Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Computer gesperrt-Angebliche Seite Bundeskriminalamt-Zahlungsaufforderung paycard (https://www.trojaner-board.de/150799-computer-gesperrt-angebliche-seite-bundeskriminalamt-zahlungsaufforderung-paycard.html)

wolli58 08.03.2014 21:45
Computer gesperrt-Angebliche Seite Bundeskriminalamt-Zahlungsaufforderung paycard
 
Beim Hochfahren erscheint eine Seite des "Bundeskriminalamtes" mit der auf meine angeblichen Aktivitaeten hinsichtlich Kinderpornographie hingewiesen wird. Gegen eine Zahlung von 100 Euro , so behauptet man, wuerde der Computer wieder freigeschaltet.
Auf meinem 2.Account "guest account" kann ich noch das malware Programm installieren und durchlaufen lassen.Nach 2 Std. zeigt es mir 700 !!! infizierte Elemente an .
Einige werden geloescht, andere in Quarantaene verschoben, bei den meisten erfolgt keine Aktion.
Der guest account bleibt nur noch wenige Minuten fun ktionstuechtig...danach erscheint auch hier nur noch die oben erwaehnte Seite des BKAs.

Bootsektor 08.03.2014 22:07
:hallo:

Mein Name ist Sandra und ich werde Dir bei Deinem Problem behilflich sein.
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem
  • Führe bitte nur Scans durch zu denen Du von mir aufgefordert wirst.
  • Bitte kein Crossposting ( posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, ausser Du wurdest dazu aufgefordert.
  • Speichere alle unsere Toosl auf dem Desktop ab.
  • Poste die Logfiles direkt in deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 2 Tagen nichts von mir hörst, dann schreibe mir bitte eine PM.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Dir jemand vom Team sagt, dass Du clean bist.

Bitte füge die Logs immer in Code-Tags ein. Wenn Du das nicht machst, erschwert es mir sehr das Auswerten. Danke.
Dazu:
  • Klicke über dem Antwortfenster auf die Raute #, dann steht dort in eckigen Klammern [code][/code]
  • Zwischen den beiden code-Bausteinen fügst Du dann deine Logfiles ein. Also [CODE] Logfile [/CODE]
  • Wenn die Logs zu lang sein sollten, dann teile sie bitte auf und poste sie dann hier in Deinem Thread, notfalls in mehreren Antworten.


Was für ein Betriebssystem hast du und von welchem Malwareprogramm sprichst du?
Geht der abgesicherte Modus?

wolli58 09.03.2014 21:42
Hi Sandra,
danke dir fuer dein Hilfsangebot. Ich habe das Programm "malwarebytes" benutzt.Das Betriebssystem ist windows 7 . Selbst im abgesicherten Modus erscheint der Sperrbildschirm.

Bootsektor 09.03.2014 22:30
Hallo wolli58,

ok. Dann mache bitte folgendes.

Schritt 1

Scan mit Farbar's Recovery Scan Tool (Recovery Mode - Windows Vista, 7, 8)
Hinweise für Windows 8-Nutzer: Anleitung 1 (FRST-Variante) und Anleitung 2 (zweiter Teil)
  • Downloade dir bitte die passende Version des Tools (im Zweifel beide) und speichere diese auf einen USB Stick: FRST 32-Bit | FRST 64-Bit
  • Schließe den USB Stick an das infizierte System an und boote das System in die System Reparatur Option.
  • Scanne jetzt nach der bebilderten Anleitung oder verwende die folgende Kurzanleitung:
Über den Boot Manager:
  • Starte den Rechner neu.
  • Während dem Hochfahren drücke mehrmals die F8 Taste
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Mit Windows CD/DVD (auch bei Windows 8 möglich):
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu und starte von der CD.
  • Wähle die Spracheinstellungen und klicke "Weiter".
  • Klicke auf Computerreparaturoptionen !
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils "Weiter".
Wähle in den Reparaturoptionen: Eingabeaufforderung
  • Gib nun bitte notepad ein und drücke Enter.
  • Im öffnenden Textdokument: Datei > Speichern unter... und wähle Computer.
    Hier wird dir der Laufwerksbuchstabe deines USB Sticks angezeigt, merke ihn dir.
  • Schließe Notepad wieder
  • Gib nun bitte folgenden Befehl ein.
    e:\frst.exe bzw. e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks, den du dir gemerkt hast. Gegebenfalls anpassen.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan
Das Tool erstellt eine FRST.txt auf deinem USB Stick. Poste den Inhalt bitte hier nach Möglichkeit in Code-Tags (Anleitung).

Bootsektor 13.03.2014 23:01
Hallo,

ich habe schon länger keine Antwort mehr von Dir erhalten. Benötigst Du weiterhin noch Hilfe?

Wenn ich in den nächsten 24 Stunden nichts von Dir höre, gehe ich davon aus, dass sich das Thema erledigt hat.

Bootsektor 17.03.2014 12:05
Fehlende Rückmeldung
Schicke bitte eine PM an mich falls Du weiter machen willst.

wolli58 19.03.2014 22:12

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-03-2014 01
Ran by SYSTEM on MININT-KA3I1C0 on 11-03-2014 19:58:46
Running from H:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Geeks to Go Forums

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-03-19] (TOSHIBA Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-02-11] (Toshiba Europe GmbH)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [896032 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1489760 2010-04-06] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [705368 2010-02-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-02-22] (TOSHIBA)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [NBAgent] - c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [1086760 2010-03-09] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2009-12-25] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-02-24] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [AVG_TRAY] - C:\Program Files (x86)\AVG\AVG2012\avgtray.exe [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2539544 2014-03-06] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Anti-phishing Domain Advisor] - C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe [232616 2012-03-01] (Visicom Media Inc. (Powered by Panda Security))
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKU\Default\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\Default User\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\Gast\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-07-24] (Google Inc.)
HKU\Guest\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-07-24] (Google Inc.)
HKU\Guest\...\Run: [Xvid] - C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
HKU\Guest\...\Run: [Spotify] - C:\Users\Guest\AppData\Roaming\Spotify\Spotify.exe [7601880 2012-08-30] (Spotify Ltd)
HKU\Guest\...\Run: [Spotify Web Helper] - C:\Users\Guest\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-30] ()
HKU\Guest\...\Run: [TBHostSupport] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Guest\AppData\Local\TBHostSupport\TBHostSupport_0.dll",DLLRunTBHostSupportPlugin <===== ATTENTION
HKU\Guest\...\Run: [APISupport] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Guest\AppData\Local\Conduit\APISupport\APISupport.dll",DLLRunAPISupport <===== ATTENTION
HKU\wolli\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3883840 2009-07-26] (Microsoft Corporation)
AppInit_DLLs-x32: c:\progra~3\bprote~1\21415~1.37\protec~1.dll => C:\ProgramData\bProtectorForWindows\2.1.415.37\protector.dll [1516024 2012-04-28] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9727tqx.lnk
ShortcutTarget: 9727tqx.lnk -> C:\ProgramData\xqt7279.cpp (Microsoft Corporation)
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9727tqx.lnk
ShortcutTarget: 9727tqx.lnk -> C:\ProgramData\xqt7279.cpp (Microsoft Corporation)
Startup: C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk ->  (No File)
Startup: C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Services (Whitelisted) =================

