Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Internet Explorer und Firefox öffnen ständig neue Fenster und Tabs. (https://www.trojaner-board.de/152702-internet-explorer-firefox-oeffnen-staendig-neue-fenster-tabs.html)

TintenfischM 18.04.2014 13:51

Internet Explorer und Firefox öffnen ständig neue Fenster und Tabs.
 
Internet Explorer und Firefox öffnen ständig neue Fenster und Tabs.

Vor einigen Wochen funktionierte nach einem Update iTunes nicht mehr. Nach dem Neuinstallieren von itunes nach Einleitung von der AppleSupport-Seite ist das oben genannte Problem aufgetreten. iTunes habe ich direkt wieder deinstalliert. Trotzdem öffnete Firefox, mein Standardbrowser, nun ständig Fenster und Tabs. Daraufhin habe ich Firefox deinstalliert und stattdessen Internet Explorer genutzt, das Problem blieb bestehen. Momentan ist Arbeiten an dem Rechner nicht möglich.

In der Anlage die entsprechenden Logfiles mit Funden, leider wurde Gmer abgebrochen; Fehlermeldung: "GMER19357.exe funktioniert nicht mehr". Avira, welches ausgeschaltet wurde, lässt sich nun leider auch nicht mehr aktivieren.

Bitte um Hilfe!!

Vielen Dank!

MM

schrauber 18.04.2014 14:21

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

TintenfischM 18.04.2014 14:35

Hallo,

so korrekt?

Viele Grüße

MM


Code:



defogger_disable by jpshortstuff (23.02.10.1)
Log created at 13:59 on 18/04/2014 (user)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-04-2014 01
Ran by user (administrator) on USER-VAIO on 18-04-2014 14:02:13
Running from C:\Users\user\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
() C:\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() c:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
() C:\Program Files (x86)\melondrea\updatemelondrea.exe
() C:\Program Files (x86)\melondrea\bin\utilmelondrea.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
() C:\Program Files (x86)\T-Mobile\InternetManager_H\Internet Manager.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
() C:\Program Files (x86)\melondrea\bin\FilterApp_C64.exe
() C:\Program Files (x86)\melondrea\bin\melondrea.BrowserAdapter.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\POWERPNT.EXE
(Microsoft Corporation) C:\Windows\system32\taskmgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\NLNOTES.EXE
(IBM Corp) C:\Program Files (x86)\lotus\notes\nsenddiag.EXE
(IBM) C:\Program Files (x86)\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\notes2.exe
(Plus HD) C:\program files (x86)\plus-hd-7.7\plus-hd-7.7-bg.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [APSDaemon] => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\MountPoints2: {9e0d301b-a763-11e3-8b7b-506313e05457} - G:\AutoRun.exe
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\MountPoints2: {9e0d3026-a763-11e3-8b7b-506313e05457} - G:\AutoRun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851647&CUI=UN12416177020766219
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVEC&bmod=EU01
URLSearchHook: HKLM-x32 - uTorrentBar_DE Toolbar - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Users\user\AppData\LocalLow\uTorrentBar_DE\prxtbuTo2.dll (ClientConnect Ltd.)
URLSearchHook: HKCU - uTorrentBar_DE Toolbar - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Users\user\AppData\LocalLow\uTorrentBar_DE\prxtbuTo2.dll (ClientConnect Ltd.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
SearchScopes: HKCU - DefaultScope {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
SearchScopes: HKCU - {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {70B7A4C8-F813-4B81-A6DE-0117E7E88505} URL = hxxp://www.zinio.com/search/index.jsp?s={searchTerms}&rf=sonyie8search
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2851647
BHO: Plus-HD-7.7 - {11111111-1111-1111-1111-110511071180} - C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-bho64.dll (Plus HD)
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: SaveClicker - {FC84CF59-4939-B146-1818-B326870E0DD1} - C:\Program Files (x86)\SaveClicker\GVOSjFIkEm.x64.dll ()
BHO-x32: IEOptimizer - {10AD2C61-0898-4348-8600-14A342F22AC3} - C:\Program Files (x86)\SavingsBull\IEOptimizer.dll ()
BHO-x32: Plus-HD-7.7 - {11111111-1111-1111-1111-110511071180} - C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-bho.dll (Plus HD)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: No Name - {84FF7BD6-B47F-46F8-9130-01B2696B36CB} -  No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: uTorrentBar_DE Toolbar - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Users\user\AppData\LocalLow\uTorrentBar_DE\prxtbuTo2.dll (ClientConnect Ltd.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO-x32: SaveClicker - {FC84CF59-4939-B146-1818-B326870E0DD1} - C:\Program Files (x86)\SaveClicker\GVOSjFIkEm.dll ()
Toolbar: HKLM-x32 - uTorrentBar_DE Toolbar - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - C:\Users\user\AppData\LocalLow\uTorrentBar_DE\prxtbuTo2.dll (ClientConnect Ltd.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKCU - No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default
FF user.js: detected! => C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\user.js
FF SelectedSearchEngine: StartWeb
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\searchplugins\iminent.xml
FF Extension: Plus-HD-7.7 - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\Extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com [2014-03-09]
FF Extension: Garmin Communicator - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-29]

Chrome:
=======
CHR HomePage:
CHR StartupUrls: "urls_to_restore_on_startup"
CHR Extension: (SaveClicker) - C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp [2014-02-25]

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] ()
R2 Level Quality Watcher; C:\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe [710976 2014-01-27] ()
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
R2 SavingsbullFilterService64; c:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe [210432 2014-02-12] ()
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 Update melondrea; C:\Program Files (x86)\melondrea\updatemelondrea.exe [350496 2014-04-18] ()
R2 Util melondrea; C:\Program Files (x86)\melondrea\bin\utilmelondrea.exe [350496 2014-04-18] ()
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [61592 2013-12-17] (NetFilterSDK.com)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-18 14:02 - 2014-04-18 14:02 - 00019526 _____ () C:\Users\user\Desktop\FRST.txt
2014-04-18 14:02 - 2014-04-18 14:02 - 00000000 ____D () C:\FRST
2014-04-18 14:01 - 2014-04-18 14:01 - 02158592 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-04-18 13:59 - 2014-04-18 13:59 - 00000470 _____ () C:\Users\user\Desktop\defogger_disable.log
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:58 - 2014-04-18 13:59 - 00050477 _____ () C:\Users\user\Desktop\Defogger.exe
2014-04-18 13:55 - 2014-04-18 13:55 - 01146880 _____ (Farbar) C:\Users\user\Desktop\FRST.exe
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\Desktop\Trojaner Board
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\smkits
2014-04-18 13:19 - 2014-04-18 13:19 - 00619946 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-18 13:19 - 2014-04-18 13:19 - 00000165 ____H () C:\Users\user\Documents\~$popups2.pptx
2014-04-13 20:00 - 2014-04-13 20:00 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA .Data
2014-04-13 15:29 - 2014-04-18 13:03 - 00060977 _____ () C:\Windows\IE10_main.log
2014-04-11 13:46 - 2014-04-18 13:03 - 00072733 _____ () C:\Windows\IE11_main.log
2014-04-11 11:14 - 2014-04-18 13:04 - 00001120 _____ () C:\Windows\setupact.log
2014-04-11 11:14 - 2014-04-13 15:17 - 00004666 _____ () C:\Windows\PFRO.log
2014-04-11 11:14 - 2014-04-11 11:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-11 11:09 - 2014-04-11 11:09 - 00000000 ____D () C:\Users\user\AppData\Roaming\TuneUp Software
2014-04-11 10:58 - 2014-04-11 14:00 - 00007622 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-04-10 09:31 - 2014-04-10 09:31 - 00081190 _____ () C:\Users\user\Desktop\osteoporose DEXA 140410.enl
2014-04-09 17:38 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 17:38 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 17:38 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 17:38 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 17:38 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 17:38 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 17:38 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 17:38 - 2014-02-24 04:35 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 12296192 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 09074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 02458112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 01495040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 11020800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 06041088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 01232896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-09 17:38 - 2014-02-24 03:34 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 17:38 - 2014-02-24 03:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 17:38 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 17:38 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 17:38 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 17:38 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 17:38 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 17:38 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-03-28 17:28 - 2014-03-28 17:28 - 00000880 _____ () C:\Users\user\Desktop\GIST.lnk
2014-03-28 13:54 - 2014-03-28 13:54 - 00283192 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 28.0.exe
2014-03-27 13:33 - 2014-03-27 13:33 - 00000742 _____ () C:\Users\user\Desktop\10WBC.lnk
2014-03-23 17:36 - 2014-03-23 17:36 - 00000985 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-03-23 11:28 - 2014-03-23 11:28 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLib64.sys

==================== One Month Modified Files and Folders =======

2014-04-18 14:02 - 2014-04-18 14:02 - 00019526 _____ () C:\Users\user\Desktop\FRST.txt
2014-04-18 14:02 - 2014-04-18 14:02 - 00000000 ____D () C:\FRST
2014-04-18 14:02 - 2014-02-25 21:27 - 57321990 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-04-18 14:01 - 2014-04-18 14:01 - 02158592 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-04-18 14:01 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-18 13:59 - 2014-04-18 13:59 - 00000470 _____ () C:\Users\user\Desktop\defogger_disable.log
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:59 - 2014-04-18 13:58 - 00050477 _____ () C:\Users\user\Desktop\Defogger.exe
2014-04-18 13:59 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-04-18 13:55 - 2014-04-18 13:55 - 01146880 _____ (Farbar) C:\Users\user\Desktop\FRST.exe
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\Desktop\Trojaner Board
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\smkits
2014-04-18 13:52 - 2011-07-13 15:15 - 01448007 _____ () C:\Windows\WindowsUpdate.log
2014-04-18 13:19 - 2014-04-18 13:19 - 00619946 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-18 13:19 - 2014-04-18 13:19 - 00000165 ____H () C:\Users\user\Documents\~$popups2.pptx
2014-04-18 13:15 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-18 13:15 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-18 13:11 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-18 13:11 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-18 13:11 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-18 13:11 - 2009-07-14 04:34 - 00000609 _____ () C:\Windows\win.ini
2014-04-18 13:04 - 2014-04-11 11:14 - 00001120 _____ () C:\Windows\setupact.log
2014-04-18 13:04 - 2014-02-25 21:28 - 00002390 _____ () C:\Windows\Tasks\Plus-HD-7.7-validator.job
2014-04-18 13:04 - 2014-02-25 21:28 - 00002324 _____ () C:\Windows\Tasks\Plus-HD-7.7-firefoxinstaller.job
2014-04-18 13:04 - 2014-02-25 21:28 - 00001506 _____ () C:\Windows\Tasks\Plus-HD-7.7-updater.job
2014-04-18 13:04 - 2014-02-25 21:28 - 00001462 _____ () C:\Windows\Tasks\Plus-HD-7.7-codedownloader.job
2014-04-18 13:04 - 2014-02-25 21:28 - 00001360 _____ () C:\Windows\Tasks\Plus-HD-7.7-enabler.job
2014-04-18 13:04 - 2012-11-26 13:52 - 00126922 _____ () C:\SUService.log
2014-04-18 13:04 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-04-18 13:04 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-18 13:03 - 2014-04-13 15:29 - 00060977 _____ () C:\Windows\IE10_main.log
2014-04-18 13:03 - 2014-04-11 13:46 - 00072733 _____ () C:\Windows\IE11_main.log
2014-04-18 07:39 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-04-13 20:00 - 2014-04-13 20:00 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA .Data
2014-04-13 15:21 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-13 15:17 - 2014-04-11 11:14 - 00004666 _____ () C:\Windows\PFRO.log
2014-04-11 15:14 - 2014-02-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-11 15:02 - 2011-07-28 20:01 - 00000000 ____D () C:\ProgramData\Apple
2014-04-11 14:59 - 2014-03-02 14:38 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-11 14:00 - 2014-04-11 10:58 - 00007622 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-04-11 11:14 - 2014-04-11 11:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-11 11:14 - 2011-07-13 15:19 - 00000000 ____D () C:\Program Files\Google
2014-04-11 11:14 - 2011-07-13 15:19 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-11 11:12 - 2011-09-07 11:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-11 11:12 - 2011-07-25 21:13 - 00000000 ____D () C:\Windows\Minidump
2014-04-11 11:09 - 2014-04-11 11:09 - 00000000 ____D () C:\Users\user\AppData\Roaming\TuneUp Software
2014-04-11 11:00 - 2011-07-25 20:55 - 00000000 ____D () C:\Users\user\AppData\Local\Google
2014-04-11 11:00 - 2011-07-13 15:19 - 00000000 ____D () C:\ProgramData\Google
2014-04-11 10:55 - 2011-08-02 15:40 - 00000000 ____D () C:\Users\user\AppData\Local\Conduit
2014-04-10 10:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-10 09:31 - 2014-04-10 09:31 - 00081190 _____ () C:\Users\user\Desktop\osteoporose DEXA 140410.enl
2014-04-09 19:48 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 19:48 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 19:44 - 2011-08-21 19:51 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-03-31 09:35 - 2011-07-27 21:52 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 17:28 - 2014-03-28 17:28 - 00000880 _____ () C:\Users\user\Desktop\GIST.lnk
2014-03-28 13:54 - 2014-03-28 13:54 - 00283192 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 28.0.exe
2014-03-27 20:54 - 2011-07-27 21:19 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315
2014-03-27 20:54 - 2011-07-27 21:19 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26
2014-03-27 13:33 - 2014-03-27 13:33 - 00000742 _____ () C:\Users\user\Desktop\10WBC.lnk
2014-03-27 09:58 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-23 17:36 - 2014-03-23 17:36 - 00000985 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-03-23 11:28 - 2014-03-23 11:28 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLib64.sys

Files to move or delete:
====================
C:\ProgramData\avira_free_antivirus_de.exe
C:\ProgramData\Dropbox 1.4.3.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-09 18:11

==================== End Of Log ============================

--- --- ---

Code:


Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-04-2014 01
Ran by user at 2014-04-18 14:03:13
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.0.0 - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.9 - Adobe Systems Incorporated)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - ALPS ELECTRIC CO., LTD.)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{7BB90344-0647-468E-925A-7F69F7983421}) (Version: 2.0.1.85 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.193 - ArcSoft)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Berkeley Madonna (HKLM-x32\...\{27AB9BD6-4A3E-4BBD-8381-CD445E474936}) (Version:  - )
BS.Player FREE powered by AdVantage (HKLM-x32\...\BSPlayerf) (Version: 2.28.964 - Webteh, d.o.o.)
BS.Player PRO (HKLM-x32\...\BSPlayerp) (Version: 2.53.1034 - Webteh, d.o.o.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.109 - Corel Inc.)
Einstellungen für VAIO-Inhaltsüberwachung (HKLM-x32\...\{23825B69-36DF-4DAD-9CFD-118D11D80F16}) (Version: 2.4.1.09180 - Sony Corporation)
EndNote X5 (HKLM-x32\...\{86B3F2D6-AC2B-0015-8AE1-F2F77F781B0C}) (Version: 15.0.0.5478 - Thomson Reuters)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.0.545 - Evernote Corp.)
Google Update Helper (x32 Version: 1.3.23.9 - Google Inc.) Hidden
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{CCAFF072-4DDB-4846-963D-15F02A8E9472}) (Version: 13.00.0000 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.00.1030 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Internet Manager (HKLM-x32\...\Internet Manager) (Version: 22.001.18.74.55 - Huawei Technologies Co.,Ltd)
Java(TM) 6 Update 16 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416016FF}) (Version: 6.0.160 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Lotus Notes 8.5.3 de (HKLM-x32\...\{122A716C-63AD-4F73-BDCD-309F0A799C91}) (Version: 8.53.11286 - IBM)
Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.1.0.10210 - Sony Corporation)
Media Gallery (x32 Version: 1.1.0.10210 - Sony Corporation) Hidden
mediscript Hammerexamen (HKLM-x32\...\{1231D46E-3174-4F1F-859E-41DCB0D070D2}) (Version: 5.0.0 - Elsevier GmbH)
melondrea (HKLM\...\melondrea) (Version: 2014.02.24.181624 - melondrea)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 x64 English (HKLM\...\{F83779DF-E1F5-43A2-A7BE-732F856FADB7}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MusicStation (HKLM-x32\...\{AB259D46-F851-41B0-9AFA-AED8998AD68A}) (Version: 2.0.0.1067 - Omnifone)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.9 - NVIDIA Corporation)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
Plus-HD-7.7 (HKLM-x32\...\Plus-HD-7.7) (Version: 1.34.2.13 - Plus HD) <==== ATTENTION
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.0.00.10260 - Sony Corporation)
PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{88C252C8-A7EE-4B60-BF74-8E5919A8048F}) (Version: 1.0.00.09250 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.0.00.09250 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (Click to Disc) (HKLM-x32\...\InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}) (Version: 3.0.01.11230 - Sony Corporation)
PMB VAIO Edition plug-in (Click to Disc) (x32 Version: 3.0.01.11230 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Image Optimizer) (HKLM-x32\...\InstallShield_{1873FFC1-FDCB-47E1-B7C7-F418211E3530}) (Version: 1.0.00.10150 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Image Optimizer) (x32 Version: 1.0.00.10150 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Movie Story) (HKLM-x32\...\InstallShield_{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}) (Version: 2.2.00.15250 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Movie Story) (x32 Version: 2.2.00.15250 - Sony Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5992 - Realtek Semiconductor Corp.)
ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version:  - )
Roxio Central Audio (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Copy (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Core (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Data (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Tools (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Easy Media Creator 10 LJ (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio)
Roxio Easy Media Creator Home (x32 Version: 10.3.183 - Roxio) Hidden
SaveClicker (HKLM-x32\...\{E96338DC-1468-4918-8EC2-8454BFFC5025}) (Version: 1.1.0.1030 - SaveClicker) <==== ATTENTION
SavingsBull (HKLM\...\Level Quality Watcher) (Version: SavingsBull - SavingsBull) <==== ATTENTION
SavingsBull (x32 Version: 1.0.0.0 - SavingsBull) Hidden <==== ATTENTION
SavingsbullFilter (Version: 1.0.0.0 - SavingsBull Filter) Hidden <==== ATTENTION
Setting Utility Series (HKLM-x32\...\{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}) (Version: 5.1.0.11200 - Sony Corporation)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sony Home Network Library (HKLM-x32\...\{D03D02D8-AB64-4785-A48E-5AA8B0FB8C14}) (Version: 2.0.1.10160 - Sony Corporation)
Sony Home Network Library (x32 Version: 2.0.1.10160 - Sony Corporation) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6FAA03BD-2B51-4029-9AD9-64A3B8E3C84C}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
uTorrentBar_DE Toolbar (HKLM-x32\...\uTorrentBar_DE Toolbar) (Version: 6.8.5.1 - uTorrentBar_DE) <==== ATTENTION
VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 5.0.3.11130 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (HKLM-x32\...\{4882EBF5-CA37-4EF4-BCB8-9B0E78B907D0}) (Version: 3.6.0.09250 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (x32 Version: 3.6.0.09250 - Sony Corporation) Hidden
VAIO Content Metadata Intelligent Network Service Manager (HKLM-x32\...\{4427F384-B5BE-4769-B7D0-C784FC321EB1}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata Intelligent Network Service Manager (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Metadata Manager Settings (HKLM-x32\...\{12D0BE8D-538C-4AB1-86DE-C540308F50DA}) (Version: 3.6.0.09240 - Sony Corporation)
VAIO Content Metadata Manager Settings (x32 Version: 3.6.0.09240 - Sony Corporation) Hidden
VAIO Content Metadata XML Interface Library (HKLM-x32\...\{291FB4BF-EEC7-4CF9-8469-F39ED1DBC4D8}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata XML Interface Library (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Monitoring Settings (x32 Version: 2.4.1.09180 - Sony Corporation) Hidden
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.1.0.10160 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.2.0.09150 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.2.0.09150 - Sony Corporation) Hidden
VAIO DVD Menu Data (HKLM-x32\...\{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}) (Version: 2.0.00.10130 - Sony Corporation)
VAIO Energie Verwaltung (HKLM-x32\...\{803E4FA5-A940-4420-B89D-A8BC2E160247}) (Version: 5.0.0.11300 - Sony Corporation)
VAIO Entertainment Platform (HKLM-x32\...\{6B1F20F2-6321-4669-A58C-33DF8E7517FF}) (Version: 3.6.0.09150 - Sony Corporation)
VAIO Entertainment Platform (x32 Version: 3.6.0.09150 - Sony Corporation) Hidden
VAIO Event Service (HKLM-x32\...\{C7477742-DDB4-43E5-AC8D-0259E1E661B1}) (Version: 5.1.0.11300 - Sony Corporation)
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 1.2.0.09240 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 1.0.0.10290 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 3.9.1 - Sony Corporation) Hidden
VAIO Marketing Tools (HKLM-x32\...\MarketingTools) (Version:  - Sony Corporation)
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.0.1.10160 - Sony Corporation)
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 1.2.0.09100 - Sony Corporation)
VAIO Movie Story MergeModules x64 (Version: 1.0.14240 - Sony Corporation) Hidden
VAIO Movie Story Template Data (HKLM-x32\...\InstallShield_{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}) (Version: 2.2.00.15250 - Sony Corporation)
VAIO Movie Story Template Data (x32 Version: 2.0.00.09240 - Sony Corporation) Hidden
VAIO Original Function Settings (x32 Version: 2.0.0.07010 - Sony Corporation) Hidden
VAIO Original Funktion Einstellungen (HKLM-x32\...\{A63E7492-A0BC-4BB9-89A7-352965222380}) (Version: 2.0.0.07010 - Sony Corporation)
VAIO Personalization Manager (HKLM-x32\...\{A95187EF-BCF4-4468-B501-C0BAB976ADD1}) (Version: 2.0.0.06220 - Sony Corporation)
VAIO Personalization Manager (x32 Version: 2.0.0.06220 - Sony Corporation) Hidden
VAIO Premium Partners (HKLM-x32\...\VAIO Premium Partners) (Version: 1.0 - Sony Europe)
VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.1.0.11250 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 6.1.1.10250 - Sony Corporation)
VAIO Wallpaper Contents (HKLM-x32\...\{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}) (Version: 2.0.0.06010 - Sony Corporation)
VAIO Window Organizer (HKLM-x32\...\{6D320CE8-79EB-4D45-8C6D-DEF74D84B49A}) (Version: 2.0.0.08280 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.1.0.10200 - Sony Corporation)
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
Windows Driver Package - Broadcom Bluetooth  (09/09/2009 6.2.0.9405) (HKLM\...\930E4792BDAEAFB62A9514EE7578775658A5D07C) (Version: 09/09/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

11-04-2014 12:59:29 Removed Apple Software Update
11-04-2014 13:00:17 Removed Apple Mobile Device Support
11-04-2014 13:00:59 Removed Bonjour
11-04-2014 13:01:33 Removed Apple Application Support
11-04-2014 15:41:54 Windows Update
13-04-2014 13:27:44 Windows Update
13-04-2014 18:15:10 Windows Update
13-04-2014 20:24:26 Windows Update
15-04-2014 21:36:47 Windows Update
16-04-2014 08:38:09 Windows Update
16-04-2014 20:24:10 Windows Update
17-04-2014 19:26:25 Windows Update
18-04-2014 11:01:57 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0FCBD88B-561D-476A-9E9D-F133D15D63BD} - System32\Tasks\VAIO Care Service => C:\Program Files\Sony\VAIO Care\VAIOCareService.exe [2009-10-21] (Sony Corporation)
Task: {11F23285-73B9-4380-BF63-7CAA14FA77BD} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {25A529C6-0A67-476A-A74E-4156CB31A33B} - System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25] (Google Inc.)
Task: {2D3682DA-0E30-4B02-8187-052E2C321117} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {4AD3B0FF-B3B1-47C5-A1A4-12FD4CDEC4B9} - System32\Tasks\Plus-HD-7.7-validator => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-validator.exe [2014-02-25] (Plus HD) <==== ATTENTION
Task: {51AC7AD5-0423-4AEA-92E4-7AEB2C6F3E9F} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2009-09-24] (Sony Corporation)
Task: {55985EB9-E42B-40B9-84C9-DFEA4C9BCA59} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {7BABAC77-3B91-4CC3-85AD-4573FCFBFF12} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {AB34D3BB-1D9E-492C-8D2D-C28C6CE01729} - System32\Tasks\Plus-HD-7.7-firefoxinstaller => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-firefoxinstaller.exe [2014-02-25] (Plus HD) <==== ATTENTION
Task: {ACE25725-C302-4826-9E02-C9044859540B} - System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25] (Google Inc.)
Task: {B1681672-CF62-40C4-BE0B-96E6AC075CEB} - System32\Tasks\Plus-HD-7.7-updater => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-updater.exe [2014-02-25] (Plus HD) <==== ATTENTION
Task: {BF9FD1B7-D330-4FAB-9434-EA80B65D339C} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {C5AB10FF-BB81-4EFE-A6E5-656CECAEDB78} - System32\Tasks\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2009-10-19] (Sony Corporation)
Task: {CC306779-D254-4845-A3C6-555DEB7A453B} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {D59C238B-7274-4FA8-9318-BB561B9C7B5B} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2012-10-26] (Sony Corporation)
Task: {E9D4B398-4D68-4CEA-876F-CAEA7DA96FD7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: {F4465EBB-EE23-4EFE-8C24-A4A1CBCECA38} - System32\Tasks\Plus-HD-7.7-enabler => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-enabler.exe [2014-02-25] (Plus HD) <==== ATTENTION
Task: {F51A8938-76E5-4395-AC86-09AD20B0218D} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2012-10-26] (Sony Corporation)
Task: {F907503C-DAB5-4360-B5E9-DFACE9A7847F} - System32\Tasks\Plus-HD-7.7-codedownloader => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-codedownloader.exe [2014-02-25] (Plus HD) <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Plus-HD-7.7-codedownloader.job => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-codedownloader.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-7.7-enabler.job => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-enabler.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-7.7-firefoxinstaller.job => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-firefoxinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-7.7-updater.job => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\Plus-HD-7.7-validator.job => C:\Program Files (x86)\Plus-HD-7.7\Plus-HD-7.7-validator.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2009-09-21 15:04 - 2009-09-21 15:04 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2009-09-01 05:31 - 2009-09-01 05:31 - 00022016 _____ () C:\Windows\System32\ssp2ml6.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2014-03-09 11:47 - 2013-02-05 09:24 - 00671744 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2014-01-27 22:45 - 2014-01-27 22:45 - 00710976 _____ () C:\Program Files\Level Quality Watcher\v1.01\levelqualitywatcher64.exe
2011-05-27 09:59 - 2009-01-12 08:15 - 00071096 _____ () C:\Windows\SysWOW64\NMSAccess32.exe
2014-02-12 15:16 - 2014-02-12 15:16 - 00210432 _____ () c:\Program Files\SavingsbullFilter\SavingsbullFilterService64.exe
2014-02-02 12:26 - 2014-02-02 12:26 - 00317952 _____ () c:\Program Files\SavingsbullFilter\ProtocolFilters.dll
2013-11-19 01:42 - 2013-11-19 01:42 - 00110080 _____ () c:\Program Files\SavingsbullFilter\nfapi.dll
2014-02-24 20:16 - 2014-04-18 08:09 - 00350496 _____ () C:\Program Files (x86)\melondrea\updatemelondrea.exe
2014-02-26 20:52 - 2014-04-18 07:38 - 00350496 _____ () C:\Program Files (x86)\melondrea\bin\utilmelondrea.exe
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2014-03-09 11:46 - 2012-11-22 13:21 - 00326240 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\Internet Manager.exe
2014-03-23 11:28 - 2014-04-18 13:11 - 00287008 _____ () C:\Program Files (x86)\melondrea\bin\FilterApp_C64.exe
2014-04-10 10:03 - 2014-04-17 22:26 - 00095520 _____ () C:\Program Files (x86)\melondrea\bin\melondrea.BrowserAdapter.exe
2013-08-12 19:14 - 2013-08-12 19:08 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2014-03-09 11:47 - 2009-01-10 12:32 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2014-03-09 11:47 - 2009-06-22 20:42 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2014-03-09 11:47 - 2012-10-31 11:11 - 02417152 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2014-03-09 11:47 - 2012-10-31 11:14 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2011-07-13 15:36 - 2009-11-30 19:20 - 00010752 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2011-07-13 15:36 - 2009-11-30 19:20 - 00009728 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2014-03-09 11:46 - 2013-01-30 04:56 - 00428544 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\core.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00275968 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\sdk.dll
2014-03-09 11:46 - 2009-01-10 12:32 - 00011362 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\mingwm10.dll
2014-03-09 11:46 - 2009-06-22 20:42 - 00043008 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\libgcc_s_dw2-1.dll
2014-03-09 11:46 - 2012-10-31 11:11 - 02417152 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\QtCore4.dll
2014-03-09 11:46 - 2012-10-31 11:33 - 09562624 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\QtGui4.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00390144 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\Proxy.DLL
2014-03-09 11:46 - 2013-01-30 04:53 - 00222208 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\Common.dll
2014-03-09 11:46 - 2013-01-30 04:53 - 00158208 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\Trace.dll
2014-03-09 11:46 - 2013-01-30 04:53 - 00545280 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\PluginContainer.dll
2014-03-09 11:46 - 2013-01-30 04:53 - 00239104 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\AtCodec.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00300544 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DeviceSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00236544 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:53 - 00135168 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\OSDialup.dll
2014-03-09 11:46 - 2013-01-30 04:53 - 00168960 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\XCodec.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00157184 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DataServicePlugin.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00262656 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\AddrBookSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00219136 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\SmsSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00142336 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\USSDSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00337408 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DeviceAppPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00065536 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\OSPowerMgr.dll
2014-03-09 11:46 - 2012-05-18 02:40 - 00120192 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\Win7Support.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00123904 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\ATR2SMgr.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 01086976 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\AddrBookPlugin.dll
2014-03-09 11:46 - 2013-02-20 03:33 - 00686592 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\SmsAppPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00158720 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetConnectSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00211968 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DialUpPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:53 - 00102400 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\OSAdapt.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00179200 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NDISPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:54 - 00131584 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\OSNDIS.dll
2014-03-09 11:46 - 2012-05-18 02:39 - 01107328 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NDISAPI.dll
2014-03-09 11:46 - 2013-01-30 04:55 - 00295936 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetInfoSrvPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:59 - 00559616 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DeviceMgrUIPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:00 - 00303104 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\XFramePlugin.dll
2014-03-09 11:46 - 2013-02-20 03:33 - 00819712 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\MiniFramePlugin.dll
2014-03-09 11:46 - 2012-10-31 11:11 - 00398336 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\QtXml4.dll
2014-03-09 11:46 - 2013-01-30 04:58 - 00097280 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NotifyServicePlugin.dll
2014-03-09 11:46 - 2013-01-30 05:01 - 00330240 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetConnectPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:57 - 00418816 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DialupUIPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:00 - 00318976 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\StatusBarMgrPlugin.dll
2014-03-09 11:46 - 2013-02-22 03:07 - 00274432 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\MenuMgrPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:00 - 00117248 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\LayoutPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:01 - 00309760 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\SettingUIPlugin.dll
2014-03-09 11:46 - 2013-02-21 04:51 - 00500224 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetSettingPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:03 - 00308736 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetInfoRecordUIPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:04 - 00100352 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\CompressRatePlugin.dll
2014-03-09 11:46 - 2013-01-30 05:02 - 00517632 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\NetInfoUIExPlugin.dll
2014-03-09 11:46 - 2013-01-30 04:58 - 00839680 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\SMSUIPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:04 - 00110080 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\ServiceUIPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:02 - 00412160 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\DiagnosisPlugin.dll
2014-03-09 11:46 - 2012-10-31 11:14 - 01148416 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\QtNetwork4.dll
2014-03-09 11:46 - 2013-01-30 05:04 - 00139776 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\HelpUIPlugin.dll
2014-03-09 11:46 - 2013-01-30 05:03 - 00434688 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\USSDUIPlugin.dll
2014-03-09 11:46 - 2013-02-20 03:33 - 00806400 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\AddrBookUIPlugin.dll
2014-03-09 11:46 - 2012-10-31 13:14 - 00082944 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qgif4.dll
2014-03-09 11:46 - 2012-10-31 13:16 - 00081920 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qico4.dll
2014-03-09 11:46 - 2012-10-31 13:14 - 00192000 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qjpeg4.dll
2014-03-09 11:46 - 2012-10-31 13:15 - 00350720 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qmng4.dll
2014-03-09 11:46 - 2012-10-31 13:15 - 00370176 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\plugins\imageformats\qtiff4.dll
2014-03-09 11:46 - 2013-02-05 09:24 - 00712192 _____ () C:\Program Files (x86)\T-Mobile\InternetManager_H\LiveUpdateInterface.dll
2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL
2011-09-15 17:19 - 2011-09-15 17:19 - 00081920 _____ () C:\Program Files (x86)\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\eclipse_1118.dll
2011-09-15 17:19 - 2011-09-15 17:19 - 00110592 _____ () C:\Program Files (x86)\lotus\notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.3.20110915-1350\win32\x86\pipeserver.dll
2012-11-26 14:01 - 2012-11-26 14:01 - 00073728 _____ () C:\Users\user\AppData\Local\Lotus\Notes\Data\workspace\.config\org.eclipse.osgi\bundles\588\1\.cp\swtIbmWrapper.dll
2014-02-18 11:17 - 2014-02-18 11:17 - 00086800 _____ () C:\Program Files (x86)\SavingsBull\IEOptimizer.dll
2013-02-25 21:28 - 2013-02-25 21:28 - 00370176 _____ () C:\Program Files (x86)\SaveClicker\GVOSjFIkEm.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: TermService => 3

