosts content: ==========================
2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => ?
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => ?
==================== Loaded Modules (whitelisted) =============
2011-08-22 23:19 - 2011-08-22 23:19 - 11204992 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2011-11-24 21:20 - 2011-11-24 21:20 - 00593856 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2010-12-15 23:19 - 2010-12-15 23:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll
2012-03-07 01:05 - 2011-12-15 15:56 - 00022400 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\de\TosDILangPack.resources.dll
2012-03-07 01:05 - 2011-12-15 15:55 - 00063360 _____ () C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIInternal.XmlSerializers.dll
2012-01-20 12:13 - 2012-01-20 12:13 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-11-09 17:55 - 2011-11-09 17:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2011-11-26 02:51 - 2011-11-26 02:51 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => ""="Driver"
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (01/23/2014 11:42:47 PM) (Source: TabletServicePen) (User: )
Description: Could not init tablet driver
Error: (01/23/2014 11:26:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 07:06:45 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 05:51:37 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/23/2014 03:10:45 PM) (Source: RasClient) (User: )
Description: CoID={4FE72C65-9C35-49D5-A708-07EE1F3CCB56}: Der Benutzer "Maggie\Laura" hat eine Verbindung mit dem Namen "StudNet" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 998.
Error: (01/23/2014 03:10:43 PM) (Source: RasClient) (User: )
Description: CoID={76F64299-2C7C-49C5-B67B-6C7DC6D008D2}: Der Benutzer "Maggie\Laura" hat eine Verbindung mit dem Namen "StudNet" gewählt, die Verbindung konnte jedoch nicht hergestellt werden. Der durch den Fehler zurückgegebene Ursachencode lautet: 998.
Error: (01/22/2014 05:29:55 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: Acrobat.exe, Version: 10.1.8.24, Zeitstempel: 0x5225d619
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18247, Zeitstempel: 0x521ea8e7
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce753
ID des fehlerhaften Prozesses: 0x2100
Startzeit der fehlerhaften Anwendung: 0xAcrobat.exe0
Pfad der fehlerhaften Anwendung: Acrobat.exe1
Pfad des fehlerhaften Moduls: Acrobat.exe2
Berichtskennung: Acrobat.exe3
Error: (01/22/2014 04:53:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
Error: (01/22/2014 04:49:15 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: firefox.exe, Version: 26.0.0.5087, Zeitstempel: 0x52a0d273
Name des fehlerhaften Moduls: xul.dll, Version: 26.0.0.5087, Zeitstempel: 0x52a0d20a
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0014e1a8
ID des fehlerhaften Prozesses: 0x93c
Startzeit der fehlerhaften Anwendung: 0xfirefox.exe0
Pfad der fehlerhaften Anwendung: firefox.exe1
Pfad des fehlerhaften Moduls: firefox.exe2
Berichtskennung: firefox.exe3
Error: (01/22/2014 04:39:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (01/23/2014 11:39:53 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:34:53 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:26:52 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:26:51 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 11:26:25 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (01/23/2014 07:20:05 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:12:14 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:12:12 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:10:09 PM) (Source: ipnathlp) (User: )
Description: 0
Error: (01/23/2014 07:07:06 PM) (Source: ipnathlp) (User: )
Description: 0
Microsoft Office Sessions:
=========================
Error: (11/04/2012 02:47:36 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6662.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 3674 seconds with 2520 seconds of active time. This session ended with a crash.
Error: (09/17/2012 10:58:31 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2529 seconds with 1800 seconds of active time. This session ended with a crash.
Error: (09/05/2012 03:59:27 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1199 seconds with 1020 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 43%
Total physical RAM: 8154.8 MB
Available physical RAM: 4624.66 MB
Total Pagefile: 16307.79 MB
Available Pagefile: 11762.51 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB
==================== Drives ================================
Drive c: (TI30886900A) (Fixed) (Total:448.43 GB) (Free:254.75 GB) NTFS ==>[System with boot components (obtained from reading drive)]
==================== MBR & Partition Table ==================
==================== End Of Log ============================
Code:
GMER 2.1.19355 - hxxp://www.gmer.net
Rootkit scan 2014-01-24 00:26:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT00 465,76GB
Running: gmer.exe; Driver: C:\Users\LAURA_~1\AppData\Local\Temp\awddypod.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff800035a9000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575 fffff800035a902f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2272] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2272] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[5992] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[5992] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[5636] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[5636] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
? C:\windows\system32\mssprxy.dll [5636] entry point in ".rdata" section 00000000676371e6
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[8532] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe[8532] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5644] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe[5644] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
.text C:\program files (x86)\avira\antivir desktop\avcenter.exe[10208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000771a1465 2 bytes [1A, 77]
.text C:\program files (x86)\avira\antivir desktop\avcenter.exe[10208] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000771a14bb 2 bytes [1A, 77]
.text ... * 2
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9DF25BDA-537E-4737-954E-5CEFA39841FC}\mpengine.dll (*** suspicious ***) @ C:\windows\System32\svchost.exe [2928] (Microsoft Malware Protection Engine/Microsoft Corporation SIGNED)(2014-01-21 07:01:03) 000007fee4450000
Library C:\Users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll (*** suspicious ***) @ C:\windows\Explorer.EXE [4320] 000007fef15a0000
Process C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (*** suspicious ***) @ C:\Users\Laura\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [4844] 0000000000400000
Library C:\Users\Laura\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll (*** suspicious ***) @ C:\Program Files (x86)\WinRAR\WinRAR.exe [4340] 0000000073850000
Process C:\Users\Laura\AppData\Local\Temp\Rar$EXa0.631\gmer.exe (*** suspicious ***) @ C:\Users\Laura\AppData\Local\Temp\Rar$EXa0.631\gmer.exe [8264](2014-01-23 22:51:40) 0000000000400000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 8115
Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 10130
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@DhcpServer 192.168.1.130
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@LeaseObtainedTime 1390517838
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@T1 1390517988
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@T2 1390518100
Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{7A4A2A3D-7397-4D43-A5D1-D9A8E82BE279}@LeaseTerminatesTime 1390518138
---- EOF - GMER 2.1 ----
|
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