S3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] ()
S2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [5175856 2013-10-16] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.)
S2 bProtector; C:\ProgramData\bProtectorForWindows\2.1.415.37\bProtect.exe [1181176 2012-04-28] (bProtector)
S2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [123384 2014-01-22] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-02-11] (Toshiba Europe GmbH)
S2 vToolbarUpdater18.0.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.0\ToolbarUpdater.exe [1759768 2014-03-06] (AVG Secure Search)
S2 Winmgmt; C:\ProgramData\9727tqx.zvv [332540 2014-03-08] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [127328 2012-12-10] (AVG Technologies CZ, s.r.o. )
S3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfiltera.sys [29776 2011-12-23] (AVG Technologies CZ, s.r.o. )
S0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [28480 2012-04-19] (AVG Technologies CZ, s.r.o. )
S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [307040 2012-11-08] (AVG Technologies CZ, s.r.o.)
S1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [47696 2011-12-23] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [36944 2012-01-31] (AVG Technologies CZ, s.r.o.)
S1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [384800 2013-04-11] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-03-06] (AVG Technologies)
S3 DSDrv4AMD64; C:\Program Files (x86)\DScaler\DSDrv4amd64.sys [22488 2009-08-28] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 U6000ALL; C:\Windows\System32\DRIVERS\U6000ALL.sys [276480 2007-07-14] ()
S3 X6va005; \??\C:\Users\Guest\AppData\Local\Temp\00542.tmp [X]
S3 X6va006; \??\C:\Users\Guest\AppData\Local\Temp\006B97E.tmp [X]
S3 X6va007; \??\C:\Users\Guest\AppData\Local\Temp\0075878.tmp [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-11 19:58 - 2014-03-11 19:58 - 00000000 ____D () C:\FRST
2014-03-08 20:51 - 2014-03-08 20:51 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\Nico Mak Computing
2014-03-08 20:37 - 2014-03-09 21:31 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-03-08 20:30 - 2014-03-08 20:30 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Nico Mak Computing
2014-03-08 20:28 - 2014-03-08 20:32 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-03-08 20:28 - 2014-03-08 20:30 - 00001200 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-03-08 20:28 - 2014-03-08 20:29 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-03-08 20:28 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\System32\wsusnative64.exe
2014-03-08 20:27 - 2014-03-08 20:27 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1 (1).exe
2014-03-08 20:26 - 2014-03-08 20:26 - 00667272 _____ ( ) C:\Users\Guest\Downloads\ZipSetup.exe
2014-03-08 20:20 - 2014-03-08 20:20 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1.exe
2014-03-08 19:28 - 2014-03-08 19:28 - 00002272 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-03-08 19:28 - 2014-03-08 19:28 - 00000000 ____D () C:\Users\Guest\AppData\Local\WinZip
2014-03-08 19:27 - 2014-03-08 19:28 - 00000000 ____D () C:\ProgramData\WinZip
2014-03-08 19:27 - 2014-03-08 19:28 - 00000000 ____D () C:\Program Files\WinZip
2014-03-08 19:26 - 2014-03-08 19:26 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180 (1).exe
2014-03-08 19:25 - 2014-03-08 19:25 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180.exe
2014-03-08 16:03 - 2014-03-08 16:03 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-08 16:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (4).exe
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (3).exe
2014-03-08 16:00 - 2014-03-08 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (2).exe
2014-03-08 15:59 - 2014-03-08 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (1).exe
2014-03-08 15:59 - 2014-03-08 15:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-08 15:30 - 2014-03-11 19:40 - 00003424 _____ () C:\Windows\System32\Tasks\bProtector
2014-03-08 15:16 - 2014-03-11 19:40 - 95027928 ____T () C:\ProgramData\9727tqx.fee
2014-03-08 15:16 - 2014-03-08 15:16 - 00332540 ____T (Microsoft Corporation) C:\ProgramData\9727tqx.zvv
2014-03-08 15:16 - 2014-03-08 15:16 - 00183337 _____ (Microsoft Corporation) C:\ProgramData\xqt7279.cpp
2014-03-06 22:12 - 2014-03-06 22:17 - 00000000 ____D () C:\Users\wolli\Documents\Kanada 2014
2014-03-06 18:42 - 2014-03-06 19:04 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-03-01 13:31 - 2014-03-01 13:31 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\4.0
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\.tfo4
2014-02-24 22:14 - 2014-02-24 22:14 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-24 15:41 - 2014-02-24 15:41 - 00018778 _____ () C:\Users\Guest\Documents\graf.odt
2014-02-17 11:36 - 2014-02-17 11:36 - 00000000 ____D () C:\Users\wolli\4.0
2014-02-17 11:36 - 2014-02-17 11:36 - 00000000 ____D () C:\Users\wolli\.tfo4
2014-02-15 18:00 - 2014-02-15 18:06 - 00017957 _____ () C:\Users\Guest\Documents\ohm.odt
2014-02-12 22:17 - 2014-02-06 12:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-02-12 22:17 - 2014-02-06 11:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-02-12 22:17 - 2014-02-06 11:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-12 22:17 - 2014-02-06 11:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-02-12 22:17 - 2014-02-06 10:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-12 22:17 - 2014-02-06 10:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-12 22:17 - 2013-12-21 10:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-02-12 22:17 - 2013-12-21 09:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-12 22:16 - 2014-02-06 13:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-02-12 22:16 - 2014-02-06 12:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-02-12 22:16 - 2014-02-06 12:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-02-12 22:16 - 2014-02-06 12:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-02-12 22:16 - 2014-02-06 12:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-02-12 22:16 - 2014-02-06 11:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-02-12 22:16 - 2014-02-06 11:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-02-12 22:16 - 2014-02-06 11:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-02-12 22:16 - 2014-02-06 11:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-02-12 22:16 - 2014-02-06 11:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-02-12 22:16 - 2014-02-06 11:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-12 22:16 - 2014-02-06 11:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-02-12 22:16 - 2014-02-06 11:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-02-12 22:16 - 2014-02-06 11:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-12 22:16 - 2014-02-06 11:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-12 22:16 - 2014-02-06 10:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-12 22:16 - 2014-02-06 10:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-02-12 22:16 - 2014-02-06 10:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-12 22:16 - 2014-02-06 10:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-12 22:16 - 2014-02-06 10:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-02-12 22:16 - 2014-02-06 10:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-12 22:16 - 2014-02-06 10:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-12 22:16 - 2014-02-06 10:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-12 22:16 - 2014-02-06 10:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-02-12 22:16 - 2014-02-06 10:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-02-12 22:16 - 2014-02-06 10:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-12 22:16 - 2014-02-06 10:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-12 22:16 - 2014-02-06 10:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-12 22:16 - 2014-02-06 09:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-02-12 22:16 - 2014-02-06 09:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-12 22:16 - 2014-02-06 09:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-02-12 22:16 - 2014-02-06 09:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-12 22:16 - 2014-02-06 09:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-12 21:18 - 2013-12-25 00:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-12 21:18 - 2013-12-24 23:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2014-02-12 21:18 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2014-02-12 21:18 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2014-02-12 21:18 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-12 21:18 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-12 21:18 - 2013-11-26 09:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-12 21:18 - 2013-11-22 23:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2014-02-11 12:44 - 2014-02-11 12:44 - 00011070 _____ () C:\Users\wolli\Documents\Beihilfe.odt
2014-02-11 08:20 - 2014-02-11 08:20 - 00002142 _____ () C:\Users\wolli\Desktop\Mozilla Firefox 4.0 Beta 1 (2).lnk
2014-02-11 08:15 - 2014-02-11 08:15 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-02-10 21:33 - 2014-02-10 21:33 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\TuneUp Software
2014-02-10 21:30 - 2014-02-10 21:30 - 00002990 _____ () C:\Windows\System32\Tasks\{E8AFA139-C9C4-4D6C-BBD5-738D909C12EE}
2014-02-10 15:58 - 2014-02-10 15:58 - 00042748 _____ () C:\Users\wolli\Downloads\www.skitouren.ch- Gipfelbuch - Oberalpstock_Piz Tgietschen, 3328 m.ü.M.htm
2014-02-10 15:58 - 2014-02-10 15:58 - 00000000 ____D () C:\Users\wolli\Downloads\www.skitouren.ch- Gipfelbuch - Oberalpstock_Piz Tgietschen, 3328 m.ü.M_files

==================== One Month Modified Files and Folders =======

2014-03-11 19:58 - 2014-03-11 19:58 - 00000000 ____D () C:\FRST
2014-03-11 19:40 - 2014-03-08 15:30 - 00003424 _____ () C:\Windows\System32\Tasks\bProtector
2014-03-11 19:40 - 2014-03-08 15:16 - 95027928 ____T () C:\ProgramData\9727tqx.fee
2014-03-11 19:40 - 2013-06-08 09:30 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2014-03-11 19:40 - 2013-06-03 21:03 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-03-11 19:40 - 2010-07-24 08:05 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-11 19:40 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-11 19:40 - 2009-07-14 05:51 - 00137437 _____ () C:\Windows\setupact.log
2014-03-09 21:43 - 2013-12-07 22:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-09 21:38 - 2009-07-14 05:45 - 00016304 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-09 21:38 - 2009-07-14 05:45 - 00016304 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-09 21:37 - 2010-07-24 08:05 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-09 21:34 - 2011-09-18 17:22 - 00000000 ____D () C:\Users\Guest\AppData\Local\LogMeIn Hamachi
2014-03-09 21:31 - 2014-03-08 20:37 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-03-09 21:30 - 2011-05-07 11:36 - 00000000 ____D () C:\Windows\System32\Drivers\AVG
2014-03-09 12:06 - 2010-06-04 01:06 - 01515332 _____ () C:\Windows\WindowsUpdate.log
2014-03-09 11:54 - 2011-09-19 15:36 - 00000000 ____D () C:\Users\wolli\AppData\Local\LogMeIn Hamachi
2014-03-09 11:52 - 2012-04-05 10:21 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\Dropbox
2014-03-09 11:51 - 2012-04-05 10:23 - 00000000 ___RD () C:\Users\wolli\Dropbox
2014-03-09 11:51 - 2011-09-22 20:55 - 00000000 ____D () C:\Users\wolli\Tracing
2014-03-08 20:51 - 2014-03-08 20:51 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\Nico Mak Computing
2014-03-08 20:34 - 2011-09-09 09:51 - 00000000 ____D () C:\Users\Guest\AppData\Local\VirtualStore
2014-03-08 20:32 - 2014-03-08 20:28 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-03-08 20:32 - 2010-06-04 01:03 - 00070148 _____ () C:\Windows\PFRO.log
2014-03-08 20:30 - 2014-03-08 20:30 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Nico Mak Computing
2014-03-08 20:30 - 2014-03-08 20:28 - 00001200 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-03-08 20:29 - 2014-03-08 20:28 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-03-08 20:27 - 2014-03-08 20:27 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1 (1).exe
2014-03-08 20:26 - 2014-03-08 20:26 - 00667272 _____ ( ) C:\Users\Guest\Downloads\ZipSetup.exe
2014-03-08 20:20 - 2014-03-08 20:20 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1.exe
2014-03-08 19:32 - 2012-03-18 07:31 - 00000000 ____D () C:\ProgramData\Norton
2014-03-08 19:28 - 2014-03-08 19:28 - 00002272 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-03-08 19:28 - 2014-03-08 19:28 - 00000000 ____D () C:\Users\Guest\AppData\Local\WinZip
2014-03-08 19:28 - 2014-03-08 19:27 - 00000000 ____D () C:\ProgramData\WinZip
2014-03-08 19:28 - 2014-03-08 19:27 - 00000000 ____D () C:\Program Files\WinZip
2014-03-08 19:26 - 2014-03-08 19:26 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180 (1).exe
2014-03-08 19:25 - 2014-03-08 19:25 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180.exe
2014-03-08 19:22 - 2012-06-23 19:35 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Spotify
2014-03-08 19:12 - 2012-06-24 14:12 - 00000000 ____D () C:\Program Files (x86)\Vid-Saver
2014-03-08 16:03 - 2014-03-08 16:03 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (4).exe
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (3).exe
2014-03-08 16:00 - 2014-03-08 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (2).exe
2014-03-08 16:00 - 2014-03-08 15:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (1).exe
2014-03-08 15:59 - 2014-03-08 15:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-08 15:49 - 2013-11-26 21:14 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\BitTorrent
2014-03-08 15:16 - 2014-03-08 15:16 - 00332540 ____T (Microsoft Corporation) C:\ProgramData\9727tqx.zvv
2014-03-08 15:16 - 2014-03-08 15:16 - 00183337 _____ (Microsoft Corporation) C:\ProgramData\xqt7279.cpp
2014-03-08 11:18 - 2010-07-24 09:18 - 07686656 ___SH () C:\Users\wolli\Documents\Thumbs.db
2014-03-08 11:16 - 2012-06-01 13:39 - 00012893 _____ () C:\Users\wolli\Documents\Meine 3000er.odt
2014-03-08 10:59 - 2013-12-26 07:22 - 00003516 _____ () C:\Windows\System32\Tasks\wolli NBAgent
2014-03-07 11:00 - 2012-02-09 21:17 - 00002182 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-06 22:17 - 2014-03-06 22:12 - 00000000 ____D () C:\Users\wolli\Documents\Kanada 2014
2014-03-06 19:20 - 2009-07-14 18:58 - 00643866 _____ () C:\Windows\System32\perfh007.dat
2014-03-06 19:20 - 2009-07-14 18:58 - 00126394 _____ () C:\Windows\System32\perfc007.dat
2014-03-06 19:20 - 2009-07-14 06:13 - 01472002 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-03-06 19:04 - 2014-03-06 18:42 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-03-06 18:42 - 2013-05-12 10:59 - 00003728 _____ () C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1avg-secure-search.xml
2014-03-06 18:42 - 2012-09-04 14:17 - 00050976 _____ (AVG Technologies) C:\Windows\System32\Drivers\avgtpx64.sys
2014-03-06 18:42 - 2011-12-13 16:35 - 00000000 ____D () C:\Program Files (x86)\AVG Secure Search
2014-03-01 13:31 - 2014-03-01 13:31 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\4.0
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\.tfo4
2014-02-27 09:03 - 2011-09-09 09:51 - 00000000 ____D () C:\users\Guest
2014-02-24 22:15 - 2013-12-07 22:44 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-24 22:15 - 2013-12-07 22:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-24 22:15 - 2011-12-23 21:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-24 22:14 - 2014-02-24 22:14 - 17858952 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-02-24 15:41 - 2014-02-24 15:41 - 00018778 _____ () C:\Users\Guest\Documents\graf.odt
2014-02-18 21:37 - 2013-12-25 16:44 - 00000000 ____D () C:\Users\wolli\Desktop\best of  XL
2014-02-17 11:36 - 2014-02-17 11:36 - 00000000 ____D () C:\Users\wolli\4.0
2014-02-17 11:36 - 2014-02-17 11:36 - 00000000 ____D () C:\Users\wolli\.tfo4
2014-02-17 11:36 - 2010-07-22 13:59 - 00000000 ____D () C:\users\wolli
2014-02-17 10:52 - 2012-05-13 22:13 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-17 10:52 - 2010-07-22 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1
2014-02-15 18:06 - 2014-02-15 18:00 - 00017957 _____ () C:\Users\Guest\Documents\ohm.odt
2014-02-14 18:32 - 2010-07-24 08:05 - 00004104 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-02-14 18:32 - 2010-07-24 08:05 - 00003852 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-02-12 08:32 - 2010-04-19 10:11 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-02-11 12:44 - 2014-02-11 12:44 - 00011070 _____ () C:\Users\wolli\Documents\Beihilfe.odt
2014-02-11 08:20 - 2014-02-11 08:20 - 00002142 _____ () C:\Users\wolli\Desktop\Mozilla Firefox 4.0 Beta 1 (2).lnk
2014-02-11 08:15 - 2014-02-11 08:15 - 00000000 ____D () C:\Program Files\McAfee Security Scan
2014-02-11 08:15 - 2013-02-13 20:50 - 00001938 _____ () C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2014-02-10 21:33 - 2014-02-10 21:33 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\TuneUp Software
2014-02-10 21:30 - 2014-02-10 21:30 - 00002990 _____ () C:\Windows\System32\Tasks\{E8AFA139-C9C4-4D6C-BBD5-738D909C12EE}
2014-02-10 19:17 - 2013-12-22 17:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-02-10 15:58 - 2014-02-10 15:58 - 00042748 _____ () C:\Users\wolli\Downloads\www.skitouren.ch- Gipfelbuch - Oberalpstock_Piz Tgietschen, 3328 m.ü.M.htm
2014-02-10 15:58 - 2014-02-10 15:58 - 00000000 ____D () C:\Users\wolli\Downloads\www.skitouren.ch- Gipfelbuch - Oberalpstock_Piz Tgietschen, 3328 m.ü.M_files