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/18/2014 01:53:41 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: fixmapi.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bcd6e
Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18229, Zeitstempel: 0x51fb1116
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00035b64
ID des fehlerhaften Prozesses: 0x1a08
Startzeit der fehlerhaften Anwendung: 0xfixmapi.exe0
Pfad der fehlerhaften Anwendung: fixmapi.exe1
Pfad des fehlerhaften Moduls: fixmapi.exe2
Berichtskennung: fixmapi.exe3

Error: (04/18/2014 01:47:26 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514, Zeitstempel: 0x4ce79912
Name des fehlerhaften Moduls: IEOptimizer.dll, Version: 0.0.0.0, Zeitstempel: 0x53037983
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000014fa
ID des fehlerhaften Prozesses: 0x1a14
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/18/2014 01:46:16 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514, Zeitstempel: 0x4ce79912
Name des fehlerhaften Moduls: IEOptimizer.dll, Version: 0.0.0.0, Zeitstempel: 0x53037983
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000014fa
ID des fehlerhaften Prozesses: 0x150c
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/18/2014 01:35:39 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514, Zeitstempel: 0x4ce79912
Name des fehlerhaften Moduls: IEOptimizer.dll, Version: 0.0.0.0, Zeitstempel: 0x53037983
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000014fa
ID des fehlerhaften Prozesses: 0x1014
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/18/2014 01:23:43 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514, Zeitstempel: 0x4ce79912
Name des fehlerhaften Moduls: IEOptimizer.dll, Version: 0.0.0.0, Zeitstempel: 0x53037983
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000014fa
ID des fehlerhaften Prozesses: 0x1b44
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/18/2014 01:19:19 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514, Zeitstempel: 0x4ce79912
Name des fehlerhaften Moduls: IEOptimizer.dll, Version: 0.0.0.0, Zeitstempel: 0x53037983
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000014fa
ID des fehlerhaften Prozesses: 0xc88
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/18/2014 01:12:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 8.0.7601.17514, Zeitstempel: 0x4ce79912
Name des fehlerhaften Moduls: IEOptimizer.dll, Version: 0.0.0.0, Zeitstempel: 0x53037983
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000014fa
ID des fehlerhaften Prozesses: 0x1628
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3

Error: (04/18/2014 01:05:03 PM) (Source: VzCdbSvc) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (04/18/2014 01:05:03 PM) (Source: VzCdbSvc) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (04/18/2014 00:52:45 PM) (Source: VzCdbSvc) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)


System errors:
=============
Error: (04/18/2014 01:05:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "VAIO Content Folder Watcher" ist vom Dienst "Remotedesktopdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (04/18/2014 01:04:57 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.

Error: (04/18/2014 01:04:48 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (04/18/2014 01:04:48 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (04/18/2014 01:03:39 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (04/18/2014 01:03:13 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 10 für Windows 7 für x64-basierte Systeme

Error: (04/18/2014 00:56:20 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.

Error: (04/18/2014 00:56:20 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.

Error: (04/18/2014 00:56:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.

Error: (04/18/2014 00:56:18 PM) (Source: Disk) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk3\DR3 gefunden.


Microsoft Office Sessions:
=========================
Error: (11/24/2012 07:26:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 181 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:14:23 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:14:13 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 14861 seconds with 7800 seconds of active time.  This session ended with a crash.

Error: (04/25/2012 01:40:43 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/07/2011 08:22:07 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31802 seconds with 5940 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-09-18 17:40:26.397
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 17:40:26.241
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 17:35:17.096
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 17:35:16.534
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 17:35:09.046
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 17:35:08.562
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-18 17:29:48.589
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 17:29:48.355
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 17:29:48.121
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-18 17:29:47.887
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\avkmgr.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 52%
Total physical RAM: 4014.09 MB
Available physical RAM: 1917.25 MB
Total Pagefile: 8026.36 MB
Available Pagefile: 5487.97 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:230.72 GB) (Free:153.64 GB) NTFS
Drive g: (Internet Manager) (CDROM) (Total:0.05 GB) (Free:0 GB) CDFS
Drive m: (Volume) (Fixed) (Total:224.93 GB) (Free:68.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 06CF34C5)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=225 GB) - (Type=OF Extended)

==================== End Of Log ============================


schrauber 19.04.2014 09:31

Revo Uninstaller - Download - Filepony
Damit alles deinstallieren was Du in der Additional.txt findest mit dem Zusatz <== ATTENTION

Mit Revo auch Moderat die Reste entfernen lassen.




Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.


TintenfischM 19.04.2014 12:36

Hallo,

habe die empfohlenen Schritte erfüllt. Bis auf „…savingbull“ und „…task …“ (waren nicht im Revo erschienen) konnte ich die anderen Attention-markierten Programme deinstallieren bzw. Dateien löschen. Spybot ist aufgegangen und berichtet Search & Destroy "Ein wichtiger Registrierdatenbank-Eintrag wurde verändert". Der Eintrag ist für mich kryptisch: {C840E-246-6895-475E-9BD7-CAA1C7ECA9F2}

Hier noch die Logfile von Kombofix.

Code:


Combofix Logfile:

       
Code:

       
ComboFix 14-04-17.01 - user 19.04.2014  12:37:52.2.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4014.2295 [GMT 2:00]
ausgeführt von:: c:\users\user\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\avira_free_antivirus_de.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\A_m5iC9EUGis.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\background.html
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\content.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\lsdb.js
c:\users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\manifest.json
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\A_m5iC9EUGis.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\background.html
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\content.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\lsdb.js
c:\users\Gast\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\manifest.json
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\A_m5iC9EUGis.js
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\background.html
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\content.js
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\lsdb.js
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\glichbemhbdnhheodcpappemilpcfhgp\2.1\manifest.json
c:\users\user\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome.manifest
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\asyncDB.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\background.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\browserAction.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\contextMenu.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\dbManager.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\dom_bg.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\fileManager.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\firefox.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\firefoxNotifications.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\firefoxOmnibox.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\message.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\pageAction.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\request.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\tabs.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\webRequest.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\api\windowsMessagingHandler.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\background.html
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\baseObject.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\browser.xul
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\addressBarChangeObserver.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\console.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\consts.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\delegate.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\extensionDataStore.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\folderIOWrapper.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\httpObserver.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\IDBWrapper.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\installer.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\logFile.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\prefs.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\progressListenerObserver.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\registry.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\reloadObserver.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\reports.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\requestObject.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\searchSettings.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\uninstallObserver.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\updateManager.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\utils.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\core\xhr.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\dialog.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\ffCoreFilesIndex.txt
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\main.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\options.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\options.xul
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\platformVersion.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\chrome\content\search_dialog.xul
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\defaults\preferences\prefs.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\manifest.xml
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins.json
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\1_base.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\102_dealply_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\103_intext_5_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\104_jollywallet_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\119_similar_web_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\123_intext_adv_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\14_CrossriderUtils.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\155_ibario_pops_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\16_FFAppAPIWrapper.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\17_jQuery.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\177_crossriderDashboard.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\178_revizer_ws_dynamic_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\179_revizer_p_dynamic_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\180_bpo_serp_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\182_openUrl.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\183_tabsWrapper.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\184_noproblemppc_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\191_ciuvo_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\195_icm_convertmedia_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\207_dbWrapper.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\21_debug.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\22_resources.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\220_icm_base_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\221_icm_downloads_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\223_imonomy_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\246_setup.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\28_initializer.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\4_jquery_1_7_1.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\47_resources_background.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\64_appApiMessage.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\7_hooks.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\72_appApiValidation.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\78_CrossriderInfo.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\9_search_engine_hook.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\91_monetizationLoader.js.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\plugins\98_omniCommands.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\userCode\background.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\extensionData\userCode\extension.js
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\install.rdf
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\locale\en-US\translations.dtd
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\button1.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\button2.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\button3.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\button4.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\button5.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\crossrider_statusbar.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\icon128.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\icon16.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\icon24.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\icon48.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\panelarrow-up.png
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\popup.html
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\skin.css
c:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\extensions\29abb661-0efc-4f64-8a89-b11430d434c4@9678608e-dc95-42b0-8db0-4ce126239776.com\skin\update.css
c:\windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe
c:\windows\security\Database\tmp.edb
.
c:\windows\regedit.exe . . . ist infiziert!!
.
c:\windows\SysWOW64\regedit.exe . . . ist infiziert!!
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_Level Quality Watcher
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-03-19 bis 2014-04-19  ))))))))))))))))))))))))))))))
.
.
2014-04-19 09:31 . 2014-04-19 09:31        --------        d-----w-        c:\program files (x86)\VS Revo Group
2014-04-18 16:23 . 2014-04-17 03:31        10651704        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{4AC7C245-D9A6-4FD1-B634-7BA20D9BE4DD}\mpengine.dll
2014-04-18 12:02 . 2014-04-18 12:05        --------        d-----w-        C:\FRST
2014-04-18 11:53 . 2014-04-18 11:53        --------        d-----w-        c:\users\user\AppData\Roaming\smkits
2014-04-11 09:09 . 2014-04-11 09:09        --------        d-----w-        c:\users\user\AppData\Roaming\TuneUp Software
2014-03-28 11:54 . 2014-03-28 11:54        283192        ----a-w-        c:\program files (x86)\Firefox Setup Stub 28.0.exe
2014-03-23 09:28 . 2014-03-23 09:28        61112        ----a-w-        c:\windows\system32\drivers\wStLib64.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-04-09 17:44 . 2011-08-21 17:51        90655440        ----a-w-        c:\windows\system32\MRT.exe
2014-03-31 07:35 . 2011-07-27 19:52        270496        ------w-        c:\windows\system32\MpSigStub.exe
2014-03-13 08:01 . 2012-06-01 14:25        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-13 08:01 . 2012-06-01 14:25        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-04 09:17 . 2014-04-09 15:38        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
2014-03-02 11:14 . 2014-03-02 11:10        148885840        ----a-w-        c:\program files (x86)\iTunes64Setup.exe
2014-02-07 01:23 . 2014-03-11 20:21        3156480        ----a-w-        c:\windows\system32\win32k.sys
2014-02-04 02:32 . 2014-03-11 20:21        1424384        ----a-w-        c:\windows\system32\WindowsCodecs.dll
2014-02-04 02:32 . 2014-03-11 20:21        624128        ----a-w-        c:\windows\system32\qedit.dll
2014-02-04 02:04 . 2014-03-11 20:21        1230336        ----a-w-        c:\windows\SysWow64\WindowsCodecs.dll
2014-02-04 02:04 . 2014-03-11 20:21        509440        ----a-w-        c:\windows\SysWow64\qedit.dll
2014-01-29 02:32 . 2014-03-11 20:21        484864        ----a-w-        c:\windows\system32\wer.dll
2014-01-29 02:06 . 2014-03-11 20:21        381440        ----a-w-        c:\windows\SysWow64\wer.dll
2014-01-28 02:32 . 2014-03-11 20:21        228864        ----a-w-        c:\windows\system32\wwansvc.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{10AD2C61-0898-4348-8600-14A342F22AC3}]
2014-02-18 09:17        86800        ----a-w-        c:\program files (x86)\SavingsBull\IEOptimizer.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-08-26 320880]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2009-10-24 597792]
"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2011-07-13 26624]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2012-12-12 163000]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-02-22 689744]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-11-30 17:20        98304        ----a-w-        c:\windows\System32\VESWinlogon.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Internet Manager. RunOuc;Internet Manager. OUC;c:\program files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe;c:\program files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [x]
R2 Roxio Upnp Server 10;Roxio Upnp Server 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe;c:\program files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys;c:\windows\SYSNATIVE\DRIVERS\ew_hwusbdev.sys [x]
R3 ew_usbenumfilter;huawei_CompositeFilter;c:\windows\system32\DRIVERS\ew_usbenumfilter.sys;c:\windows\SYSNATIVE\DRIVERS\ew_usbenumfilter.sys [x]
R3 huawei_cdcacm;huawei_cdcacm;c:\windows\system32\DRIVERS\ew_jucdcacm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jucdcacm.sys [x]
R3 huawei_ext_ctrl;huawei_ext_ctrl;c:\windows\system32\DRIVERS\ew_juextctrl.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juextctrl.sys [x]
R3 huawei_wwanecm;huawei_wwanecm;c:\windows\system32\DRIVERS\ew_juwwanecm.sys;c:\windows\SYSNATIVE\DRIVERS\ew_juwwanecm.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 Roxio UPnP Renderer 10;Roxio UPnP Renderer 10;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe;c:\program files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [x]
R3 SampleCollector;Intel(R) Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe;c:\program files\Sony\VAIO Care\collsvc.exe [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDBSvr;VAIO Media plus Database Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SOHPlMgr;VAIO Media plus Playlist Manager;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TVICHW64;TVICHW64;c:\windows\system32\DRIVERS\TVICHW64.SYS;c:\windows\SYSNATIVE\DRIVERS\TVICHW64.SYS [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S1 wStLib64;wStLib64;c:\windows\system32\drivers\wStLib64.sys;c:\windows\SYSNATIVE\drivers\wStLib64.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 HWDeviceService64.exe;HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe;c:\programdata\DatacardService\HWDeviceService64.exe [x]
S2 LNSUSvc;Lotus Notes Smart Upgrade Service       ;c:\program files (x86)\lotus\notes\SUService.exe;c:\program files (x86)\lotus\notes\SUService.exe [x]
S2 Lotus Notes Diagnostics;Lotus Notes-Diagnose;c:\program files (x86)\lotus\notes\nsd.exe;c:\program files (x86)\lotus\notes\nsd.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys;c:\windows\SYSNATIVE\drivers\risdsne64.sys [x]
S2 SavingsbullFilterService64;SavingsbullFilterService64;c:\program files\SavingsbullFilter\SavingsbullFilterService64.exe;c:\program files\SavingsbullFilter\SavingsbullFilterService64.exe [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 Update melondrea;Update melondrea;c:\program files (x86)\melondrea\updatemelondrea.exe;c:\program files (x86)\melondrea\updatemelondrea.exe [x]
S2 Util melondrea;Util melondrea;c:\program files (x86)\melondrea\bin\utilmelondrea.exe;c:\program files (x86)\melondrea\bin\utilmelondrea.exe [x]
S2 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys;c:\windows\SYSNATIVE\DRIVERS\ew_jubusenum.sys [x]
S3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x]
S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2014-04-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-01 08:01]
.
2014-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25 19:11]
.
2014-04-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25 19:11]
.
2014-04-19 c:\windows\Tasks\Plus-HD-7.7-codedownloader.job
- c:\program files (x86)\Plus-HD-7.7\Plus-HD-7.7-codedownloader.exe [2014-02-25 19:28]
.
2014-04-19 c:\windows\Tasks\Plus-HD-7.7-enabler.job
- c:\program files (x86)\Plus-HD-7.7\Plus-HD-7.7-enabler.exe [2014-02-25 19:28]
.
2014-04-19 c:\windows\Tasks\Plus-HD-7.7-firefoxinstaller.job
- c:\program files (x86)\Plus-HD-7.7\Plus-HD-7.7-firefoxinstaller.exe [2014-02-25 19:28]
.
2014-04-19 c:\windows\Tasks\Plus-HD-7.7-updater.job
- c:\program files (x86)\Plus-HD-7.7\Plus-HD-7.7-updater.exe [2014-02-25 19:28]
.
2014-04-19 c:\windows\Tasks\Plus-HD-7.7-validator.job
- c:\program files (x86)\Plus-HD-7.7\Plus-HD-7.7-validator.exe [2014-02-25 19:28]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11111111-1111-1111-1111-110511071180}]
2014-02-25 19:28        678248        ----a-w-        c:\program files (x86)\Plus-HD-7.7\Plus-HD-7.7-bho64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IAAnotif"="c:\program files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-10-13 186904]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-02 16395880]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-07 9636896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2011-07-13 171520]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2010-11-03 1580368]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-10-07 1744152]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851647&CUI=UN12416177020766219
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost localhost
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.220.1
TCP: Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: NameServer = 10.74.210.210 10.74.210.211
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{84FF7BD6-B47F-46F8-9130-01B2696B36CB} - (no file)
Wow6432Node-HKLM-Run-APSDaemon - c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Cisco Systems\VPN Client\cvpnd.exe
c:\programdata\Internet Manager\OnlineUpdate\ouc.exe
c:\program files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files (x86)\lotus\notes\ntmulti.exe
c:\windows\SysWOW64\NMSAccess32.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgr.exe
c:\program files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-04-19  13:28:14 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-04-19 11:28
.
Vor Suchlauf: 16 Verzeichnis(se), 171.032.596.480 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 170.338.271.232 Bytes frei
.
- - End Of File - - 5CA40C18DD7EE3FA42976A870D6C5B6E