Files to move or delete:
====================
C:\ProgramData\9727tqx.fee
C:\ProgramData\9727tqx.zvv


Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\i4jdel0.exe
C:\Users\Gast\AppData\Local\Temp\i4jdel1.exe
C:\Users\Guest\AppData\Local\Temp\contentDATs.exe
C:\Users\Guest\AppData\Local\Temp\dsHostCheckerSetup.exe
C:\Users\Guest\AppData\Local\Temp\FileSystemView.dll
C:\Users\Guest\AppData\Local\Temp\gftsmaie.dll
C:\Users\Guest\AppData\Local\Temp\i4jdel0.exe
C:\Users\Guest\AppData\Local\Temp\i4jdel1.exe
C:\Users\Guest\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Guest\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Guest\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Guest\AppData\Local\Temp\tbBit2.dll
C:\Users\Guest\AppData\Local\Temp\uttD0EF.tmp.exe
C:\Users\Guest\AppData\Local\Temp\vcredist_x86.exe
C:\Users\wolli\AppData\Local\Temp\avguidx.dll
C:\Users\wolli\AppData\Local\Temp\contentDATs.exe
C:\Users\wolli\AppData\Local\Temp\dsHostCheckerSetup.exe
C:\Users\wolli\AppData\Local\Temp\FileSystemView.dll
C:\Users\wolli\AppData\Local\Temp\iGearedHelper.dll
C:\Users\wolli\AppData\Local\Temp\iv_uninstall.exe
C:\Users\wolli\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\wolli\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\wolli\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\wolli\AppData\Local\Temp\oi_{12B729D8-26AC-42DA-997D-17A4F09BAD47}.exe
C:\Users\wolli\AppData\Local\Temp\quzjw5hy.dll
C:\Users\wolli\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\wolli\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\wolli\AppData\Local\Temp\~+JF1594943289653576939.dll


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================


==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 3954.67 MB
Available physical RAM: 3367.04 MB
Total Pagefile: 3952.82 MB
Available Pagefile: 3375.35 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:232.88 GB) (Free:13.83 GB) NTFS
Drive d: (Data) (Fixed) (Total:232.49 GB) (Free:220.74 GB) NTFS
Drive e: (SYSTEM) (Fixed) (Total:0.39 GB) (Free:0.17 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: (Intenso) (Removable) (Total:3.89 GB) (Free:3.33 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: D9ADAD65)

Partition: GPT Partition Type.

========================================================
Disk: 2 (Size: 4 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.


LastRegBack: 2014-01-15 19:30

==================== End Of Log ============================
--- --- ---

Bootsektor 19.03.2014 22:34
Hallo wolli58,

sehr gut. Danke.

Startet der Rechner nach folgendem Fix wieder normal?
Schritt 1

Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9727tqx.lnk
ShortcutTarget: 9727tqx.lnk -> C:\ProgramData\xqt7279.cpp (Microsoft Corporation)
Startup: C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9727tqx.lnk
ShortcutTarget: 9727tqx.lnk -> C:\ProgramData\xqt7279.cpp (Microsoft Corporation)
S2 Winmgmt; C:\ProgramData\9727tqx.zvv [332540 2014-03-08] (Microsoft Corporation)
C:\ProgramData\9727tqx.zvv
C:\ProgramData\xqt7279.cpp
C:\ProgramData\9727tqx.fee
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.

Wir sind nach diesem Schritt noch nicht fertig, bitte arbeite weiterhin mit.

wolli58 21.03.2014 09:37
Hi Sandra,
habe den Stick in den Computer gesteckt, aber statt auf FIX habe ich versehentlich auf SCAN gedrückt.....Computer läuft ganz gut, aber anscheinend nicht perfekt....
Wie gehen wir weiter vor ?
Wolli58

Bootsektor 21.03.2014 11:14
Hallo wolli58,

mysteriös, aber wenn dein PC jetzt im Normalmodus startet, dann mache bitte folgendes im Normalmodus:

Schritt 1

Verschiebe nun die FRST.exe von Deinem USB-Stick auf den Desktop Deines Rechners.
Starte jetzt noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

wolli58 22.03.2014 21:20
FRST Additions Logfile:
[CODE]Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-03-2014 01
Ran by wolli at 2014-03-22 21:14:11
Running from F:\
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
AS: AVG Anti-Virus Free Edition 2012 (Enabled - Up to date) {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.3.9130 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.3.9130 - Adobe Systems Inc.) Hidden
Adobe Flash Player 12 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader 9.5.1 - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.1 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.)
Advertising Center (x32 Version: 0.0.0.2 - Nero AG) Hidden
Amazon.de (HKLM-x32\...\{A74F16FA-1D5B-405B-8D8D-1BC6F9DAED8B}) (Version: - Amazon EU S.a.r.L.)
Anti-phishing Domain Advisor (HKLM-x32\...\Anti-phishing Domain Advisor) (Version: 1.0.0.0 - Visicom Media Inc. (Powered by Panda Security))
ATI Catalyst Install Manager (HKLM\...\{B5896016-3143-B94F-585D-DF75DAF1D879}) (Version: 3.0.765.0 - ATI Technologies, Inc.)
AudioConverter (HKLM-x32\...\AudioConverter) (Version: - PerformerSoft LLC) <==== ATTENTION
AVG 2012 (HKLM\...\AVG) (Version: 2012.1.2247 - AVG Technologies)
AVG 2012 (Version: 12.0.3722 - AVG Technologies) Hidden
AVG 2012 (Version: 12.1.2247 - AVG Technologies) Hidden
AVG Security Toolbar (HKLM-x32\...\AVG Secure Search) (Version: 18.0.5.292 - AVG Technologies)
AviSynth 2.5 (HKLM-x32\...\AviSynth) (Version: - )
Bejeweled 2 Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
BitTorrent (HKLM-x32\...\BitTorrent) (Version: 7.6.1 - BitTorrent Inc.)
blekko search bar (HKLM-x32\...\blekkotb_020) (Version: 1.3.19.12 - Visicom Media Inc.) <==== ATTENTION
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v7.10.10(T) - TOSHIBA CORPORATION)
bProtector for Windows (HKLM-x32\...\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}) (Version: - )
Broadcom 802.11 Network Adapter (HKLM\...\Broadcom 802.11 Network Adapter) (Version: 5.60.48.42 - Broadcom Corporation)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Core Implementation (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
Catalyst Control Center Graphics Full New (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
Catalyst Control Center Graphics Light (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2010.0315.1050.17562 - ATI Technologies, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2010.0315.1050.17562 - ATI) Hidden
CCC Help Chinese Standard (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Chinese Traditional (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Czech (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Danish (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Dutch (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help English (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Finnish (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help French (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help German (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Greek (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Hungarian (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Italian (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Japanese (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Korean (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Norwegian (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Polish (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Portuguese (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Russian (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Spanish (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Swedish (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Thai (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
CCC Help Turkish (x32 Version: 2010.0315.1049.17562 - ATI) Hidden
ccc-core-static (x32 Version: 2010.0315.1050.17562 - Ihr Firmenname) Hidden
ccc-utility64 (Version: 2010.0315.1050.17562 - ATI) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Content Manager 2 (HKLM-x32\...\Content Manager 2) (Version: 3.10.0.45737 - NNG Llc.)
Cross Fire En (HKLM-x32\...\Cross Fire_is1) (Version: - Z8Games.com)
Crossfire Europe (HKLM-x32\...\Crossfire Europe) (Version: 1.172 - SG INTERACTIVE)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden
Dropbox (HKCU\...\Dropbox) (Version: 2.4.11 - Dropbox, Inc.)
Drv (HKLM-x32\...\{DA71A94B-3617-4935-8BBE-1566B2174C95}) (Version: 1.00.0000 - My Company Name)
DScaler 4 Test Version (HKLM-x32\...\DScaler 4 Test Version_is1) (Version: - )
eBay (HKLM-x32\...\{FDE58148-57E7-43BF-879A-29CCE818C078}) (Version: 1.1.9 - eBay Inc.)
FATE (x32 Version: 2.2.0.82 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 33.0.1750.146 - Google Inc.)
Google Earth (HKLM-x32\...\{528145C0-462A-11E1-B8B4-B8AC6F97B88E}) (Version: 6.2.0.5905 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.4805.320 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.5.7.1002 - Intel Corporation)
Java Auto Updater (x32 Version: 2.0.7.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 31 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216031FF}) (Version: 6.0.310 - Oracle)
Jewel Quest II (x32 Version: 2.2.0.82 - WildTangent) Hidden
Juniper Networks Host Checker (HKCU\...\Neoteris_Host_Checker) (Version: 7.1.0.18671 - Juniper Networks)
Juniper Networks, Inc. Setup Client (HKCU\...\Juniper_Setup_Client) (Version: 7.1.3.11013 - Juniper Networks, Inc.)
Juniper Networks, Inc. Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks, Inc.)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Lagarith Lossless Codec (1.3.27) (HKLM-x32\...\{F59AC46C-10C3-4023-882C-4212A92283B3}_is1) (Version: - )
Linkury Smartbar (HKLM-x32\...\{B01AAC47-D5D7-4A9A-AFC0-1C2C23AE8991}) (Version: 1.6.1.835 - Linkury Inc.) <==== ATTENTION
LogMeIn Hamachi (HKLM-x32\...\LogMeIn Hamachi) (Version: 2.2.0.173 - LogMeIn, Inc.)
LogMeIn Hamachi (x32 Version: 2.2.0.173 - LogMeIn, Inc.) Hidden
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.141.11 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.1.0.175 - McAfee, Inc.)
McAfee SiteAdvisor (HKLM-x32\...\{35ED3F83-4BDC-4c44-8EC6-6A8301C7413A}) (Version: 3.6.135 - McAfee, Inc.)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{39D0E034-1042-4905-BECB-5502909FCB7C}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 28.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 en-US)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 24.3.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.3.0 (x86 de)) (Version: 24.3.0 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Naviextras Toolbox Prerequesities (HKLM-x32\...\{537575D6-3B96-474C-BD8F-DFF667363DBD}) (Version: 1.0.0 - NNG Llc.)
NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.18.0 - NEC Electronics Corporation)
NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0 - NEC Electronics Corporation) Hidden
Nero 9 Essentials (HKLM-x32\...\{c7ba895b-8ada-4628-aa47-27b4badbdc6b}) (Version: - Nero AG)
Nero BackItUp (HKLM-x32\...\{0420F95C-11FF-4E02-B967-6CC22B188F9F}) (Version: 5.2.21001 - Nero AG)
Nero BackItUp and Burn (HKLM-x32\...\{E08CC458-41FB-4BB5-9B08-2C83DB55A5B9}) (Version: 1.2.0030 - Nero AG)
Nero BurnRights (HKLM-x32\...\{397516AE-7DFE-4F90-84E0-BD616D559434}) (Version: 3.6.26001 - Nero AG)
Nero BurnRights (x32 Version: 3.4.13.100 - Nero AG) Hidden
Nero BurnRights Help (x32 Version: 3.4.4.100 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 9.0.0.1 - Nero AG) Hidden
Nero DiscSpeed (x32 Version: 5.4.13.100 - Nero AG) Hidden
Nero DiscSpeed Help (x32 Version: 5.4.4.100 - Nero AG) Hidden
Nero DriveSpeed (x32 Version: 4.4.12.100 - Nero AG) Hidden
Nero DriveSpeed Help (x32 Version: 4.4.4.100 - Nero AG) Hidden
Nero Express (HKLM-x32\...\{6C3CF7AC-5AB0-42D9-93C0-68166A57AFB6}) (Version: 9.6.16000 - Nero AG)
Nero Express Help (x32 Version: 9.4.34.100 - Nero AG) Hidden
Nero InfoTool (x32 Version: 6.4.12.100 - Nero AG) Hidden
Nero InfoTool Help (x32 Version: 6.4.4.100 - Nero AG) Hidden
Nero Installer (x32 Version: 4.4.9.0 - Nero AG) Hidden
Nero Online Upgrade (x32 Version: 1.3.0.0 - Nero AG) Hidden
Nero RescueAgent (HKLM-x32\...\{51E2F9B3-A972-4F58-B4EF-4D9676D9F5D1}) (Version: 2.6.25002 - Nero AG)
Nero StartSmart (x32 Version: 9.4.37.100 - Nero AG) Hidden
Nero StartSmart Help (x32 Version: 9.4.37.100 - Nero AG) Hidden
NeroExpress (x32 Version: 9.4.34.100 - Nero AG) Hidden
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
OpenOffice.org 3.2 (HKLM-x32\...\{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}) (Version: 3.2.9502 - OpenOffice.org)
Pando Media Booster (HKLM-x32\...\{980A182F-E0A2-4A40-94C1-AE0C1235902E}) (Version: 2.6.0.9 - Pando Networks Inc.)
Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden
Photo Service - powered by myphotobook (HKLM-x32\...\eu.myphotobook.001F9DF2D0BAABEB11F42CCEE43224607B61109C.1) (Version: 1.0.7-279 - myphotobook GmbH)
Photo Service - powered by myphotobook (x32 Version: 1.0.7 - myphotobook GmbH) Hidden
Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Polar Bowler (x32 Version: 2.2.0.82 - WildTangent) Hidden
PriceGong 2.6.4 (HKLM-x32\...\PriceGong) (Version: 2.6.4 - PriceGong) <==== ATTENTION
PSP Video 9 6 (HKLM-x32\...\PSP Video 9) (Version: 6 - Red Kawa)
Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.13.112.2010 - Realtek)
Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5992 - Realtek Semiconductor Corp.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6069 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30111 - Realtek Semiconductor Corp.)
Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
Toshiba Assist (HKLM-x32\...\{1B87C40B-A60B-4EF3-9A68-706CF4B69978}) (Version: 3.00.11 - TOSHIBA CORPORATION)
TOSHIBA Bulletin Board (HKLM-x32\...\InstallShield_{C14518AF-1A0F-4D39-8011-69BAA01CD380}) (Version: 1.6.07.64 - TOSHIBA Corporation)
TOSHIBA Bulletin Board (Version: 1.6.07.64 - TOSHIBA Corporation) Hidden
TOSHIBA ConfigFree (HKLM-x32\...\{607BE7BF-7C28-4ADB-A4A0-385962B901C3}) (Version: 8.0.28 - TOSHIBA Corporation)
TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.2 for x64 - TOSHIBA Corporation)
TOSHIBA eco Utility (HKLM-x32\...\InstallShield_{B3FF1CD9-B2F0-4D71-BB55-5F580401C48E}) (Version: 1.2.11.64 - TOSHIBA Corporation)
TOSHIBA eco Utility (Version: 1.2.11.64 - TOSHIBA Corporation) Hidden
TOSHIBA eco Utility (x32 Version: 1.2.11.64 - TOSHIBA Corporation) Hidden
TOSHIBA Face Recognition (HKLM-x32\...\InstallShield_{F67FA545-D8E5-4209-86B1-AEE045D1003F}) (Version: 3.1.3.64 - TOSHIBA Corporation)
TOSHIBA Face Recognition (Version: 3.1.3.64 - TOSHIBA Corporation) Hidden
TOSHIBA Flash Cards Support Utility (HKLM-x32\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.0.6C - TOSHIBA CORPORATION)
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.6C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM-x32\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.22C - Ihr Firmenname)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.22C - Ihr Firmenname) Hidden
TOSHIBA HDD/SSD Alert (HKLM-x32\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.6 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.6 - TOSHIBA Corporation) Hidden
Toshiba Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.01 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{983CD6FE-8320-4B80-A8F6-0D0366E0AA22}) (Version: 1.0.80.3.64 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.5.10 - TOSHIBA CORPORATION)
TOSHIBA Online Product Information (HKLM-x32\...\{2290A680-4083-410A-ADCC-7092C67FC052}) (Version: 2.09.0001 - TOSHIBA)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.6.0.64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.4 x64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA ReelTime (HKLM-x32\...\InstallShield_{A0E99122-25C1-4CA4-9063-499A2A814EB6}) (Version: 1.6.06.64 - TOSHIBA Corporation)
TOSHIBA ReelTime (Version: 1.6.06.64 - TOSHIBA Corporation) Hidden
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.40 - TOSHIBA)
TOSHIBA Supervisor Password (x32 Version: 1.63.0.9C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM-x32\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.0.9C - TOSHIBA CORPORATION)
Toshiba TEMPRO (HKLM-x32\...\{2B000B80-A3FA-4B92-A5FF-D9AD402B6701}) (Version: 3.30 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.3.3.64 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.3.3.64 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.3.3.64 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM-x32\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.15 - TOSHIBA Corporation)
TRORMCLauncher (HKLM-x32\...\InstallShield_{E65C7D8E-186D-484B-BEA8-DEF0331CE600}) (Version: - )
TRORMCLauncher (Version: 1.0.0.9 - TOSHIBA) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Utility Common Driver (x32 Version: 1.0.52.1C - TOSHIBA) Hidden
VideoPerformer (HKLM-x32\...\VideoPerformer) (Version: - PerformerSoft LLC) <==== ATTENTION
Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)
Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)
WildTangent ORB Game Console (x32 Version: - WildTangent) Hidden
WildTangent-Spiele (HKLM-x32\...\WildTangent toshiba Master Uninstall) (Version: 1.0.0.80 - WildTangent)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8091.0730 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.01 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
WinRAR 4.01 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH)
WinZip 18.0 (HKLM\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240DF}) (Version: 18.0.10661 - WinZip Computing, S.L. )
WinZip Malware Protector (HKLM-x32\...\WinZip Malware Protector_is1) (Version: 2.1.1000.10740 - WinZip International LLC)
Xvid Video Codec (HKLM-x32\...\Xvid Video Codec 1.3.2) (Version: 1.3.2 - Xvid Team)
Zuma Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden

==================== Restore Points =========================

21-03-2014 08:39:43 Windows Update

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {041CC34E-C577-48D5-B863-7D2D67C12B09} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-22] (Adobe Systems Incorporated)
Task: {04ACAC02-E4D3-4810-9575-265F6A4A2235} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv => C:\Windows\TEMP\{891DD241-AEFF-41E2-ACD5-696938895232}.exe
Task: {393EC390-6C0C-4FE7-AF99-EE527EDE0FA4} - System32\Tasks\wolli NBAgent => C:\Program Files (x86)\Nero\Nero BackItUp &amp; Burn\Nero BackItUp\NBAgent.exe
Task: {3A4FF059-12CC-4B0D-B4E1-4B5063D4239C} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2010-02-22] (TOSHIBA CORPORATION)
Task: {4834D868-B261-4106-BF82-D450FF92CED0} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-24] (Google Inc.)
Task: {6B09C006-3383-4859-A801-52F2CE265DFC} - System32\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv => C:\Windows\TEMP\{E3BB883E-F82F-4239-B2BD-55EC627A18C7}.exe
Task: {7A56F18F-500B-4B68-AFD2-3262C555F296} - System32\Tasks\{E8AFA139-C9C4-4D6C-BBD5-738D909C12EE} => Firefox.exe
Task: {AEA570EE-96C0-4733-8FCD-19C16BF718A7} - System32\Tasks\WinZip Malware Protector_startup => C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe [2013-03-26] (Nico Mak Computing)
Task: {B0F8AF98-9AA8-45C1-AF2F-D6348E6E7730} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-24] (Google Inc.)
Task: {D01B3E83-68C9-4ED0-81A9-6FDD7B220D2B} - System32\Tasks\wolli Local Autobackup => C:\Program Files (x86)\Nero\Nero BackItUp &amp; Burn\Nero BackItUp\NBCore.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job => C:\Windows\TEMP\{891DD241-AEFF-41E2-ACD5-696938895232}.exe
Task: C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job => C:\Windows\TEMP\{E3BB883E-F82F-4239-B2BD-55EC627A18C7}.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-04-06 13:53 - 2010-04-06 13:53 - 00578936 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2014-03-21 08:44 - 2014-03-21 08:44 - 00159768 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\loggingserver.exe
2011-09-24 10:12 - 2011-05-28 21:05 - 00164864 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2010-03-19 13:28 - 2010-03-19 13:28 - 03409256 _____ () C:\Program Files\TOSHIBA\BulletinBoard\TosNcUi.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 08762680 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2009-11-03 12:26 - 2009-11-03 12:26 - 00053560 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-03 13:15 - 2010-03-03 13:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2010-04-19 10:01 - 2009-06-22 13:40 - 00022328 _____ () C:\Program Files\TOSHIBA\Toshiba Assist\NotifyX.dll
2009-03-12 18:08 - 2009-03-12 18:08 - 00048640 _____ () C:\Program Files (x86)\Toshiba\PCDiag\NotifyPCD.dll
2009-07-25 15:38 - 2009-07-25 15:38 - 00017800 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll
2011-12-13 16:35 - 2014-03-21 08:44 - 02544664 _____ () C:\Program Files (x86)\AVG Secure Search\vprot.exe
2009-10-13 09:00 - 2009-10-13 09:00 - 00016384 ____R () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2010-06-04 01:10 - 2010-06-04 01:10 - 00270336 _____ () C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2010-02-05 16:44 - 2010-02-05 16:44 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2012-04-28 17:32 - 2012-04-28 17:32 - 01516024 _____ () C:\ProgramData\bProtectorForWindows\2.1.415.37\protector.dll
2014-03-21 08:44 - 2014-03-21 08:44 - 00519704 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\log4cplusU.dll
2014-03-08 20:30 - 2013-02-28 16:53 - 00886272 _____ () C:\Program Files (x86)\WinZip Malware Protector\System.Data.SQLite.dll
2014-03-08 20:30 - 2013-03-26 12:16 - 01718648 _____ () C:\Program Files (x86)\WinZip Malware Protector\aspsys.dll
2014-03-08 20:28 - 2013-02-28 16:53 - 00168448 _____ () C:\Program Files (x86)\WinZip Malware Protector\UNRAR.DLL
2013-10-19 00:55 - 2013-10-19 00:55 - 25100288 _____ () C:\Users\wolli\AppData\Roaming\Dropbox\bin\libcef.dll
2010-05-04 14:36 - 2010-05-04 14:36 - 00970752 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2013-12-22 17:40 - 2014-02-10 19:16 - 03019376 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2013-12-22 17:40 - 2014-02-10 19:16 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2013-12-22 17:40 - 2014-02-10 19:16 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2010-11-19 21:40 - 2014-02-16 17:15 - 03614320 _____ () C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1\mozjs.dll
2014-03-21 08:44 - 2014-03-21 08:44 - 00688664 _____ () C:\Program Files (x86)\Common Files\AVG Secure Search\NativeBrowserApi\18.0.5\NativeBrowserApi.dll
2014-02-24 22:15 - 2014-02-24 22:15 - 16265096 ____N () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\wolli\Documents\rundbrief 2005.eml:OECustomProperty
AlternateDataStreams: C:\Users\wolli\Documents\Rundbrief 2006.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (03/22/2014 08:07:23 PM) (Source: BackItUp5) (User: )
Description: Backup process failed.

Error: (03/22/2014 08:07:23 PM) (Source: BackItUp5) (User: )
Description: Job execution failed because the selected target for job does not exist.

Error: (03/21/2014 09:10:48 AM) (Source: BackItUp5) (User: )
Description: Backup process failed.

Error: (03/21/2014 09:10:48 AM) (Source: BackItUp5) (User: )
Description: Job execution failed because the selected target for job does not exist.

Error: (03/08/2014 08:30:04 PM) (Source: Microsoft-Windows-RestartManager) (User: karabiner)
Description: Die Anwendung oder der Dienst "WinZip Malware Protector" konnte nicht heruntergefahren werden.

Error: (03/08/2014 07:46:37 PM) (Source: BackItUp5) (User: )
Description: Backup process failed.

Error: (03/08/2014 07:46:37 PM) (Source: BackItUp5) (User: )
Description: Your specified backup can't be continued due to insufficient space on target. Please select another target location.

Error: (03/08/2014 07:46:37 PM) (Source: BackItUp5) (User: )
Description: Unable to open last backup information file

Error: (03/08/2014 05:45:13 PM) (Source: BackItUp5) (User: )
Description: Backup process failed.

Error: (03/08/2014 05:45:13 PM) (Source: BackItUp5) (User: )
Description: Your specified backup can't be continued due to insufficient space on target. Please select another target location.


System errors:
=============
Error: (03/22/2014 08:01:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Update" wurde nicht richtig gestartet.

Error: (03/21/2014 08:57:07 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎21.‎03.‎2014 um 08:45:50 unerwartet heruntergefahren.

Error: (03/21/2014 08:45:58 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet:
%%127

Error: (03/21/2014 08:44:17 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet:
%%127

Error: (03/21/2014 08:44:17 AM) (Source: DCOM) (User: )
Description: {8BC3F05E-D86B-11D0-A075-00C04FB68820}

Error: (03/21/2014 08:43:47 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet:
%%127

Error: (03/21/2014 08:43:25 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IP-Hilfsdienst" ist vom Dienst "Windows-Verwaltungsinstrumentation" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%127

Error: (03/21/2014 08:43:25 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "LogMeIn Hamachi Tunneling Engine" ist vom Dienst "Windows-Verwaltungsinstrumentation" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%127

Error: (03/21/2014 08:43:25 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Verwaltungsinstrumentation" wurde mit folgendem Fehler beendet:
%%127

Error: (03/21/2014 08:43:03 AM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am ‎18.‎03.‎2014 um 09:39:45 unerwartet heruntergefahren.


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Percentage of memory in use: 61%
Total physical RAM: 3954.67 MB
Available physical RAM: 1504.43 MB
Total Pagefile: 7907.52 MB
Available Pagefile: 4624.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:232.88 GB) (Free:12.77 GB) NTFS
Drive d: (Data) (Fixed) (Total:232.49 GB) (Free:220.74 GB) NTFS
Drive f: (Intenso) (Removable) (Total:3.89 GB) (Free:3.33 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: D9ADAD65)

Partition: GPT Partition Type.