--- --- ---
A36C5E4F47E84449FF07ED3517B43A31



Danke!!

schönen gruß

MM

schrauber 19.04.2014 19:45

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

TintenfischM 20.04.2014 00:00

Hallo,

alle Schritte wie empfohlen durchgeführt. Anbei die Files:

Code:


alwarebytes Anti-Malware
www.malwarebytes.org


Protection, 20.04.2014 00:20:43, SYSTEM, USER-VAIO, Protection, Malware Protection, Starting,
Protection, 20.04.2014 00:20:43, SYSTEM, USER-VAIO, Protection, Malware Protection, Started,
Protection, 20.04.2014 00:20:44, SYSTEM, USER-VAIO, Protection, Malicious Website Protection, Starting,
Protection, 20.04.2014 00:23:00, SYSTEM, USER-VAIO, Protection, Malicious Website Protection, Started,

(end)

AdwCleaner Logfile:
Code:

# AdwCleaner v3.100 - Bericht erstellt am 20/04/2014 um 00:34:32
# Aktualisiert 20/04/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : user - USER-VAIO
# Gestartet von : C:\Users\user\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files\Level Quality Watcher
Ordner Gelöscht : C:\users\user\AppData\Local\Conduit
Ordner Gelöscht : C:\users\user\AppData\Local\torch
Ordner Gelöscht : C:\users\user\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\users\user\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\users\user\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\users\user\AppData\Roaming\Systweak
Datei Gelöscht : C:\Windows\SysWOW64\conduitEngine.tmp
Datei Gelöscht : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\invalidprefs.js
Datei Gelöscht : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\user.js

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\leocdeigfnkaojcapikdjcdbedcjmffc
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IMinentToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IMinentToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\systweakasp_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEAutoUpdateHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEAutoUpdateHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEToolbarHelper_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\uTorrentBar_DEToolbarHelper_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5C255C8A-E604-49B4-9D64-90988571CECB}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2318C2B1-4965-11D4-9B18-009027A5CD4F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{83FF80F4-8C74-4B80-B5BA-C8DDD434E5C4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\systweak
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\BackgroundContainer
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\LevelQualityWatcher

***** [ Browser ] *****

-\\ Internet Explorer v8.0.7601.17514


-\\ Mozilla Firefox v

[ Datei : C:\users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultthis.engineName", "uTorrentBar_DE Customized Web Search");
Zeile gelöscht : user_pref("extensions.KwUfVmrNH7Mk.scode", "(function(){try{var url=(window.self.location.href + document.cookie);if(url.indexOf(\"acebook\")>-1||url.indexOf(\"txtlnkusaolp00000800\")>-1||url.indexOf([...]
Zeile gelöscht : user_pref("extensions.iminent.admin", false);
Zeile gelöscht : user_pref("extensions.iminent.aflt", "orgnl");
Zeile gelöscht : user_pref("extensions.iminent.appId", "{0E4B2CAB-B859-4C57-B96E-63DDEC692BC4}");
Zeile gelöscht : user_pref("extensions.iminent.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.iminent.cntry", "DE");
Zeile gelöscht : user_pref("extensions.iminent.dfltLng", "");
Zeile gelöscht : user_pref("extensions.iminent.excTlbr", false);
Zeile gelöscht : user_pref("extensions.iminent.ffxUnstlRst", false);
Zeile gelöscht : user_pref("extensions.iminent.hdrMd5", "33D76B67047C4D1E2AFCB555D64BACB0");
Zeile gelöscht : user_pref("extensions.iminent.id", "228e51a2000000000000002314087d29");
Zeile gelöscht : user_pref("extensions.iminent.instlDay", "16126");
Zeile gelöscht : user_pref("extensions.iminent.instlRef", "");
Zeile gelöscht : user_pref("extensions.iminent.lastVrsnTs", "1.8.28.320:27:24");
Zeile gelöscht : user_pref("extensions.iminent.newTab", false);
Zeile gelöscht : user_pref("extensions.iminent.prdct", "iminent");
Zeile gelöscht : user_pref("extensions.iminent.prtnrId", "iminent");
Zeile gelöscht : user_pref("extensions.iminent.rvrt", "false");
Zeile gelöscht : user_pref("extensions.iminent.sg", "none");
Zeile gelöscht : user_pref("extensions.iminent.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.iminent.tlbrId", "YBCPCSTIPO");
Zeile gelöscht : user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");
Zeile gelöscht : user_pref("extensions.iminent.vrsn", "1.8.28.3");
Zeile gelöscht : user_pref("extensions.iminent.vrsnTs", "1.8.28.320:27:24");
Zeile gelöscht : user_pref("extensions.iminent.vrsni", "1.8.28.3");

-\\ Google Chrome v

[ Datei : C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [7614 octets] - [20/04/2014 00:29:44]
AdwCleaner[S0].txt - [7069 octets] - [20/04/2014 00:34:32]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [7129 octets] ##########

--- --- ---

Code:


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by user on 20.04.2014 at  0:47:10,60
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.04.2014 at  0:54:42,00
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-04-2014
Ran by user (administrator) on USER-VAIO on 20-04-2014 00:49:30
Running from C:\Users\user\Desktop\Trojaner Board
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Thisisu) C:\Users\user\Desktop\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe
(Thisisu) C:\Users\user\Desktop\JRT.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.220.1
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default
FF SelectedSearchEngine: StartWeb
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Garmin Communicator - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-29]

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] ()
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [119512 2014-04-20] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-20 00:48 - 2014-04-20 00:48 - 00000624 _____ () C:\Users\user\Desktop\JRT.txt
2014-04-20 00:39 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 00:38 - 2014-04-20 00:39 - 01016261 _____ (Thisisu) C:\Users\user\Desktop\JRT.exe
2014-04-20 00:37 - 2014-04-20 00:37 - 00007217 _____ () C:\Users\user\Desktop\AdwCleaner[S0].txt
2014-04-20 00:29 - 2014-04-20 00:34 - 00000000 ____D () C:\AdwCleaner
2014-04-20 00:29 - 2014-04-20 00:29 - 01308369 _____ () C:\Users\user\Desktop\adwcleaner.exe
2014-04-19 23:42 - 2014-04-20 00:38 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-19 23:42 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-19 23:42 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-19 23:42 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-19 23:42 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-19 23:41 - 2014-04-19 23:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\user\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-19 13:28 - 2014-04-19 13:28 - 00046672 _____ () C:\ComboFix.txt
2014-04-19 12:36 - 2014-04-19 13:28 - 00000000 ____D () C:\ComboFix
2014-04-19 12:24 - 2014-04-19 13:28 - 00000000 ____D () C:\Qoobox
2014-04-19 12:24 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-19 12:24 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-19 12:24 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-19 12:23 - 2014-04-19 13:25 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 12:07 - 2014-04-19 12:33 - 02120212 _____ () C:\Users\user\Documents\spybot.pptx
2014-04-19 11:31 - 2014-04-19 11:31 - 00001234 _____ () C:\Users\user\Desktop\Revo Uninstaller.lnk
2014-04-19 11:31 - 2014-04-19 11:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-18 18:16 - 2014-04-18 18:16 - 00013590 _____ () C:\Users\user\Desktop\osteoporose DEXA 140418.enl
2014-04-18 18:16 - 2014-04-18 18:16 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140418.Data
2014-04-18 15:59 - 2014-04-18 15:59 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140410.Data
2014-04-18 14:02 - 2014-04-20 00:49 - 00000000 ____D () C:\FRST
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:53 - 2014-04-20 00:49 - 00000000 ____D () C:\Users\user\Desktop\Trojaner Board
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\smkits
2014-04-18 13:19 - 2014-04-18 14:41 - 03477429 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-13 15:29 - 2014-04-20 00:18 - 00082503 _____ () C:\Windows\IE10_main.log
2014-04-11 13:46 - 2014-04-20 00:19 - 00095610 _____ () C:\Windows\IE11_main.log
2014-04-11 11:14 - 2014-04-20 00:35 - 00001456 _____ () C:\Windows\setupact.log
2014-04-11 11:14 - 2014-04-20 00:20 - 00041706 _____ () C:\Windows\PFRO.log
2014-04-11 11:14 - 2014-04-11 11:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-11 11:09 - 2014-04-11 11:09 - 00000000 ____D () C:\Users\user\AppData\Roaming\TuneUp Software
2014-04-11 10:58 - 2014-04-11 14:00 - 00007622 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-04-10 09:31 - 2014-04-18 18:53 - 00085554 _____ () C:\Users\user\Desktop\osteoporose DEXA 140410.enl
2014-04-09 17:38 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 17:38 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 17:38 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 17:38 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 17:38 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 17:38 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 17:38 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 17:38 - 2014-02-24 04:35 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 12296192 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 09074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 02458112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 01495040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 11020800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 06041088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 01232896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-09 17:38 - 2014-02-24 03:34 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 17:38 - 2014-02-24 03:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 17:38 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 17:38 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 17:38 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 17:38 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 17:38 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 17:38 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-03-28 17:28 - 2014-03-28 17:28 - 00000880 _____ () C:\Users\user\Desktop\GIST.lnk
2014-03-28 13:54 - 2014-03-28 13:54 - 00283192 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 28.0.exe
2014-03-27 13:33 - 2014-03-27 13:33 - 00000742 _____ () C:\Users\user\Desktop\10WBC.lnk
2014-03-23 17:36 - 2014-03-23 17:36 - 00000985 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-03-23 11:28 - 2014-03-23 11:28 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLib64.sys

==================== One Month Modified Files and Folders =======

2014-04-20 00:49 - 2014-04-18 14:02 - 00000000 ____D () C:\FRST
2014-04-20 00:49 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\Desktop\Trojaner Board
2014-04-20 00:48 - 2014-04-20 00:48 - 00000624 _____ () C:\Users\user\Desktop\JRT.txt
2014-04-20 00:44 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-20 00:44 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-20 00:40 - 2011-07-13 15:15 - 01639923 _____ () C:\Windows\WindowsUpdate.log
2014-04-20 00:39 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 00:39 - 2014-04-20 00:38 - 01016261 _____ (Thisisu) C:\Users\user\Desktop\JRT.exe
2014-04-20 00:38 - 2014-04-19 23:42 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-20 00:37 - 2014-04-20 00:37 - 00007217 _____ () C:\Users\user\Desktop\AdwCleaner[S0].txt
2014-04-20 00:36 - 2012-11-26 13:52 - 00129562 _____ () C:\SUService.log
2014-04-20 00:35 - 2014-04-11 11:14 - 00001456 _____ () C:\Windows\setupact.log
2014-04-20 00:35 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-04-20 00:35 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-20 00:34 - 2014-04-20 00:29 - 00000000 ____D () C:\AdwCleaner
2014-04-20 00:29 - 2014-04-20 00:29 - 01308369 _____ () C:\Users\user\Desktop\adwcleaner.exe
2014-04-20 00:20 - 2014-04-11 11:14 - 00041706 _____ () C:\Windows\PFRO.log
2014-04-20 00:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\security
2014-04-20 00:19 - 2014-04-11 13:46 - 00095610 _____ () C:\Windows\IE11_main.log
2014-04-20 00:18 - 2014-04-13 15:29 - 00082503 _____ () C:\Windows\IE10_main.log
2014-04-20 00:01 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-19 23:59 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-04-19 23:42 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-19 23:41 - 2014-04-19 23:41 - 17305616 _____ (Malwarebytes Corporation ) C:\Users\user\Desktop\mbam-setup-2.0.1.1004.exe
2014-04-19 14:02 - 2009-07-14 04:34 - 00000609 _____ () C:\Windows\win.ini
2014-04-19 13:46 - 2014-02-25 21:27 - 60476358 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-04-19 13:28 - 2014-04-19 13:28 - 00046672 _____ () C:\ComboFix.txt
2014-04-19 13:28 - 2014-04-19 12:36 - 00000000 ____D () C:\ComboFix
2014-04-19 13:28 - 2014-04-19 12:24 - 00000000 ____D () C:\Qoobox
2014-04-19 13:25 - 2014-04-19 12:23 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 13:14 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-19 13:12 - 2014-02-25 21:28 - 00000000 ____D () C:\ProgramData\SaveClicker
2014-04-19 12:33 - 2014-04-19 12:07 - 02120212 _____ () C:\Users\user\Documents\spybot.pptx
2014-04-19 12:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-19 11:41 - 2014-02-25 21:28 - 00000000 ____D () C:\ProgramData\fdbc7c75d5d48b3d
2014-04-19 11:41 - 2014-02-25 21:28 - 00000000 ____D () C:\Program Files (x86)\SaveClicker
2014-04-19 11:31 - 2014-04-19 11:31 - 00001234 _____ () C:\Users\user\Desktop\Revo Uninstaller.lnk
2014-04-19 11:31 - 2014-04-19 11:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-19 10:22 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-04-18 18:53 - 2014-04-10 09:31 - 00085554 _____ () C:\Users\user\Desktop\osteoporose DEXA 140410.enl
2014-04-18 18:16 - 2014-04-18 18:16 - 00013590 _____ () C:\Users\user\Desktop\osteoporose DEXA 140418.enl
2014-04-18 18:16 - 2014-04-18 18:16 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140418.Data
2014-04-18 15:59 - 2014-04-18 15:59 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140410.Data
2014-04-18 15:00 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-18 15:00 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-18 15:00 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-18 14:41 - 2014-04-18 13:19 - 03477429 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\smkits
2014-04-11 15:14 - 2014-02-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-11 15:02 - 2011-07-28 20:01 - 00000000 ____D () C:\ProgramData\Apple
2014-04-11 14:59 - 2014-03-02 14:38 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-11 14:00 - 2014-04-11 10:58 - 00007622 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-04-11 11:14 - 2014-04-11 11:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-11 11:14 - 2011-07-13 15:19 - 00000000 ____D () C:\Program Files\Google
2014-04-11 11:14 - 2011-07-13 15:19 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-11 11:12 - 2011-09-07 11:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-11 11:12 - 2011-07-25 21:13 - 00000000 ____D () C:\Windows\Minidump
2014-04-11 11:09 - 2014-04-11 11:09 - 00000000 ____D () C:\Users\user\AppData\Roaming\TuneUp Software
2014-04-11 11:00 - 2011-07-25 20:55 - 00000000 ____D () C:\Users\user\AppData\Local\Google
2014-04-11 11:00 - 2011-07-13 15:19 - 00000000 ____D () C:\ProgramData\Google
2014-04-10 10:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-09 19:48 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 19:48 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 19:44 - 2011-08-21 19:51 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-03 09:51 - 2014-04-19 23:42 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-19 23:42 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-19 23:42 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 09:35 - 2011-07-27 21:52 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 17:28 - 2014-03-28 17:28 - 00000880 _____ () C:\Users\user\Desktop\GIST.lnk
2014-03-28 13:54 - 2014-03-28 13:54 - 00283192 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 28.0.exe
2014-03-27 20:54 - 2011-07-27 21:19 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315
2014-03-27 20:54 - 2011-07-27 21:19 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26
2014-03-27 13:33 - 2014-03-27 13:33 - 00000742 _____ () C:\Users\user\Desktop\10WBC.lnk
2014-03-27 09:58 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-23 17:36 - 2014-03-23 17:36 - 00000985 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-03-23 11:28 - 2014-03-23 11:28 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLib64.sys

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 10:52

==================== End Of Log ============================

--- --- ---

[CODE]






Sollte ich eigentlich AVIRA nochmal einschalten versuchen? Gestern ließ es sich nicht einschalten.
Und die Meldungen von Spybot-Search&Destroy? Sind die relevant?


Danke 100000x für die Hilfe!!!

Gruß

MM

schrauber 20.04.2014 18:16


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

TintenfischM 21.04.2014 17:22

Hallo,

anbei ESET-Log-File.

Code:


ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=1a35e0a1dd58af4fa9eda87c1889b14d
# engine=17961
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-04-20 09:17:56
# local_time=2014-04-20 11:17:56 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 94 12939 168699981 5711 0
# compatibility_mode=5893 16776573 100 94 49067 149658526 0 0
# scanned=593108
# found=2
# cleaned=0
# scan_time=11127
sh=6205DDE47C041E3B67EFC540F89F24344835EE11 ft=0 fh=0000000000000000 vn="Win32/AdWare.Adpeak.B application" ac=I fn="C:\Temp\t.msi"
sh=C7B993C5A5063247674161856C7C75D657A3DB1C ft=0 fh=0000000000000000 vn="WMA/TrojanDownloader.GetCodec.C trojan" ac=I fn="G:\music_bob\house party\niki belucci get up.mp3"


Schönen Gruß

Gleich kommt der nächste...

also, SecurityCheck konnte ich leider nicht von der FilePonySeite downloaden, habe es auch mehrmals versucht...


gruß

mm

Hi,

eine ältere Version von SecurityCheck ging doch...
Hier die Lo

Code:


 Results of screen317's Security Check version 0.99.81 
 Windows 7 Service Pack 1 x64 
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Spybot - Search & Destroy
 Adobe Flash Player 10 Flash Player out of Date!