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

==================== End Of Log ============================

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-03-2014 01
Ran by wolli (administrator) on KARABINER on 22-03-2014 21:13:01
Running from F:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgcsrva.exe
(AMD) C:\Windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
(bProtector) C:\ProgramData\bProtectorForWindows\2.1.415.37\bProtect.exe
(Microsoft Corporation) C:\Windows\SysWOW64\schtasks.exe
(LogMeIn, Inc.) C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe
(bProtector) C:\ProgramData\bProtectorForWindows\2.1.415.37\bProtect.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe
(Nero AG) c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgemca.exe
(AVG Secure Search) C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
() C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\loggingserver.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
(Nico Mak Computing) C:\Program Files (x86)\WinZip Malware Protector\WinZipMalwareProtector.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe
(Dropbox, Inc.) C:\Users\wolli\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Nero AG) C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
() C:\Program Files (x86)\AVG Secure Search\vprot.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Visicom Media Inc. (Powered by Panda Security)) C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(LogMeIn Inc.) C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1\firefox.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee\SiteAdvisor\saUI.exe
(Microsoft Corporation) C:\Windows\system32\prevhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_70.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [595816 2010-03-19] (TOSHIBA Corporation)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2052392 2010-03-10] (Synaptics Incorporated)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1050072 2010-02-11] (Toshiba Europe GmbH)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [896032 2010-03-22] (Realtek Semiconductor)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [505696 2009-11-05] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [913720 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1489760 2010-04-06] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [705368 2010-02-23] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [35672 2010-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba Registration] - C:\Program Files\Toshiba\Registration\ToshibaReminder.exe [136136 2010-04-19] (Toshiba Europe GmbH)
HKLM-x32\...\Run: [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [352256 2010-02-22] (TOSHIBA)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [NBAgent] - c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe [1086760 2010-03-09] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-15] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2009-12-25] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2454840 2010-02-24] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [AVG_TRAY] - C:\Program Files (x86)\AVG\AVG2012\avgtray.exe [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [vProt] - C:\Program Files (x86)\AVG Secure Search\vprot.exe [2544664 2014-03-21] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Anti-phishing Domain Advisor] - C:\ProgramData\Anti-phishing Domain Advisor\visicom_antiphishing.exe [232616 2012-03-01] (Visicom Media Inc. (Powered by Panda Security))
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-02-26] (LogMeIn Inc.)
HKU\.DEFAULT\...\Run: [TOSHIBA Online Product Information] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [4581280 2010-03-03] (TOSHIBA)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [301568 2013-03-19] (Microsoft Corporation)
HKU\S-1-5-21-2461716167-2869026119-3337913761-1000\...\Run: [msnmsgr] - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe [3883840 2009-07-26] (Microsoft Corporation)
HKU\S-1-5-21-2461716167-2869026119-3337913761-1000\...\MountPoints2: {95a5cd07-aa0d-11df-96f1-88ae1d42a953} - F:\LaunchU3.exe -a
HKU\S-1-5-21-2461716167-2869026119-3337913761-1003\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-07-24] (Google Inc.)
HKU\S-1-5-21-2461716167-2869026119-3337913761-1003\...\Run: [Xvid] - C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
HKU\S-1-5-21-2461716167-2869026119-3337913761-1003\...\Run: [Spotify] - C:\Users\Guest\AppData\Roaming\Spotify\Spotify.exe [7601880 2012-08-30] (Spotify Ltd)
HKU\S-1-5-21-2461716167-2869026119-3337913761-1003\...\Run: [Spotify Web Helper] - C:\Users\Guest\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-30] ()
HKU\S-1-5-21-2461716167-2869026119-3337913761-1003\...\Run: [TBHostSupport] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Guest\AppData\Local\TBHostSupport\TBHostSupport_0.dll",DLLRunTBHostSupportPlugin <===== ATTENTION
HKU\S-1-5-21-2461716167-2869026119-3337913761-1003\...\Run: [APISupport] - "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\Guest\AppData\Local\Conduit\APISupport\APISupport.dll",DLLRunAPISupport <===== ATTENTION
AppInit_DLLs-x32: c:\progra~3\bprote~1\21415~1.37\protec~1.dll => C:\ProgramData\bProtectorForWindows\2.1.415.37\protector.dll [1516024 2012-04-28] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Gast\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\wolli\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2849855
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://toshiba.de.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x8207BB4A506ACD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
URLSearchHook: HKCU - (No Name) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - No File
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
URLSearchHook: HKCU - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=772f49cb-ba26-4f17-8074-46e5cdd0ff62&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.helperbar.com/?publisher=OPENCANDY&dpid=OPENCANDYAPRIL&co=DE&userid=772f49cb-ba26-4f17-8074-46e5cdd0ff62&affid=110774&searchtype=ds&babsrc=lnkry&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={DB02BB88-3033-432E-A193-E8D360910549}&mid=165622d86a7a79c4b4043203d6d0f9e9-ffea93d67d3fa26f3d642a0191ef59df33027e0d&lang=de&ds=AVG&pr=fr&d=2011-12-13 16:34:57&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - bProtectorDefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL =
SearchScopes: HKCU - {4DF9A5E0-6E78-4081-BCBD-7C6BC96200C8} URL =
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={DB02BB88-3033-432E-A193-E8D360910549}&mid=165622d86a7a79c4b4043203d6d0f9e9-ffea93d67d3fa26f3d642a0191ef59df33027e0d&lang=de&ds=AVG&pr=fr&d=2011-12-13 16:34:57&v=15.3.0.11&pid=avg&sg=0&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {DA99E98C-0C63-4DA1-BDF8-64D9D0C72557} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
SearchScopes: HKCU - {EA605A1A-7056-46D7-81CF-852256FDC396} URL = hxxp://de.search.yahoo.com/search?fr=mcafee&p={SearchTerms}
SearchScopes: HKCU - {EDEA845B-D67B-4754-8FE9-91D273815CFD} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files (x86)\AVG\AVG2012\avgdtiea.dll (AVG Technologies CZ, s.r.o.)
BHO: Linkury SmartbarEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Vid-Saver - {11111111-1111-1111-1111-110011341191} - C:\Program Files (x86)\Vid-Saver\Vid-Saver.dll (215 Apps)
BHO-x32: Shopping Assistant Plugin - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.6.4\PriceGongIE.dll (PriceGong)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Linkury SmartbarEngine - {31ad400d-1b06-4e33-a59a-90c2c140cba0} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.0.5.292\AVG Secure Search_toolbar.dll (AVG Secure Search)
BHO-x32: blekko search bar - {a0442ee1-d2e7-44c0-b4a5-8c4e6b035787} - C:\Program Files (x86)\blekkotb_020\blekkotb_019X.dll ()
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM - Linkury Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKLM-x32 - AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\18.0.5.292\AVG Secure Search_toolbar.dll (AVG Secure Search)
Toolbar: HKLM-x32 - blekko search bar - {a0442ee1-d2e7-44c0-b4a5-8c4e6b035787} - C:\Program Files (x86)\blekkotb_020\blekkotb_019X.dll ()
Toolbar: HKLM-x32 - Linkury Smartbar - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} -  No File
Toolbar: HKCU - No Name - {64EAD72B-FFD4-4E01-AA3A-4C71665D73E4} -  No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll (McAfee, Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll (McAfee, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Handler-x32: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\18.0.5\ViProtocol.dll (AVG Secure Search)

FireFox:
========
FF ProfilePath: C:\Users\wolli\AppData\Roaming\Mozilla\Firefox\Profiles\s39zg9oj.default
FF DefaultSearchEngine: AVG Secure Search
FF SearchEngineOrder.1: Blekko
FF SelectedSearchEngine: AVG Secure Search
FF Homepage: hxxp://blekko.com/ws/?source=017d87aa&toolbarid=blekkotb_020&u=2012042899F949DA80F159E785C68134&tbp=homepage
FF Keyword.URL: hxxp://blekko.com/ws/?source={SourceID}&tbp=url&toolbarid=blekkotb_020&u=USERGUID&q=
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\18.0.5\\npsitesafety.dll (AVG Technologies)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Vid-Saver - C:\Users\wolli\AppData\Roaming\Mozilla\Firefox\Profiles\s39zg9oj.default\Extensions\crossriderapp3491@crossrider.com [2014-03-07]
FF Extension: blekko search bar - C:\Users\wolli\AppData\Roaming\Mozilla\Firefox\Profiles\s39zg9oj.default\Extensions\{a0442ee1-d2e7-44c0-b4a5-8c4e6b035787} [2012-04-28]
FF Extension: Test Pilot - C:\Users\wolli\AppData\Roaming\Mozilla\Firefox\Profiles\s39zg9oj.default\Extensions\testpilot@labs.mozilla.com.xpi [2011-02-04]
FF HKLM-x32\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] - C:\Program Files (x86)\AVG\AVG2012\Firefox4\
FF Extension: AVG Safe Search - C:\Program Files (x86)\AVG\AVG2012\Firefox4\ []
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] - C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor [2010-04-19]
FF HKLM-x32\...\Firefox\Extensions: [avg@toolbar] - C:\ProgramData\AVG Secure Search\FireFoxExt\18.0.5.292
FF Extension: AVG Security Toolbar - C:\ProgramData\AVG Secure Search\FireFoxExt\18.0.5.292 [2014-03-21]
FF StartMenuInternet: FIREFOX.EXE - C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1\firefox.exe