 Adobe Flash Player 12.0.0.77 
 Adobe Reader 10.1.9 Adobe Reader out of Date! 
````````Process Check: objlist.exe by Laurent```````` 
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

Und ein frisches FRST:



FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-04-2014 02
Ran by user (administrator) on USER-VAIO on 21-04-2014 14:51:54
Running from C:\Users\user\Desktop\Trojaner Board
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Windows\system32\UI0Detect.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\Program Files (x86)\T-Mobile\InternetManager_H\Internet Manager.exe
(Adobe Systems, Inc.) C:\Windows\SysWow64\Macromed\Flash\FlashUtil10c.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851647&CUI=UN12416177020766219
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default
FF SelectedSearchEngine: StartWeb
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Garmin Communicator - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-29]

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] ()
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-04-21] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-21 14:46 - 2014-04-21 14:46 - 00000879 _____ () C:\Users\user\Desktop\checkup.txt
2014-04-21 14:45 - 2014-04-21 14:45 - 00987448 _____ () C:\Users\user\Desktop\SecurityCheck.exe
2014-04-21 14:44 - 2014-04-21 14:44 - 00039985 _____ () C:\Users\user\Desktop\download-securitycheck.htm
2014-04-20 00:39 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 00:29 - 2014-04-20 00:34 - 00000000 ____D () C:\AdwCleaner
2014-04-19 23:42 - 2014-04-21 14:36 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-19 23:42 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-19 23:42 - 2014-04-03 09:51 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-19 23:42 - 2014-04-03 09:51 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-19 23:42 - 2014-04-03 09:50 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-19 13:28 - 2014-04-19 13:28 - 00046672 _____ () C:\ComboFix.txt
2014-04-19 12:36 - 2014-04-19 13:28 - 00000000 ____D () C:\ComboFix
2014-04-19 12:24 - 2014-04-19 13:28 - 00000000 ____D () C:\Qoobox
2014-04-19 12:24 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-04-19 12:24 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-04-19 12:24 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-04-19 12:24 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-04-19 12:23 - 2014-04-19 13:25 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 12:07 - 2014-04-19 12:33 - 02120212 _____ () C:\Users\user\Documents\spybot.pptx
2014-04-19 11:31 - 2014-04-19 11:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-18 18:16 - 2014-04-18 18:16 - 00013590 _____ () C:\Users\user\Desktop\osteoporose DEXA 140418.enl
2014-04-18 18:16 - 2014-04-18 18:16 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140418.Data
2014-04-18 15:59 - 2014-04-18 15:59 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140410.Data
2014-04-18 14:02 - 2014-04-21 14:51 - 00000000 ____D () C:\FRST
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:53 - 2014-04-21 14:51 - 00000000 ____D () C:\Users\user\Desktop\Trojaner Board
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\smkits
2014-04-18 13:19 - 2014-04-18 14:41 - 03477429 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-13 15:29 - 2014-04-20 23:53 - 00096136 _____ () C:\Windows\IE10_main.log
2014-04-11 13:46 - 2014-04-20 23:54 - 00110194 _____ () C:\Windows\IE11_main.log
2014-04-11 11:14 - 2014-04-21 14:34 - 00042540 _____ () C:\Windows\PFRO.log
2014-04-11 11:14 - 2014-04-21 14:34 - 00001624 _____ () C:\Windows\setupact.log
2014-04-11 11:14 - 2014-04-11 11:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-11 11:09 - 2014-04-11 11:09 - 00000000 ____D () C:\Users\user\AppData\Roaming\TuneUp Software
2014-04-11 10:58 - 2014-04-11 14:00 - 00007622 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-04-10 09:31 - 2014-04-20 19:56 - 00087970 _____ () C:\Users\user\Desktop\osteoporose DEXA 140410.enl
2014-04-09 17:38 - 2014-03-04 11:44 - 01163264 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2014-04-09 17:38 - 2014-03-04 11:44 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2014-04-09 17:38 - 2014-03-04 11:17 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-04-09 17:38 - 2014-03-04 11:16 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-04-09 17:38 - 2014-03-04 11:16 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-04-09 17:38 - 2014-03-04 11:16 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-04-09 17:38 - 2014-03-04 10:09 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-04-09 17:38 - 2014-03-04 10:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-04-09 17:38 - 2014-02-24 04:35 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 12296192 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 09074688 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 02458112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 01495040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-04-09 17:38 - 2014-02-24 04:34 - 00064512 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 11020800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 06041088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 01232896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-04-09 17:38 - 2014-02-24 04:05 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-04-09 17:38 - 2014-02-24 03:34 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-04-09 17:38 - 2014-02-24 03:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-04-09 17:38 - 2014-02-04 04:35 - 00274880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msiscsi.sys
2014-04-09 17:38 - 2014-02-04 04:35 - 00190912 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\storport.sys
2014-04-09 17:38 - 2014-02-04 04:35 - 00027584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Diskdump.sys
2014-04-09 17:38 - 2014-02-04 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\iologmsg.dll
2014-04-09 17:38 - 2014-02-04 04:00 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iologmsg.dll
2014-04-09 17:38 - 2014-01-24 04:37 - 01684928 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-03-28 17:28 - 2014-03-28 17:28 - 00000880 _____ () C:\Users\user\Desktop\GIST.lnk
2014-03-28 13:54 - 2014-03-28 13:54 - 00283192 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 28.0.exe
2014-03-27 13:33 - 2014-03-27 13:33 - 00000742 _____ () C:\Users\user\Desktop\10WBC.lnk
2014-03-23 17:36 - 2014-03-23 17:36 - 00000985 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-03-23 11:28 - 2014-03-23 11:28 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLib64.sys

==================== One Month Modified Files and Folders =======

2014-04-21 14:51 - 2014-04-18 14:02 - 00000000 ____D () C:\FRST
2014-04-21 14:51 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\Desktop\Trojaner Board
2014-04-21 14:46 - 2014-04-21 14:46 - 00000879 _____ () C:\Users\user\Desktop\checkup.txt
2014-04-21 14:45 - 2014-04-21 14:45 - 00987448 _____ () C:\Users\user\Desktop\SecurityCheck.exe
2014-04-21 14:44 - 2014-04-21 14:44 - 00039985 _____ () C:\Users\user\Desktop\download-securitycheck.htm
2014-04-21 14:42 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-04-21 14:42 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-04-21 14:41 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-04-21 14:41 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-04-21 14:41 - 2011-07-13 15:15 - 01758284 _____ () C:\Windows\WindowsUpdate.log
2014-04-21 14:41 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-04-21 14:40 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-04-21 14:36 - 2014-04-19 23:42 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-21 14:34 - 2014-04-11 11:14 - 00042540 _____ () C:\Windows\PFRO.log
2014-04-21 14:34 - 2014-04-11 11:14 - 00001624 _____ () C:\Windows\setupact.log
2014-04-21 14:34 - 2012-11-26 13:52 - 00130882 _____ () C:\SUService.log
2014-04-21 14:34 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-04-21 14:34 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-04-20 23:54 - 2014-04-11 13:46 - 00110194 _____ () C:\Windows\IE11_main.log
2014-04-20 23:53 - 2014-04-13 15:29 - 00096136 _____ () C:\Windows\IE10_main.log
2014-04-20 23:01 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-04-20 22:59 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-04-20 19:56 - 2014-04-10 09:31 - 00087970 _____ () C:\Users\user\Desktop\osteoporose DEXA 140410.enl
2014-04-20 00:39 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-04-20 00:34 - 2014-04-20 00:29 - 00000000 ____D () C:\AdwCleaner
2014-04-20 00:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\security
2014-04-19 23:42 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-19 14:02 - 2009-07-14 04:34 - 00000609 _____ () C:\Windows\win.ini
2014-04-19 13:46 - 2014-02-25 21:27 - 60476358 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-04-19 13:28 - 2014-04-19 13:28 - 00046672 _____ () C:\ComboFix.txt
2014-04-19 13:28 - 2014-04-19 12:36 - 00000000 ____D () C:\ComboFix
2014-04-19 13:28 - 2014-04-19 12:24 - 00000000 ____D () C:\Qoobox
2014-04-19 13:25 - 2014-04-19 12:23 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 13:14 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-19 13:12 - 2014-02-25 21:28 - 00000000 ____D () C:\ProgramData\SaveClicker
2014-04-19 12:33 - 2014-04-19 12:07 - 02120212 _____ () C:\Users\user\Documents\spybot.pptx
2014-04-19 12:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-19 11:41 - 2014-02-25 21:28 - 00000000 ____D () C:\ProgramData\fdbc7c75d5d48b3d
2014-04-19 11:41 - 2014-02-25 21:28 - 00000000 ____D () C:\Program Files (x86)\SaveClicker
2014-04-19 11:31 - 2014-04-19 11:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-18 18:16 - 2014-04-18 18:16 - 00013590 _____ () C:\Users\user\Desktop\osteoporose DEXA 140418.enl
2014-04-18 18:16 - 2014-04-18 18:16 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140418.Data
2014-04-18 15:59 - 2014-04-18 15:59 - 00000000 ____D () C:\Users\user\Desktop\osteoporose DEXA 140410.Data
2014-04-18 14:41 - 2014-04-18 13:19 - 03477429 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:53 - 2014-04-18 13:53 - 00000000 ____D () C:\Users\user\AppData\Roaming\smkits
2014-04-11 15:14 - 2014-02-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-04-11 15:02 - 2011-07-28 20:01 - 00000000 ____D () C:\ProgramData\Apple
2014-04-11 14:59 - 2014-03-02 14:38 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-11 14:00 - 2014-04-11 10:58 - 00007622 _____ () C:\Users\user\AppData\Local\Resmon.ResmonCfg
2014-04-11 11:14 - 2014-04-11 11:14 - 00000000 _____ () C:\Windows\setuperr.log
2014-04-11 11:14 - 2011-07-13 15:19 - 00000000 ____D () C:\Program Files\Google
2014-04-11 11:14 - 2011-07-13 15:19 - 00000000 ____D () C:\Program Files (x86)\Google
2014-04-11 11:12 - 2011-09-07 11:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-04-11 11:12 - 2011-07-25 21:13 - 00000000 ____D () C:\Windows\Minidump
2014-04-11 11:09 - 2014-04-11 11:09 - 00000000 ____D () C:\Users\user\AppData\Roaming\TuneUp Software
2014-04-11 11:00 - 2011-07-25 20:55 - 00000000 ____D () C:\Users\user\AppData\Local\Google
2014-04-11 11:00 - 2011-07-13 15:19 - 00000000 ____D () C:\ProgramData\Google
2014-04-10 10:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-04-09 19:48 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-04-09 19:48 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-04-09 19:44 - 2011-08-21 19:51 - 90655440 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-04-03 09:51 - 2014-04-19 23:42 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-03 09:51 - 2014-04-19 23:42 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-03 09:50 - 2014-04-19 23:42 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-03-31 09:35 - 2011-07-27 21:52 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-03-28 17:28 - 2014-03-28 17:28 - 00000880 _____ () C:\Users\user\Desktop\GIST.lnk
2014-03-28 13:54 - 2014-03-28 13:54 - 00283192 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 28.0.exe
2014-03-27 20:54 - 2011-07-27 21:19 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315
2014-03-27 20:54 - 2011-07-27 21:19 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26
2014-03-27 13:33 - 2014-03-27 13:33 - 00000742 _____ () C:\Users\user\Desktop\10WBC.lnk
2014-03-27 09:58 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-23 17:36 - 2014-03-23 17:36 - 00000985 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-03-23 11:28 - 2014-03-23 11:28 - 00061112 _____ (StdLib) C:\Windows\system32\Drivers\wStLib64.sys

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-04-19 10:52

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

[/CODE]


Es ist viel besser geworden alles. Danke!!!!
Kann ich mich denn trauen, Firefox oder GoogleChrome neu zu installieren?
Und was mache ich mit den Meldungen von SpyBot, die hartnäckig weiter auftauchen?

:dankeschoen:

MM

Hi again :crazy:

Also, was Internet angeht, ist alles gut. Es öffnen sich keine zusätzlichen Fenster und Tabs mehr, wie es war, und es lässt sich gut arbeiten. Ein Traum !!!
Ein kleines (hoffentlich kleines:)) Problem habe ich noch... Seit gestern, seitdem ich ESET laufen ließ, oder zumindest gefühlt seither, lassen sich alle Word-, Excel- und ppt-Dateien extrem langsam öffnen, auch mein Memory Stick, oder der Arbeitsplatz..als würden diese nicht so schnell reagieren können.. Hängt das eventuell mit den durchgeführten Scans zusammen?

danke !!!

gruß

MM

schrauber 22.04.2014 13:29

Unwarscheinlich. Deaktiviere mal dein AV Programm und reboote, teste nochmal. Was genau meldet Spybot?

TintenfischM 22.04.2014 16:44

Hello again,

Nach mehrfachem Neustart funktioniert gerade alles wieder. Die letzten 2 Male ist auch keine Spybot Meldung mehr aufgetaucht :)
Danke tausend Dank für die Hilfe!!
Wüsste nicht, was ich sonst gemacht hätte..

:dankeschön:

schrauber 22.04.2014 19:27

Flash und ADobe updaten.


Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

TintenfischM 11.05.2014 17:57

Lieber Schrauber,

nach einigen Wochen Ruhe ist ein ähnliches Problem aufgetreten, auch wenn etwas anders. Diesmal werden viele kleine Werbungsfenster in dem Fenster, wo ich gerade arbeite, geöffnet. Dadurch ist auch Internet langsamer geworden.
Könntest Du eventuell was dagegen machen?

Das wäre ganz ganz toll...

Schönen Gruß

MM

schrauber 12.05.2014 13:53

In welchem browser?

TintenfischM 12.05.2014 18:26

Im Internet Explorer.
Ich habe zwischendurch versucht, Firefox zu installieren, da kommt aber immer eine Fehlermeldung, dass ich keine Administratorrechte hätte, obwohl ich nichts geändert hatte. Und wenn ich es versuche, Firefox als User zu installieren, passiert gar nichts.
Also, doch noch was übles da?

Gruß,

MM

schrauber 13.05.2014 13:38

Setze folgendermassen den Internet Explorer zurück:
  • Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
  • Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
  • Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.
(Hier findest du die bebilderte Anleitung.)


mach von der Meldung bei der FF Installation bitte mal einen Screenshot und hänge ihn hier an.

TintenfischM 13.05.2014 20:12

Liste der Anhänge anzeigen (Anzahl: 1)
Hier der Screenshot...

Mehr kam nicht..

Gruß

MM

TintenfischM 13.05.2014 20:37

Ich weiß nicht, was mit FF Installation gemeint ist, aber ich habe nicht gesehen, dass was installiert wurde..

schrauber 14.05.2014 19:14

Du willst doch Firefox installieren, und das klappt nicht mit ner Meldung wegen Adminrechten. Von der Meldung bitte einen Screenshot :)

TintenfischM 14.05.2014 20:41

Hey,

habe jetzt wieder probiert und es ging :) juhu!!

Allerdings die kleinen Werungsfensterchen in dem Arbeitsfesnter sind noch da.

Gruß,

MM

schrauber 15.05.2014 19:29

Zitat:

Allerdings die kleinen Werungsfensterchen in dem Arbeitsfesnter sind noch da.
Ehm, versteh ich nit.Sorry :)

TintenfischM 15.05.2014 21:31

Liste der Anhänge anzeigen (Anzahl: 1)
Also, es sollte heißen, die kleinen Werbespots erscheinen ständig am Rand im Fenster, das ich mir gerade anschaue, z.B. Werbung für Kleider, Schuhe, usw. ohne ENDE!
Ich habe ein Screenshot gemacht, den ich hier anhänge.

Gruß,

Anhang 66954

MM

schrauber 16.05.2014 12:50

Poste mal bitte ein frisches FRST log. Aber das ist das Blöde am IE, weil es keinen Adblocker gibt.

TintenfischM 16.05.2014 18:30

Hallo :)

dasselbe gilt auch für firefox, nicht nur für IE, die Werbespots tauchen auch da auf ...


FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-05-2014
Ran by user (administrator) on USER-VAIO on 16-05-2014 19:26:36
Running from C:\Users\user\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851647&CUI=UN12416177020766219
URLSearchHook: HKCU - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.220.1
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default
FF SelectedSearchEngine: StartWeb
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Garmin Communicator - C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\lhhhdl93.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} [2013-11-29]

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] ()
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-16] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-16 19:26 - 2014-05-16 19:27 - 00017271 _____ () C:\Users\user\Desktop\FRST.txt
2014-05-16 19:26 - 2014-05-16 19:26 - 02067456 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-05-16 19:26 - 2014-05-16 19:26 - 00000000 ____D () C:\FRST
2014-05-15 22:16 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 22:16 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 22:16 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 22:16 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 22:15 - 2014-05-05 21:20 - 09073664 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:15 - 2014-05-05 21:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:15 - 2014-05-05 20:39 - 06041600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:15 - 2014-05-05 20:39 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 22:15 - 2014-05-05 18:28 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:15 - 2014-05-05 17:50 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:15 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 22:15 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 22:15 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 22:15 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 22:15 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 22:15 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 22:15 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 22:15 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 22:15 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 22:15 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 22:15 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 22:15 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 22:15 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 21:34 - 2014-05-14 21:34 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 21:33 - 2014-05-14 21:34 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:33 - 2014-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:32 - 2014-05-14 21:33 - 00283144 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 29.0.1.exe
2014-05-11 19:10 - 2014-05-11 19:12 - 00002230 _____ () C:\DelFix.txt
2014-05-11 19:01 - 2014-05-11 19:01 - 00283144 _____ (Mozilla) C:\Users\user\Firefox Setup Stub 29.0.1.exe
2014-05-11 16:18 - 2014-05-11 19:04 - 00173470 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-05-11 16:18 - 2014-05-11 16:19 - 00000000 ____D () C:\Users\user\Desktop\EndNote_HIFU.Data
2014-05-11 12:23 - 2014-05-11 12:39 - 00835072 _____ () C:\Users\user\Desktop\Erste HIFU-Therapie in Bonn b.pptx.ppt
2014-05-07 03:02 - 2014-05-16 19:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 18:46 - 2014-05-05 18:46 - 17305528 _____ (Malwarebytes Corporation ) C:\mbam_premium.exe
2014-05-03 15:47 - 2014-05-03 15:47 - 00000000 ____D () C:\Users\user\Desktop\BPaper_Endnote.Data
2014-04-30 08:29 - 2014-04-30 08:30 - 00000548 _____ () C:\Windows\LkmdfCoInst.log
2014-04-23 18:42 - 2014-04-23 18:42 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-23 18:42 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-23 18:42 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\Program Files\iTunes
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-23 18:41 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iPod
2014-04-23 18:39 - 2014-04-23 18:39 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-23 18:33 - 2014-04-23 18:33 - 148885840 _____ (Apple Inc.) C:\Users\user\iTunes64Setup.exe
2014-04-22 10:46 - 2014-05-01 17:22 - 00100906 _____ () C:\Users\user\Desktop\BPaper_Endnote.enl
2014-04-20 00:39 - 2014-05-11 19:10 - 00000000 ____D () C:\Windows\ERUNT
2014-04-19 23:42 - 2014-05-16 19:08 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-04-19 23:42 - 2014-05-05 18:47 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-04-19 23:42 - 2014-05-05 18:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-04-19 23:42 - 2014-05-05 18:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-19 23:42 - 2014-04-03 10:47 - 00088280 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-04-19 23:42 - 2014-04-03 10:47 - 00063192 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-04-19 23:42 - 2014-04-03 10:47 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-04-19 12:23 - 2014-04-19 13:25 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 12:07 - 2014-04-19 12:33 - 02120212 _____ () C:\Users\user\Documents\spybot.pptx
2014-04-19 11:31 - 2014-04-19 11:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable
2014-04-18 13:53 - 2014-04-21 15:02 - 00000000 ____D () C:\Trojaner Board
2014-04-18 13:19 - 2014-04-18 14:41 - 03477429 _____ () C:\Users\user\Documents\popups2.pptx

==================== One Month Modified Files and Folders =======

2014-05-16 19:27 - 2014-05-16 19:26 - 00017271 _____ () C:\Users\user\Desktop\FRST.txt
2014-05-16 19:26 - 2014-05-16 19:26 - 02067456 _____ (Farbar) C:\Users\user\Desktop\FRST64.exe
2014-05-16 19:26 - 2014-05-16 19:26 - 00000000 ____D () C:\FRST
2014-05-16 19:15 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-16 19:15 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-16 19:14 - 2011-07-13 15:15 - 01468599 _____ () C:\Windows\WindowsUpdate.log
2014-05-16 19:10 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-05-16 19:08 - 2014-04-19 23:42 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-16 19:08 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 19:06 - 2012-11-26 13:52 - 00147390 _____ () C:\SUService.log
2014-05-16 19:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-16 19:05 - 2014-04-11 11:14 - 00005980 _____ () C:\Windows\setupact.log
2014-05-16 19:04 - 2014-05-07 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:42 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 22:41 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:40 - 2011-08-21 19:51 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 22:05 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-05-15 22:01 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-14 21:34 - 2014-05-14 21:34 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 21:34 - 2014-05-14 21:33 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:34 - 2014-02-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-14 21:33 - 2014-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:33 - 2014-05-14 21:32 - 00283144 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 29.0.1.exe
2014-05-14 21:31 - 2012-06-12 12:19 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 09:01 - 2012-06-01 16:25 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 09:01 - 2012-06-01 16:25 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:01 - 2012-06-01 16:25 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-13 10:02 - 2014-04-11 13:46 - 00337889 _____ () C:\Windows\IE11_main.log
2014-05-11 19:12 - 2014-05-11 19:10 - 00002230 _____ () C:\DelFix.txt
2014-05-11 19:10 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-05-11 19:04 - 2014-05-11 16:18 - 00173470 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-05-11 19:01 - 2014-05-11 19:01 - 00283144 _____ (Mozilla) C:\Users\user\Firefox Setup Stub 29.0.1.exe
2014-05-11 16:19 - 2014-05-11 16:18 - 00000000 ____D () C:\Users\user\Desktop\EndNote_HIFU.Data
2014-05-11 12:39 - 2014-05-11 12:23 - 00835072 _____ () C:\Users\user\Desktop\Erste HIFU-Therapie in Bonn b.pptx.ppt
2014-05-10 21:00 - 2011-07-27 21:19 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315
2014-05-10 21:00 - 2011-07-27 21:19 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26
2014-05-10 16:03 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-05-10 16:03 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-05-10 16:03 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-09 08:14 - 2014-05-15 22:16 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 22:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-05 21:20 - 2014-05-15 22:15 - 09073664 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 21:20 - 2014-05-15 22:15 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 20:39 - 2014-05-15 22:15 - 06041600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 20:39 - 2014-05-15 22:15 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 18:47 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-05 18:47 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-05 18:47 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-05 18:46 - 2014-05-05 18:46 - 17305528 _____ (Malwarebytes Corporation ) C:\mbam_premium.exe
2014-05-05 18:28 - 2014-05-15 22:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 17:50 - 2014-05-15 22:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-03 15:47 - 2014-05-03 15:47 - 00000000 ____D () C:\Users\user\Desktop\BPaper_Endnote.Data
2014-05-01 17:22 - 2014-04-22 10:46 - 00100906 _____ () C:\Users\user\Desktop\BPaper_Endnote.enl
2014-04-30 08:30 - 2014-04-30 08:29 - 00000548 _____ () C:\Windows\LkmdfCoInst.log
2014-04-30 08:29 - 2012-03-11 17:04 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2014-04-23 18:42 - 2014-04-23 18:42 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-23 18:42 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iTunes
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-23 18:41 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iPod
2014-04-23 18:39 - 2014-04-23 18:39 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-23 18:34 - 2011-07-28 20:01 - 00000000 ____D () C:\ProgramData\Apple
2014-04-23 18:33 - 2014-04-23 18:33 - 148885840 _____ (Apple Inc.) C:\Users\user\iTunes64Setup.exe
2014-04-22 22:45 - 2014-04-13 15:29 - 00121221 _____ () C:\Windows\IE10_main.log
2014-04-21 15:02 - 2014-04-18 13:53 - 00000000 ____D () C:\Trojaner Board
2014-04-21 14:34 - 2014-04-11 11:14 - 00042540 _____ () C:\Windows\PFRO.log
2014-04-20 00:20 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\security
2014-04-19 23:42 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-04-19 14:02 - 2009-07-14 04:34 - 00000609 _____ () C:\Windows\win.ini
2014-04-19 13:46 - 2014-02-25 21:27 - 60476358 _____ () C:\Windows\system32\SavingsBullFilterService.log
2014-04-19 13:25 - 2014-04-19 12:23 - 00000000 ____D () C:\Windows\erdnt
2014-04-19 13:14 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-04-19 13:12 - 2014-02-25 21:28 - 00000000 ____D () C:\ProgramData\SaveClicker
2014-04-19 12:44 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-04-19 12:33 - 2014-04-19 12:07 - 02120212 _____ () C:\Users\user\Documents\spybot.pptx
2014-04-19 12:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-04-19 11:41 - 2014-02-25 21:28 - 00000000 ____D () C:\ProgramData\fdbc7c75d5d48b3d
2014-04-19 11:41 - 2014-02-25 21:28 - 00000000 ____D () C:\Program Files (x86)\SaveClicker
2014-04-19 11:31 - 2014-04-19 11:31 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-04-18 14:41 - 2014-04-18 13:19 - 03477429 _____ () C:\Users\user\Documents\popups2.pptx
2014-04-18 13:59 - 2014-04-18 13:59 - 00000000 _____ () C:\Users\user\defogger_reenable

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe
C:\Users\user\Firefox Setup Stub 29.0.1.exe
C:\Users\user\iTunes64Setup.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 22:15] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-09 14:07

==================== End Of Log ============================

--- --- ---


Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-05-2014
Ran by user at 2014-05-16 19:27:28
Running from C:\Users\user\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.0.0 - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - ALPS ELECTRIC CO., LTD.)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{7BB90344-0647-468E-925A-7F69F7983421}) (Version: 2.0.1.85 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.193 - ArcSoft)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Berkeley Madonna (HKLM-x32\...\{27AB9BD6-4A3E-4BBD-8381-CD445E474936}) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BS.Player FREE powered by AdVantage (HKLM-x32\...\BSPlayerf) (Version: 2.28.964 - Webteh, d.o.o.)
BS.Player PRO (HKLM-x32\...\BSPlayerp) (Version: 2.53.1034 - Webteh, d.o.o.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.109 - Corel Inc.)
Einstellungen für VAIO-Inhaltsüberwachung (HKLM-x32\...\{23825B69-36DF-4DAD-9CFD-118D11D80F16}) (Version: 2.4.1.09180 - Sony Corporation)
EndNote X5 (HKLM-x32\...\{86B3F2D6-AC2B-0015-8AE1-F2F77F781B0C}) (Version: 15.0.0.5478 - Thomson Reuters)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.0.545 - Evernote Corp.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{CCAFF072-4DDB-4846-963D-15F02A8E9472}) (Version: 13.00.0000 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.00.1030 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Internet Manager (HKLM-x32\...\Internet Manager) (Version: 22.001.18.74.55 - Huawei Technologies Co.,Ltd)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java(TM) 6 Update 16 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416016FF}) (Version: 6.0.160 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Lotus Notes 8.5.3 de (HKLM-x32\...\{122A716C-63AD-4F73-BDCD-309F0A799C91}) (Version: 8.53.11286 - IBM)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.1.0.10210 - Sony Corporation)
Media Gallery (x32 Version: 1.1.0.10210 - Sony Corporation) Hidden
mediscript Hammerexamen (HKLM-x32\...\{1231D46E-3174-4F1F-859E-41DCB0D070D2}) (Version: 5.0.0 - Elsevier GmbH)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 x64 English (HKLM\...\{F83779DF-E1F5-43A2-A7BE-732F856FADB7}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MusicStation (HKLM-x32\...\{AB259D46-F851-41B0-9AFA-AED8998AD68A}) (Version: 2.0.0.1067 - Omnifone)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.9 - NVIDIA Corporation)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.0.00.10260 - Sony Corporation)
PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{88C252C8-A7EE-4B60-BF74-8E5919A8048F}) (Version: 1.0.00.09250 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.0.00.09250 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (Click to Disc) (HKLM-x32\...\InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}) (Version: 3.0.01.11230 - Sony Corporation)
PMB VAIO Edition plug-in (Click to Disc) (x32 Version: 3.0.01.11230 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Image Optimizer) (HKLM-x32\...\InstallShield_{1873FFC1-FDCB-47E1-B7C7-F418211E3530}) (Version: 1.0.00.10150 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Image Optimizer) (x32 Version: 1.0.00.10150 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Movie Story) (HKLM-x32\...\InstallShield_{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}) (Version: 2.2.00.15250 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Movie Story) (x32 Version: 2.2.00.15250 - Sony Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5992 - Realtek Semiconductor Corp.)
ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version:  - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roxio Central Audio (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Copy (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Core (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Data (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Tools (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Easy Media Creator 10 LJ (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio)
Roxio Easy Media Creator Home (x32 Version: 10.3.183 - Roxio) Hidden
Setting Utility Series (HKLM-x32\...\{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}) (Version: 5.1.0.11200 - Sony Corporation)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sony Home Network Library (HKLM-x32\...\{D03D02D8-AB64-4785-A48E-5AA8B0FB8C14}) (Version: 2.0.1.10160 - Sony Corporation)
Sony Home Network Library (x32 Version: 2.0.1.10160 - Sony Corporation) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 5.0.3.11130 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (HKLM-x32\...\{4882EBF5-CA37-4EF4-BCB8-9B0E78B907D0}) (Version: 3.6.0.09250 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (x32 Version: 3.6.0.09250 - Sony Corporation) Hidden
VAIO Content Metadata Intelligent Network Service Manager (HKLM-x32\...\{4427F384-B5BE-4769-B7D0-C784FC321EB1}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata Intelligent Network Service Manager (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Metadata Manager Settings (HKLM-x32\...\{12D0BE8D-538C-4AB1-86DE-C540308F50DA}) (Version: 3.6.0.09240 - Sony Corporation)
VAIO Content Metadata Manager Settings (x32 Version: 3.6.0.09240 - Sony Corporation) Hidden
VAIO Content Metadata XML Interface Library (HKLM-x32\...\{291FB4BF-EEC7-4CF9-8469-F39ED1DBC4D8}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata XML Interface Library (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Monitoring Settings (x32 Version: 2.4.1.09180 - Sony Corporation) Hidden
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.1.0.10160 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.2.0.09150 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.2.0.09150 - Sony Corporation) Hidden
VAIO DVD Menu Data (HKLM-x32\...\{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}) (Version: 2.0.00.10130 - Sony Corporation)
VAIO Energie Verwaltung (HKLM-x32\...\{803E4FA5-A940-4420-B89D-A8BC2E160247}) (Version: 5.0.0.11300 - Sony Corporation)
VAIO Entertainment Platform (HKLM-x32\...\{6B1F20F2-6321-4669-A58C-33DF8E7517FF}) (Version: 3.6.0.09150 - Sony Corporation)
VAIO Entertainment Platform (x32 Version: 3.6.0.09150 - Sony Corporation) Hidden
VAIO Event Service (HKLM-x32\...\{C7477742-DDB4-43E5-AC8D-0259E1E661B1}) (Version: 5.1.0.11300 - Sony Corporation)
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 1.2.0.09240 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 1.0.0.10290 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 3.9.1 - Sony Corporation) Hidden
VAIO Marketing Tools (HKLM-x32\...\MarketingTools) (Version:  - Sony Corporation)
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.0.1.10160 - Sony Corporation)
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 1.2.0.09100 - Sony Corporation)
VAIO Movie Story MergeModules x64 (Version: 1.0.14240 - Sony Corporation) Hidden
VAIO Movie Story Template Data (HKLM-x32\...\InstallShield_{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}) (Version: 2.2.00.15250 - Sony Corporation)
VAIO Movie Story Template Data (x32 Version: 2.0.00.09240 - Sony Corporation) Hidden
VAIO Original Function Settings (x32 Version: 2.0.0.07010 - Sony Corporation) Hidden
VAIO Original Funktion Einstellungen (HKLM-x32\...\{A63E7492-A0BC-4BB9-89A7-352965222380}) (Version: 2.0.0.07010 - Sony Corporation)
VAIO Personalization Manager (HKLM-x32\...\{A95187EF-BCF4-4468-B501-C0BAB976ADD1}) (Version: 2.0.0.06220 - Sony Corporation)
VAIO Personalization Manager (x32 Version: 2.0.0.06220 - Sony Corporation) Hidden
VAIO Premium Partners (HKLM-x32\...\VAIO Premium Partners) (Version: 1.0 - Sony Europe)
VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.1.0.11250 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 6.1.1.10250 - Sony Corporation)
VAIO Wallpaper Contents (HKLM-x32\...\{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}) (Version: 2.0.0.06010 - Sony Corporation)
VAIO Window Organizer (HKLM-x32\...\{6D320CE8-79EB-4D45-8C6D-DEF74D84B49A}) (Version: 2.0.0.08280 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.1.0.10200 - Sony Corporation)
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
Windows Driver Package - Broadcom Bluetooth  (09/09/2009 6.2.0.9405) (HKLM\...\930E4792BDAEAFB62A9514EE7578775658A5D07C) (Version: 09/09/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

11-05-2014 17:11:16 Ende der Bereinigung
11-05-2014 20:35:57 Windows Update
12-05-2014 19:02:13 Windows Update
13-05-2014 08:00:08 Windows Update
15-05-2014 20:38:14 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0FCBD88B-561D-476A-9E9D-F133D15D63BD} - System32\Tasks\VAIO Care Service => C:\Program Files\Sony\VAIO Care\VAIOCareService.exe [2009-10-21] (Sony Corporation)
Task: {11F23285-73B9-4380-BF63-7CAA14FA77BD} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {25A529C6-0A67-476A-A74E-4156CB31A33B} - System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25] (Google Inc.)
Task: {2D3682DA-0E30-4B02-8187-052E2C321117} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {51AC7AD5-0423-4AEA-92E4-7AEB2C6F3E9F} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2009-09-24] (Sony Corporation)
Task: {55985EB9-E42B-40B9-84C9-DFEA4C9BCA59} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {764ECBFC-D54A-4C28-9B58-54AEBEB6301A} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2012-10-26] (Sony Corporation)
Task: {7BABAC77-3B91-4CC3-85AD-4573FCFBFF12} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {ACE25725-C302-4826-9E02-C9044859540B} - System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25] (Google Inc.)
Task: {BF9FD1B7-D330-4FAB-9434-EA80B65D339C} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {C5AB10FF-BB81-4EFE-A6E5-656CECAEDB78} - System32\Tasks\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2009-10-19] (Sony Corporation)
Task: {CC306779-D254-4845-A3C6-555DEB7A453B} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {D8D15CC8-3140-4B78-8554-FDEFCB77F00A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E9D4B398-4D68-4CEA-876F-CAEA7DA96FD7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {F51A8938-76E5-4395-AC86-09AD20B0218D} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2012-10-26] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-09-21 15:04 - 2009-09-21 15:04 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2009-09-01 05:31 - 2009-09-01 05:31 - 00022016 _____ () C:\Windows\System32\ssp2ml6.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2014-03-09 11:47 - 2013-02-05 09:24 - 00671744 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2011-05-27 09:59 - 2009-01-12 08:15 - 00071096 _____ () C:\Windows\SysWOW64\NMSAccess32.exe
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2013-08-12 19:14 - 2013-08-12 19:08 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2014-03-09 11:47 - 2009-01-10 12:32 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2014-03-09 11:47 - 2009-06-22 20:42 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2014-03-09 11:47 - 2012-10-31 11:11 - 02417152 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2014-03-09 11:47 - 2012-10-31 11:14 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2011-07-13 15:36 - 2009-11-30 19:20 - 00010752 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2011-07-13 15:36 - 2009-11-30 19:20 - 00009728 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2014-05-14 21:33 - 2014-05-07 04:27 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: TermService => 3

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/16/2014 07:06:51 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/16/2014 07:06:50 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/15/2014 05:20:21 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/15/2014 05:20:21 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/14/2014 09:27:54 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/14/2014 09:27:54 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/14/2014 09:54:04 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: WINWORD.EXE, Version: 12.0.6695.5000, Zeitstempel: 0x5329c5d9
Name des fehlerhaften Moduls: EN10Cwyw.WordXP.wll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4464d5b9
Ausnahmecode: 0xc0000005
Fehleroffset: 0x04eb2bf0
ID des fehlerhaften Prozesses: 0xa78
Startzeit der fehlerhaften Anwendung: 0xWINWORD.EXE0
Pfad der fehlerhaften Anwendung: WINWORD.EXE1
Pfad des fehlerhaften Moduls: WINWORD.EXE2
Berichtskennung: WINWORD.EXE3

Error: (05/14/2014 07:28:06 AM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/14/2014 07:28:06 AM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/13/2014 08:39:57 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)


System errors:
=============
Error: (05/16/2014 07:06:50 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "VAIO Content Folder Watcher" ist vom Dienst "Remotedesktopdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/16/2014 07:06:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.

Error: (05/16/2014 07:06:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (05/16/2014 07:06:46 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (05/15/2014 05:20:20 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "VAIO Content Folder Watcher" ist vom Dienst "Remotedesktopdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/15/2014 05:20:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.

Error: (05/15/2014 05:20:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (05/15/2014 05:20:15 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (05/14/2014 09:27:52 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "VAIO Content Folder Watcher" ist vom Dienst "Remotedesktopdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/14/2014 09:27:49 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.


Microsoft Office Sessions:
=========================
Error: (04/18/2014 02:39:09 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 969 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:26:44 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 181 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:14:23 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:14:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 14861 seconds with 7800 seconds of active time.  This session ended with a crash.

Error: (04/25/2012 01:40:43 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/07/2011 08:22:07 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31802 seconds with 5940 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-04-19 12:44:37.471
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-04-19 12:44:37.300
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 43%
Total physical RAM: 4014.09 MB
Available physical RAM: 2275.89 MB
Total Pagefile: 8026.36 MB
Available Pagefile: 5869.93 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:230.72 GB) (Free:157.11 GB) NTFS
Drive m: (Volume) (Fixed) (Total:224.93 GB) (Free:68.45 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 06CF34C5)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=225 GB) - (Type=OF Extended)

==================== End Of Log ============================


schrauber 17.05.2014 14:40

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851647&CUI=UN12416177020766219
URLSearchHook: HKCU - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No File
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File


Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Popups in IE und FF? Auf welchen Seiten? Wann genau?

TintenfischM 17.05.2014 16:59

Hey :)

Hier den Fixlog..
Die Werbespots kommen, wann sie wollen. Am meisten stören die, wenn ich im Leo oder Linguee was suche..

Schönen gruss

MM

Code:


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 17-05-2014
Ran by user at 2014-05-17 17:56:35 Run:1
Running from C:\Users\user\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2851647&CUI=UN12416177020766219
URLSearchHook: HKCU - (No Name) - {c840e246-6b95-475e-9bd7-caa1c7eca9f2} - No File
SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKCU - DefaultScope {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {05D1642D-B05B-40DF-975B-3490220638AB} URL = hxxp://de.shopping.com/?linkin_id=8056363
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
       

*****************

HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{c840e246-6b95-475e-9bd7-caa1c7eca9f2} => Value deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{05D1642D-B05B-40DF-975B-3490220638AB} => Key deleted successfully.
HKCR\CLSID\{05D1642D-B05B-40DF-975B-3490220638AB} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} => Value deleted successfully.
HKCR\CLSID\{C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.

==== End of Fixlog ====


schrauber 18.05.2014 18:43

und immer noch in beiden browsern? Andere REchner in deinem Netz haben keine Probleme?

TintenfischM 19.05.2014 07:27

Hey

Immer noch in beiden Browsern...
Ich habe keine anderen Rechner im Netz.

LG und guten Start in die Woche

MM

schrauber 20.05.2014 08:15

Router auf Werkseinstellungen resetten, Verbindungsdatenneu eingeben.

Beide Browser komplett zurücksetzen

frisches FRST log bitte.

TintenfischM 20.05.2014 16:12

Sorry für die doofe Frage, aber wie soll ich beide Browser zurücksetzen? Geht es um die Internetoptionen?

gruß
mm

schrauber 21.05.2014 08:27

Firefox:
https://support.mozilla.org/de/kb/fi...einfach-loesen


Setze folgendermassen den Internet Explorer zurück:
  • Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
  • Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
  • Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.
(Hier findest du die bebilderte Anleitung.)