Chrome:
=======
CHR HomePage: hxxp://isearch.avg.com/?cid={DB02BB88-3033-432E-A193-E8D360910549}&mid=165622d86a7a79c4b4043203d6d0f9e9-ffea93d67d3fa26f3d642a0191ef59df33027e0d&lang=de&ds=AVG&pr=fr&d=2011-12-13 16:34:57&v=18.0.5.292&pid=avg&sg=0&sap=hp
CHR DefaultSearchKeyword: mcafee
CHR DefaultSearchURL: hxxp://de.search.yahoo.com/search?fr=mcafee&p={searchTerms}
CHR DefaultNewTabURL:
CHR Extension: (PriceGong) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok [2012-07-10]
CHR Extension: (YouTube) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-02-09]
CHR Extension: (Google Search) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-02-09]
CHR Extension: (SiteAdvisor) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho [2012-02-09]
CHR Extension: (AVG Safe Search) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla [2012-02-09]
CHR Extension: (AVG Do Not Track) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof [2012-07-10]
CHR Extension: (Google Wallet) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-07]
CHR Extension: (Gmail) - C:\Users\wolli\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-02-09]
CHR HKLM-x32\...\Chrome\Extension: [bkomkajifikmkfnjgphkjcfeepbnojok] - C:\Program Files (x86)\PriceGong\2.6.4\pricegong.crx [2012-03-25]
CHR HKLM-x32\...\Chrome\Extension: [hempmfkijmahkaddljkmchcmjbojoedl] - C:\Users\Guest\AppData\Local\CRE\hempmfkijmahkaddljkmchcmjbojoedl.crx [2012-05-31]
CHR HKLM-x32\...\Chrome\Extension: [jmfkcklnlgedgbglfkkgedjfmejoahla] - C:\Program Files (x86)\AVG\AVG2012\Chrome\safesearch.crx [2012-07-26]
CHR HKLM-x32\...\Chrome\Extension: [ndibdjnfmopecpmkdieinmbadjfpblof] - C:\ProgramData\AVG Secure Search\ChromeExt\18.0.5.292\avg.crx [2014-03-21]
CHR HKLM-x32\...\Chrome\Extension: [pgmfkblbflahhponhjmkcnpjinenhlnc] - C:\Users\Guest\AppData\Local\Vid-Saver\Chrome\Vid-Saver.crx [2012-05-09]

==================== Services (Whitelisted) =================

S3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] ()
R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2012\avgidsagent.exe [5175856 2013-10-16] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.)
R2 bProtector; C:\ProgramData\bProtectorForWindows\2.1.415.37\bProtect.exe [1181176 2012-04-28] (bProtector)
R2 LMIGuardianSvc; C:\Program Files (x86)\LogMeIn Hamachi\LMIGuardianSvc.exe [377616 2014-02-26] (LogMeIn, Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files (x86)\McAfee\SiteAdvisor\mcsacore.exe [123384 2014-01-22] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-16] (McAfee, Inc.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [124368 2010-02-11] (Toshiba Europe GmbH)
R2 vToolbarUpdater18.0.5; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.0.5\ToolbarUpdater.exe [1771032 2014-03-21] (AVG Secure Search)

==================== Drivers (Whitelisted) ====================

R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [127328 2012-12-10] (AVG Technologies CZ, s.r.o. )
R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfiltera.sys [29776 2011-12-23] (AVG Technologies CZ, s.r.o. )
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [28480 2012-04-19] (AVG Technologies CZ, s.r.o. )
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [307040 2012-11-08] (AVG Technologies CZ, s.r.o.)
R1 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [47696 2011-12-23] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [36944 2012-01-31] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [384800 2013-04-11] (AVG Technologies CZ, s.r.o.)
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [49952 2014-03-21] (AVG Technologies)
S3 DSDrv4AMD64; C:\Program Files (x86)\DScaler\DSDrv4amd64.sys [22488 2009-08-28] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 U6000ALL; C:\Windows\System32\DRIVERS\U6000ALL.sys [276480 2007-07-14] ()
S3 X6va005; \??\C:\Users\Guest\AppData\Local\Temp\00542.tmp [X]
S3 X6va006; \??\C:\Users\Guest\AppData\Local\Temp\006B97E.tmp [X]
S3 X6va007; \??\C:\Users\Guest\AppData\Local\Temp\0075878.tmp [X]
S3 X6va012; \??\C:\Windows\SysWOW64\Drivers\X6va012 [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-22 20:01 - 2014-03-22 20:01 - 00000603 _____ () C:\Users\wolli\Desktop\FRST64 - Verknüpfung.lnk
2014-03-22 20:01 - 2014-03-22 20:01 - 00000595 _____ () C:\Users\wolli\Desktop\FRST - Verknüpfung.lnk
2014-03-21 09:29 - 2014-02-07 02:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-21 09:29 - 2014-01-29 03:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-21 09:29 - 2014-01-29 03:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll
2014-03-21 09:27 - 2014-02-04 03:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-21 09:27 - 2014-02-04 03:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-03-21 08:44 - 2014-03-21 08:44 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-03-11 19:58 - 2014-03-22 21:13 - 00000000 ____D () C:\FRST
2014-03-08 20:51 - 2014-03-08 20:51 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\Nico Mak Computing
2014-03-08 20:37 - 2014-03-22 19:59 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-03-08 20:30 - 2014-03-08 20:30 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Nico Mak Computing
2014-03-08 20:28 - 2014-03-08 20:32 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-03-08 20:28 - 2014-03-08 20:30 - 00001200 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-03-08 20:28 - 2014-03-08 20:29 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-03-08 20:28 - 2013-03-15 17:10 - 00020480 _____ () C:\Windows\system32\wsusnative64.exe
2014-03-08 20:27 - 2014-03-08 20:27 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1 (1).exe
2014-03-08 20:26 - 2014-03-08 20:26 - 00667272 _____ ( ) C:\Users\Guest\Downloads\ZipSetup.exe
2014-03-08 20:20 - 2014-03-08 20:20 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1.exe
2014-03-08 19:28 - 2014-03-08 19:28 - 00002272 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-03-08 19:28 - 2014-03-08 19:28 - 00000000 ____D () C:\Users\Guest\AppData\Local\WinZip
2014-03-08 19:27 - 2014-03-08 19:28 - 00000000 ____D () C:\ProgramData\WinZip
2014-03-08 19:27 - 2014-03-08 19:28 - 00000000 ____D () C:\Program Files\WinZip
2014-03-08 19:26 - 2014-03-08 19:26 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180 (1).exe
2014-03-08 19:25 - 2014-03-08 19:25 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180.exe
2014-03-08 16:03 - 2014-03-08 16:03 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-08 16:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (4).exe
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (3).exe
2014-03-08 16:00 - 2014-03-08 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (2).exe
2014-03-08 15:59 - 2014-03-08 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (1).exe
2014-03-08 15:59 - 2014-03-08 15:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-06 22:12 - 2014-03-06 22:17 - 00000000 ____D () C:\Users\wolli\Documents\Kanada 2014
2014-03-01 13:31 - 2014-03-01 13:31 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\4.0
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\.tfo4
2014-02-24 15:41 - 2014-02-24 15:41 - 00018778 _____ () C:\Users\Guest\Documents\graf.odt

==================== One Month Modified Files and Folders =======

2014-03-22 21:13 - 2014-03-11 19:58 - 00000000 ____D () C:\FRST
2014-03-22 21:11 - 2013-12-07 22:44 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-22 21:11 - 2013-12-07 22:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-22 21:11 - 2013-12-07 22:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-22 21:11 - 2011-12-23 21:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-22 21:11 - 2010-06-04 01:06 - 01076169 _____ () C:\Windows\WindowsUpdate.log
2014-03-22 21:10 - 2010-07-24 08:05 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-22 20:20 - 2009-07-14 05:45 - 00016304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-22 20:20 - 2009-07-14 05:45 - 00016304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-22 20:05 - 2013-12-26 07:22 - 00003516 _____ () C:\Windows\System32\Tasks\wolli NBAgent
2014-03-22 20:01 - 2014-03-22 20:01 - 00000603 _____ () C:\Users\wolli\Desktop\FRST64 - Verknüpfung.lnk
2014-03-22 20:01 - 2014-03-22 20:01 - 00000595 _____ () C:\Users\wolli\Desktop\FRST - Verknüpfung.lnk
2014-03-22 19:59 - 2014-03-08 20:37 - 00003116 _____ () C:\Windows\System32\Tasks\WinZip Malware Protector_startup
2014-03-22 19:59 - 2011-05-07 11:36 - 00000000 ____D () C:\Windows\system32\Drivers\AVG
2014-03-22 19:58 - 2012-04-05 10:21 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\Dropbox
2014-03-22 19:57 - 2012-04-05 10:23 - 00000000 ___RD () C:\Users\wolli\Dropbox
2014-03-22 19:57 - 2011-09-22 20:55 - 00000000 ____D () C:\Users\wolli\Tracing
2014-03-22 19:57 - 2011-09-19 15:36 - 00000000 ____D () C:\Users\wolli\AppData\Local\LogMeIn Hamachi
2014-03-22 19:56 - 2013-06-08 09:30 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_HP_rmv.job
2014-03-22 19:56 - 2013-06-03 21:03 - 00000350 _____ () C:\Windows\Tasks\AVG-Secure-Search-Update_JUNE2013_TB_rmv.job
2014-03-22 19:56 - 2010-07-24 08:05 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-22 19:55 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-22 19:55 - 2009-07-14 05:51 - 00137829 _____ () C:\Windows\setupact.log
2014-03-22 19:55 - 2009-07-14 05:45 - 00361288 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-22 19:53 - 2013-03-15 13:24 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-22 19:53 - 2013-03-15 13:24 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-03-21 08:54 - 2011-09-09 09:51 - 00000000 ___RD () C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-21 08:54 - 2010-07-22 13:59 - 00000000 ___RD () C:\Users\wolli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-21 08:44 - 2014-03-21 08:44 - 00000000 ____D () C:\ProgramData\AVG Secure Search
2014-03-21 08:44 - 2013-05-12 10:59 - 00003728 _____ () C:\Program Files (x86)\Mozilla Firefox 4.0 Beta 1avg-secure-search.xml
2014-03-21 08:44 - 2012-09-04 14:17 - 00049952 _____ (AVG Technologies) C:\Windows\system32\Drivers\avgtpx64.sys
2014-03-21 08:44 - 2011-12-13 16:35 - 00000000 ____D () C:\Program Files (x86)\AVG Secure Search
2014-03-09 21:34 - 2011-09-18 17:22 - 00000000 ____D () C:\Users\Guest\AppData\Local\LogMeIn Hamachi
2014-03-08 20:51 - 2014-03-08 20:51 - 00000000 ____D () C:\Users\wolli\AppData\Roaming\Nico Mak Computing
2014-03-08 20:34 - 2011-09-09 09:51 - 00000000 ____D () C:\Users\Guest\AppData\Local\VirtualStore
2014-03-08 20:32 - 2014-03-08 20:28 - 00000000 ____D () C:\Program Files (x86)\WinZip Malware Protector
2014-03-08 20:32 - 2010-06-04 01:03 - 00070148 _____ () C:\Windows\PFRO.log
2014-03-08 20:30 - 2014-03-08 20:30 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Nico Mak Computing
2014-03-08 20:30 - 2014-03-08 20:28 - 00001200 _____ () C:\Users\Public\Desktop\WinZip Malware Protector.lnk
2014-03-08 20:29 - 2014-03-08 20:28 - 00000000 ____D () C:\ProgramData\Nico Mak Computing
2014-03-08 20:27 - 2014-03-08 20:27 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1 (1).exe
2014-03-08 20:26 - 2014-03-08 20:26 - 00667272 _____ ( ) C:\Users\Guest\Downloads\ZipSetup.exe
2014-03-08 20:20 - 2014-03-08 20:20 - 04894544 _____ (WinZip International LLC ) C:\Users\Guest\Downloads\wzmalwareprotector_1.exe
2014-03-08 19:32 - 2012-03-18 07:31 - 00000000 ____D () C:\ProgramData\Norton
2014-03-08 19:28 - 2014-03-08 19:28 - 00002272 _____ () C:\Users\Public\Desktop\WinZip.lnk
2014-03-08 19:28 - 2014-03-08 19:28 - 00000000 ____D () C:\Users\Guest\AppData\Local\WinZip
2014-03-08 19:28 - 2014-03-08 19:27 - 00000000 ____D () C:\ProgramData\WinZip
2014-03-08 19:28 - 2014-03-08 19:27 - 00000000 ____D () C:\Program Files\WinZip
2014-03-08 19:26 - 2014-03-08 19:26 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180 (1).exe
2014-03-08 19:25 - 2014-03-08 19:25 - 00420808 _____ (WinZip Computing) C:\Users\Guest\Downloads\WinZip180.exe
2014-03-08 19:22 - 2012-06-23 19:35 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Spotify
2014-03-08 19:12 - 2012-06-24 14:12 - 00000000 ____D () C:\Program Files (x86)\Vid-Saver
2014-03-08 16:03 - 2014-03-08 16:03 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00001120 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-08 16:02 - 2014-03-08 16:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (4).exe
2014-03-08 16:01 - 2014-03-08 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (3).exe
2014-03-08 16:00 - 2014-03-08 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (2).exe
2014-03-08 16:00 - 2014-03-08 15:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300 (1).exe
2014-03-08 15:59 - 2014-03-08 15:59 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Guest\Downloads\mbam-setup-1.75.0.1300.exe
2014-03-08 15:49 - 2013-11-26 21:14 - 00000000 ____D () C:\Users\Guest\AppData\Roaming\BitTorrent
2014-03-08 11:18 - 2010-07-24 09:18 - 07686656 ___SH () C:\Users\wolli\Documents\Thumbs.db
2014-03-08 11:16 - 2012-06-01 13:39 - 00012893 _____ () C:\Users\wolli\Documents\Meine 3000er.odt
2014-03-07 11:00 - 2012-02-09 21:17 - 00002182 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-06 22:17 - 2014-03-06 22:12 - 00000000 ____D () C:\Users\wolli\Documents\Kanada 2014
2014-03-06 19:20 - 2009-07-14 18:58 - 00643866 _____ () C:\Windows\system32\perfh007.dat
2014-03-06 19:20 - 2009-07-14 18:58 - 00126394 _____ () C:\Windows\system32\perfc007.dat
2014-03-06 19:20 - 2009-07-14 06:13 - 01472002 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-01 13:31 - 2014-03-01 13:31 - 00000000 ____D () C:\Program Files (x86)\LogMeIn Hamachi
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\4.0
2014-02-27 09:03 - 2014-02-27 09:03 - 00000000 ____D () C:\Users\Guest\.tfo4
2014-02-27 09:03 - 2011-09-09 09:51 - 00000000 ____D () C:\Users\Guest
2014-02-24 15:41 - 2014-02-24 15:41 - 00018778 _____ () C:\Users\Guest\Documents\graf.odt

Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\i4jdel0.exe
C:\Users\Gast\AppData\Local\Temp\i4jdel1.exe
C:\Users\Guest\AppData\Local\Temp\contentDATs.exe
C:\Users\Guest\AppData\Local\Temp\dsHostCheckerSetup.exe
C:\Users\Guest\AppData\Local\Temp\FileSystemView.dll
C:\Users\Guest\AppData\Local\Temp\gftsmaie.dll
C:\Users\Guest\AppData\Local\Temp\i4jdel0.exe
C:\Users\Guest\AppData\Local\Temp\i4jdel1.exe
C:\Users\Guest\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Guest\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Guest\AppData\Local\Temp\swt-win32-3740.dll
C:\Users\Guest\AppData\Local\Temp\tbBit2.dll
C:\Users\Guest\AppData\Local\Temp\uttD0EF.tmp.exe
C:\Users\Guest\AppData\Local\Temp\vcredist_x86.exe
C:\Users\wolli\AppData\Local\Temp\04hycyxh.dll
C:\Users\wolli\AppData\Local\Temp\avguidx.dll
C:\Users\wolli\AppData\Local\Temp\contentDATs.exe
C:\Users\wolli\AppData\Local\Temp\dsHostCheckerSetup.exe
C:\Users\wolli\AppData\Local\Temp\FileSystemView.dll
C:\Users\wolli\AppData\Local\Temp\iGearedHelper.dll
C:\Users\wolli\AppData\Local\Temp\iv_uninstall.exe
C:\Users\wolli\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\wolli\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\wolli\AppData\Local\Temp\MachineIdCreator.exe
C:\Users\wolli\AppData\Local\Temp\oi_{12B729D8-26AC-42DA-997D-17A4F09BAD47}.exe
C:\Users\wolli\AppData\Local\Temp\quzjw5hy.dll
C:\Users\wolli\AppData\Local\Temp\SecurityScan_Release.exe
C:\Users\wolli\AppData\Local\Temp\ToolbarInstaller.exe
C:\Users\wolli\AppData\Local\Temp\~+JF1594943289653576939.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-01-15 19:30

==================== End Of Log ============================
--- --- ---

--- --- ---

Bootsektor 22.03.2014 23:37
Hallo wolli58,

Schritt 1
Bitte deinstalliere folgende Programme:

AudioConverter
blekko search bar
bProtector for Windows
Drv
Java(TM) 6 Update 31
McAfee Security Scan Plus
PriceGong 2.6.4
VideoPerformer

Dazu gehe auf
Start --> Systemsteuerung -- > Programme --> Programme deinstallieren --> suche das Programm in der Liste --> entfernen

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
http://imageshack.us/a/img841/7292/thisisujrt.gif Bitte lade Junkware Removal Tool auf Deinen Desktop.
  • Starte das Tool mit Doppelklick. Vista und 7 Nutzer bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Das Tool wird sich öffnen und mit dem Scan beginnen.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

Schritt 4
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop (oder in dem Verzeichnis in dem FRST liegt) gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

wolli58 24.03.2014 10:03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 7 Home Premium x64
Ran by wolli on 24.03.2014 at 9:43:50,84
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\New Windows\Allow\\*.crossrider.com
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{a0442ee1-d2e7-44c0-b4a5-8c4e6b035787}
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113}
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-2461716167-2869026119-3337913761-1000\Software\Microsoft\Internet Explorer\Main\\Start Page



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.bandobjectattribute
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.bho
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.dockingpanel
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbar
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbarbandobject
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbarmenuform
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\vid-saver_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\vid-saver_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\anti-phishing domain advisor
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{b01aac47-d5d7-4a9a-afc0-1c2c23ae8991}
Successfully deleted: [Registry Key] HKEY_USERS\.DEFAULT\Software\bProtector
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0003491.BHO
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0003491.BHO.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0003491.FBApi
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0003491.FBApi.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0003491.Sandbox
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0003491.Sandbox.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220022342291}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{33333333-3333-3333-3333-330033343391}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550055345591}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660066346691}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{77777777-7777-7777-7777-770077347791}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440044344491}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220022342291}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{33333333-3333-3333-3333-330033343391}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550055345591}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660066346691}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{77777777-7777-7777-7777-770077347791}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044344491}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0003491.BHO
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0003491.BHO.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0003491.FBApi
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0003491.FBApi.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0003491.Sandbox
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0003491.Sandbox.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT2849855
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550055345591}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660066346691}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{77777777-7777-7777-7777-770077347791}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{44444444-4444-4444-4444-440044344491}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550055345591}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660066346691}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{77777777-7777-7777-7777-770077347791}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440044344491}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011341191}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\anti-phishing domain advisor"



~~~ Chrome

Successfully deleted: [Folder] C:\Users\wolli\appdata\local\Google\Chrome\User Data\Default\Extensions\bkomkajifikmkfnjgphkjcfeepbnojok
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\pgmfkblbflahhponhjmkcnpjinenhlnc



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.03.2014 at 9:53:20,42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ich habe Schritt 2 noch nicht gemacht. Er erschien in der Mailfassung nicht, habe aber jetzt gesehen, dass ich ihn zuerst hätte machen müssen. Schritt 1 war erfolgreich, lediglich die die blekko Leiste erscheint weiterhin, trotz Löschung!

Bootsektor 24.03.2014 22:15
Hallo wolli58,

das ist nicht schlimm, du kannst ihn einfach nachholen, wichtig ist, dass du im Anschluss daran den Schritt 4 machst (die FRST.txt und Addition.txt) und mir dann alles hier postest. :)

wolli58 26.03.2014 18:08
Ok, danke....aber gib mir ein paar Tage, denn ich bin erst am Freitag wieder zu HAuse-
wolli58


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:25 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131