TintenfischM 21.05.2014 19:20

Hallo :)

Danke!

Habe ich gemacht.. Hier frische FRST Logdatei.

Die Werbungen kommen trotdem weiter..

Gruß,

MM


FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-05-2014
Ran by user (administrator) on USER-VAIO on 21-05-2014 20:18:48
Running from C:\Tr.board
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x477F3E422075CF01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.220.1
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\o3bkt4zv.default-1400696066421
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] ()
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-21] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-21 20:14 - 2014-05-21 20:14 - 00000000 ____D () C:\Users\user\Desktop\Alte Firefox-Daten
2014-05-17 21:28 - 2014-05-17 21:58 - 01459016 _____ () C:\Users\user\Desktop\Photos vor und nach HIFU.pptx
2014-05-17 21:13 - 2014-05-17 21:13 - 00001048 _____ () C:\Users\user\Desktop\HIFU_Review.lnk
2014-05-17 21:04 - 2014-05-17 22:30 - 00066497 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140517.pptx
2014-05-17 17:56 - 2014-05-21 20:18 - 00000000 ____D () C:\FRST
2014-05-16 19:31 - 2014-05-21 20:18 - 00000000 ____D () C:\Tr.board
2014-05-15 22:16 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 22:16 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 22:16 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 22:16 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 22:15 - 2014-05-05 21:20 - 09073664 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:15 - 2014-05-05 21:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:15 - 2014-05-05 20:39 - 06041600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:15 - 2014-05-05 20:39 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 22:15 - 2014-05-05 18:28 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:15 - 2014-05-05 17:50 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:15 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 22:15 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 22:15 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 22:15 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 22:15 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 22:15 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 22:15 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 22:15 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 22:15 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 22:15 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 22:15 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 22:15 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 22:15 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 21:34 - 2014-05-14 21:34 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 21:33 - 2014-05-14 21:34 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:33 - 2014-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:32 - 2014-05-14 21:33 - 00283144 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 29.0.1.exe
2014-05-11 19:10 - 2014-05-11 19:12 - 00002230 _____ () C:\DelFix.txt
2014-05-11 19:01 - 2014-05-11 19:01 - 00283144 _____ (Mozilla) C:\Users\user\Firefox Setup Stub 29.0.1.exe
2014-05-11 16:18 - 2014-05-11 19:04 - 00173470 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-05-11 16:18 - 2014-05-11 16:19 - 00000000 ____D () C:\Users\user\Desktop\EndNote_HIFU.Data
2014-05-11 12:23 - 2014-05-11 12:39 - 00835072 _____ () C:\Users\user\Desktop\Erste HIFU-Therapie in Bonn b.pptx.ppt
2014-05-07 03:02 - 2014-05-16 19:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 18:46 - 2014-05-05 18:46 - 17305528 _____ (Malwarebytes Corporation ) C:\mbam_premium.exe
2014-05-03 15:47 - 2014-05-03 15:47 - 00000000 ____D () C:\Users\user\Desktop\BPaper_Endnote.Data
2014-04-30 08:29 - 2014-04-30 08:30 - 00000548 _____ () C:\Windows\LkmdfCoInst.log
2014-04-23 18:42 - 2014-04-23 18:42 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-23 18:42 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-23 18:42 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\Program Files\iTunes
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-23 18:41 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iPod
2014-04-23 18:39 - 2014-04-23 18:39 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-23 18:33 - 2014-04-23 18:33 - 148885840 _____ (Apple Inc.) C:\Users\user\iTunes64Setup.exe
2014-04-22 10:46 - 2014-05-01 17:22 - 00100906 _____ () C:\Users\user\Desktop\BPaper_Endnote.enl

==================== One Month Modified Files and Folders =======

2014-05-21 20:18 - 2014-05-17 17:56 - 00000000 ____D () C:\FRST
2014-05-21 20:18 - 2014-05-16 19:31 - 00000000 ____D () C:\Tr.board
2014-05-21 20:14 - 2014-05-21 20:14 - 00000000 ____D () C:\Users\user\Desktop\Alte Firefox-Daten
2014-05-21 20:05 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-05-21 20:05 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-05-21 20:05 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-21 20:05 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-21 20:04 - 2011-07-13 15:15 - 01741634 _____ () C:\Windows\WindowsUpdate.log
2014-05-21 20:01 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-21 20:00 - 2014-04-19 23:42 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-21 19:58 - 2012-11-26 13:52 - 00150470 _____ () C:\SUService.log
2014-05-21 19:58 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-05-21 19:57 - 2014-04-11 11:14 - 00006484 _____ () C:\Windows\setupact.log
2014-05-21 19:57 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-21 11:14 - 2014-04-11 13:46 - 00393005 _____ () C:\Windows\IE11_main.log
2014-05-17 22:30 - 2014-05-17 21:04 - 00066497 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140517.pptx
2014-05-17 21:58 - 2014-05-17 21:28 - 01459016 _____ () C:\Users\user\Desktop\Photos vor und nach HIFU.pptx
2014-05-17 21:13 - 2014-05-17 21:13 - 00001048 _____ () C:\Users\user\Desktop\HIFU_Review.lnk
2014-05-17 21:12 - 2014-03-23 17:36 - 00001062 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-05-17 18:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 19:04 - 2014-05-07 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:42 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 22:41 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:40 - 2011-08-21 19:51 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 21:34 - 2014-05-14 21:34 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 21:34 - 2014-05-14 21:33 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:34 - 2014-02-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-14 21:33 - 2014-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:33 - 2014-05-14 21:32 - 00283144 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 29.0.1.exe
2014-05-14 21:31 - 2012-06-12 12:19 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 09:01 - 2012-06-01 16:25 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 09:01 - 2012-06-01 16:25 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:01 - 2012-06-01 16:25 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-11 19:12 - 2014-05-11 19:10 - 00002230 _____ () C:\DelFix.txt
2014-05-11 19:10 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-05-11 19:04 - 2014-05-11 16:18 - 00173470 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-05-11 19:01 - 2014-05-11 19:01 - 00283144 _____ (Mozilla) C:\Users\user\Firefox Setup Stub 29.0.1.exe
2014-05-11 16:19 - 2014-05-11 16:18 - 00000000 ____D () C:\Users\user\Desktop\EndNote_HIFU.Data
2014-05-11 12:39 - 2014-05-11 12:23 - 00835072 _____ () C:\Users\user\Desktop\Erste HIFU-Therapie in Bonn b.pptx.ppt
2014-05-10 21:00 - 2011-07-27 21:19 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315
2014-05-10 21:00 - 2011-07-27 21:19 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26
2014-05-10 16:03 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-05-10 16:03 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-05-10 16:03 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-09 08:14 - 2014-05-15 22:16 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 22:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-05 21:20 - 2014-05-15 22:15 - 09073664 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 21:20 - 2014-05-15 22:15 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 20:39 - 2014-05-15 22:15 - 06041600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 20:39 - 2014-05-15 22:15 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 18:47 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-05 18:47 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-05 18:47 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-05 18:46 - 2014-05-05 18:46 - 17305528 _____ (Malwarebytes Corporation ) C:\mbam_premium.exe
2014-05-05 18:28 - 2014-05-15 22:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 17:50 - 2014-05-15 22:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-03 15:47 - 2014-05-03 15:47 - 00000000 ____D () C:\Users\user\Desktop\BPaper_Endnote.Data
2014-05-01 17:22 - 2014-04-22 10:46 - 00100906 _____ () C:\Users\user\Desktop\BPaper_Endnote.enl
2014-04-30 08:30 - 2014-04-30 08:29 - 00000548 _____ () C:\Windows\LkmdfCoInst.log
2014-04-30 08:29 - 2012-03-11 17:04 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2014-04-23 18:42 - 2014-04-23 18:42 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-23 18:42 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iTunes
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-23 18:41 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iPod
2014-04-23 18:39 - 2014-04-23 18:39 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-23 18:34 - 2011-07-28 20:01 - 00000000 ____D () C:\ProgramData\Apple
2014-04-23 18:33 - 2014-04-23 18:33 - 148885840 _____ (Apple Inc.) C:\Users\user\iTunes64Setup.exe
2014-04-22 22:45 - 2014-04-13 15:29 - 00121221 _____ () C:\Windows\IE10_main.log
2014-04-21 15:02 - 2014-04-18 13:53 - 00000000 ____D () C:\Trojaner Board
2014-04-21 14:34 - 2014-04-11 11:14 - 00042540 _____ () C:\Windows\PFRO.log

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe
C:\Users\user\Firefox Setup Stub 29.0.1.exe
C:\Users\user\iTunes64Setup.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 22:15] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 08:18

==================== End Of Log ============================

--- --- ---

schrauber 22.05.2014 13:23

In allen Browsern? Bitte mal FRST öffnen, Haken setzen bei Additional und scannen, poste bitte beide Logfiles.

TintenfischM 23.05.2014 16:33

hier nochmal.

gruß

FRST Additions Logfile:
Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by user at 2014-05-23 17:32:02
Running from C:\FRST
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
µTorrent (HKLM-x32\...\uTorrent) (Version: 3.0.0 - )
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alps Pointing-device for VAIO (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version:  - ALPS ELECTRIC CO., LTD.)
Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Magic-i Visual Effects 2 (HKLM-x32\...\{7BB90344-0647-468E-925A-7F69F7983421}) (Version: 2.0.1.85 - ArcSoft)
ArcSoft WebCam Companion 3 (HKLM-x32\...\{DE8AAC73-6D8D-483E-96EA-CAEDDADB9079}) (Version: 3.0.21.193 - ArcSoft)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.3.350 - Avira)
Berkeley Madonna (HKLM-x32\...\{27AB9BD6-4A3E-4BBD-8381-CD445E474936}) (Version:  - )
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BS.Player FREE powered by AdVantage (HKLM-x32\...\BSPlayerf) (Version: 2.28.964 - Webteh, d.o.o.)
BS.Player PRO (HKLM-x32\...\BSPlayerp) (Version: 2.53.1034 - Webteh, d.o.o.)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.109 - Corel Inc.)
Einstellungen für VAIO-Inhaltsüberwachung (HKLM-x32\...\{23825B69-36DF-4DAD-9CFD-118D11D80F16}) (Version: 2.4.1.09180 - Sony Corporation)
EndNote X5 (HKLM-x32\...\{86B3F2D6-AC2B-0015-8AE1-F2F77F781B0C}) (Version: 15.0.0.5478 - Thomson Reuters)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
Evernote (HKLM-x32\...\{F761359C-9CED-45AE-9A51-9D6605CD55C4}) (Version: 3.5.0.545 - Evernote Corp.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{CCAFF072-4DDB-4846-963D-15F02A8E9472}) (Version: 13.00.0000 - Intel Corporation)
Intel(R) Turbo Boost Technology Driver (HKLM-x32\...\{D6C630BF-8DBB-4042-8562-DC9A52CB6E7E}) (Version: 01.00.00.1030 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Internet Manager (HKLM-x32\...\Internet Manager) (Version: 22.001.18.74.55 - Huawei Technologies Co.,Ltd)
iTunes (HKLM\...\{B8BA155B-1E75-405F-9CB4-8A99615D09DC}) (Version: 11.1.5.5 - Apple Inc.)
Java(TM) 6 Update 16 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416016FF}) (Version: 6.0.160 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Lotus Notes 8.5.3 de (HKLM-x32\...\{122A716C-63AD-4F73-BDCD-309F0A799C91}) (Version: 8.53.11286 - IBM)
Malwarebytes Anti-Malware Version 2.0.1.1004 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Media Gallery (HKLM-x32\...\{DD88F979-FA58-41AC-980C-A6E1A82B61D9}) (Version: 1.1.0.10210 - Sony Corporation)
Media Gallery (x32 Version: 1.1.0.10210 - Sony Corporation) Hidden
mediscript Hammerexamen (HKLM-x32\...\{1231D46E-3174-4F1F-859E-41DCB0D070D2}) (Version: 5.0.0 - Elsevier GmbH)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 English (HKLM-x32\...\{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP1 x64 English (HKLM\...\{F83779DF-E1F5-43A2-A7BE-732F856FADB7}) (Version: 3.5.5692.0 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MusicStation (HKLM-x32\...\{AB259D46-F851-41B0-9AFA-AED8998AD68A}) (Version: 2.0.0.1067 - Omnifone)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.9 - NVIDIA Corporation)
PDF24 Creator 5.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PMB (HKLM-x32\...\{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}) (Version: 5.0.00.10260 - Sony Corporation)
PMB VAIO Edition Guide (HKLM-x32\...\InstallShield_{88C252C8-A7EE-4B60-BF74-8E5919A8048F}) (Version: 1.0.00.09250 - Sony Corporation)
PMB VAIO Edition Guide (x32 Version: 1.0.00.09250 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (Click to Disc) (HKLM-x32\...\InstallShield_{4DCEA9C1-4D6E-41BF-A854-28CFA8B56DBF}) (Version: 3.0.01.11230 - Sony Corporation)
PMB VAIO Edition plug-in (Click to Disc) (x32 Version: 3.0.01.11230 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Image Optimizer) (HKLM-x32\...\InstallShield_{1873FFC1-FDCB-47E1-B7C7-F418211E3530}) (Version: 1.0.00.10150 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Image Optimizer) (x32 Version: 1.0.00.10150 - Sony Corporation) Hidden
PMB VAIO Edition plug-in (VAIO Movie Story) (HKLM-x32\...\InstallShield_{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}) (Version: 2.2.00.15250 - Sony Corporation)
PMB VAIO Edition plug-in (VAIO Movie Story) (x32 Version: 2.2.00.15250 - Sony Corporation) Hidden
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5992 - Realtek Semiconductor Corp.)
ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version:  - )
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Roxio Central Audio (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Copy (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Core (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Data (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Central Tools (x32 Version: 3.8.0 - Roxio) Hidden
Roxio Easy Media Creator 10 LJ (HKLM-x32\...\{537BF16E-7412-448C-95D8-846E85A1D817}) (Version: 10.3 - Roxio)
Roxio Easy Media Creator Home (x32 Version: 10.3.183 - Roxio) Hidden
Setting Utility Series (HKLM-x32\...\{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}) (Version: 5.1.0.11200 - Sony Corporation)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Sony Home Network Library (HKLM-x32\...\{D03D02D8-AB64-4785-A48E-5AA8B0FB8C14}) (Version: 2.0.1.10160 - Sony Corporation)
Sony Home Network Library (x32 Version: 2.0.1.10160 - Sony Corporation) Hidden
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VAIO Care (HKLM-x32\...\{36C5BBF0-E5BF-4DE1-B684-7E90B0C93FB5}) (Version: 5.0.3.11130 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (HKLM-x32\...\{4882EBF5-CA37-4EF4-BCB8-9B0E78B907D0}) (Version: 3.6.0.09250 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (x32 Version: 3.6.0.09250 - Sony Corporation) Hidden
VAIO Content Metadata Intelligent Network Service Manager (HKLM-x32\...\{4427F384-B5BE-4769-B7D0-C784FC321EB1}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata Intelligent Network Service Manager (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Metadata Manager Settings (HKLM-x32\...\{12D0BE8D-538C-4AB1-86DE-C540308F50DA}) (Version: 3.6.0.09240 - Sony Corporation)
VAIO Content Metadata Manager Settings (x32 Version: 3.6.0.09240 - Sony Corporation) Hidden
VAIO Content Metadata XML Interface Library (HKLM-x32\...\{291FB4BF-EEC7-4CF9-8469-F39ED1DBC4D8}) (Version: 3.6.0.09080 - Sony Corporation)
VAIO Content Metadata XML Interface Library (x32 Version: 3.6.0.09080 - Sony Corporation) Hidden
VAIO Content Monitoring Settings (x32 Version: 2.4.1.09180 - Sony Corporation) Hidden
VAIO Control Center (HKLM-x32\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 4.1.0.10160 - Sony Corporation)
VAIO Data Restore Tool (HKLM-x32\...\{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}) (Version: 1.2.0.09150 - Sony Corporation)
VAIO Data Restore Tool (x32 Version: 1.2.0.09150 - Sony Corporation) Hidden
VAIO DVD Menu Data (HKLM-x32\...\{596BED91-A1D8-4DF1-8CD1-1C777F7588AC}) (Version: 2.0.00.10130 - Sony Corporation)
VAIO Energie Verwaltung (HKLM-x32\...\{803E4FA5-A940-4420-B89D-A8BC2E160247}) (Version: 5.0.0.11300 - Sony Corporation)
VAIO Entertainment Platform (HKLM-x32\...\{6B1F20F2-6321-4669-A58C-33DF8E7517FF}) (Version: 3.6.0.09150 - Sony Corporation)
VAIO Entertainment Platform (x32 Version: 3.6.0.09150 - Sony Corporation) Hidden
VAIO Event Service (HKLM-x32\...\{C7477742-DDB4-43E5-AC8D-0259E1E661B1}) (Version: 5.1.0.11300 - Sony Corporation)
VAIO Gate (HKLM-x32\...\{A7C30414-2382-4086-B0D6-01A88ABA21C3}) (Version: 1.2.0.09240 - Sony Corporation)
VAIO Gate Default (HKLM-x32\...\{B7546697-2A80-4256-A24B-1C33163F535B}) (Version: 1.0.0.10290 - Sony Corporation)
VAIO Hardware Diagnostics (x32 Version: 3.9.1 - Sony Corporation) Hidden
VAIO Marketing Tools (HKLM-x32\...\MarketingTools) (Version:  - Sony Corporation)
VAIO Media plus (HKLM-x32\...\{8DE50158-80AA-4FF2-9E9F-0A7C46F71FCD}) (Version: 2.0.1.10160 - Sony Corporation)
VAIO Media plus Opening Movie (HKLM-x32\...\{9238E8A4-BEBA-43A3-B926-769BDBF194C5}) (Version: 1.2.0.09100 - Sony Corporation)
VAIO Movie Story MergeModules x64 (Version: 1.0.14240 - Sony Corporation) Hidden
VAIO Movie Story Template Data (HKLM-x32\...\InstallShield_{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}) (Version: 2.2.00.15250 - Sony Corporation)
VAIO Movie Story Template Data (x32 Version: 2.0.00.09240 - Sony Corporation) Hidden
VAIO Original Function Settings (x32 Version: 2.0.0.07010 - Sony Corporation) Hidden
VAIO Original Funktion Einstellungen (HKLM-x32\...\{A63E7492-A0BC-4BB9-89A7-352965222380}) (Version: 2.0.0.07010 - Sony Corporation)
VAIO Personalization Manager (HKLM-x32\...\{A95187EF-BCF4-4468-B501-C0BAB976ADD1}) (Version: 2.0.0.06220 - Sony Corporation)
VAIO Personalization Manager (x32 Version: 2.0.0.06220 - Sony Corporation) Hidden
VAIO Premium Partners (HKLM-x32\...\VAIO Premium Partners) (Version: 1.0 - Sony Europe)
VAIO screensaver (HKLM-x32\...\VAIO screensaver) (Version: 1.0.0.0 - Sony Europe)
VAIO Smart Network (HKLM-x32\...\{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}) (Version: 3.1.0.11250 - Sony Corporation)
VAIO Update (HKLM-x32\...\{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}) (Version: 6.1.1.10250 - Sony Corporation)
VAIO Wallpaper Contents (HKLM-x32\...\{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}) (Version: 2.0.0.06010 - Sony Corporation)
VAIO Window Organizer (HKLM-x32\...\{6D320CE8-79EB-4D45-8C6D-DEF74D84B49A}) (Version: 2.0.0.08280 - Sony Corporation)
VAIO-Support für Übertragungen (HKLM-x32\...\{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}) (Version: 1.1.0.10200 - Sony Corporation)
VD64Inst (Version: 1.00.0000 - Roxio, Inc.) Hidden
VU5x64 (Version: 1.1.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.0.0 - Sony Corporation ) Hidden
VU5x86 (x32 Version: 1.1.0 - Sony Corporation ) Hidden
WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)
Windows Driver Package - Broadcom Bluetooth  (09/09/2009 6.2.0.9405) (HKLM\...\930E4792BDAEAFB62A9514EE7578775658A5D07C) (Version: 09/09/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Anmelde-Assistent (HKLM-x32\...\{52B97218-98CB-4B8B-9283-D213C85E1AA4}) (Version: 5.000.818.5 - Microsoft Corporation)
Windows Live Call (x32 Version: 14.0.8064.0206 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8064.206 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8089.726 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 14.0.8093.805 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8081.709 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8089.0726 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

==================== Restore Points  =========================

11-05-2014 17:11:16 Ende der Bereinigung
11-05-2014 20:35:57 Windows Update
12-05-2014 19:02:13 Windows Update
13-05-2014 08:00:08 Windows Update
15-05-2014 20:38:14 Windows Update
17-05-2014 14:59:10 Windows Update
17-05-2014 17:36:48 Windows Update
17-05-2014 21:01:43 Windows Update
18-05-2014 06:53:43 Windows Update
19-05-2014 07:23:21 Windows Update
20-05-2014 19:25:37 Windows Update
21-05-2014 09:13:34 Windows Update
21-05-2014 18:22:21 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0FCBD88B-561D-476A-9E9D-F133D15D63BD} - System32\Tasks\VAIO Care Service => C:\Program Files\Sony\VAIO Care\VAIOCareService.exe [2009-10-21] (Sony Corporation)
Task: {11F23285-73B9-4380-BF63-7CAA14FA77BD} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {25A529C6-0A67-476A-A74E-4156CB31A33B} - System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25] (Google Inc.)
Task: {2D3682DA-0E30-4B02-8187-052E2C321117} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {51AC7AD5-0423-4AEA-92E4-7AEB2C6F3E9F} - System32\Tasks\SONY\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2009-09-24] (Sony Corporation)
Task: {55985EB9-E42B-40B9-84C9-DFEA4C9BCA59} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {7BABAC77-3B91-4CC3-85AD-4573FCFBFF12} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {ACE25725-C302-4826-9E02-C9044859540B} - System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26 => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-25] (Google Inc.)
Task: {BF9FD1B7-D330-4FAB-9434-EA80B65D339C} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {BFA07E11-73B0-48C4-9638-C7A1145509F6} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2012-10-26] (Sony Corporation)
Task: {C5AB10FF-BB81-4EFE-A6E5-656CECAEDB78} - System32\Tasks\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2009-10-19] (Sony Corporation)
Task: {CC306779-D254-4845-A3C6-555DEB7A453B} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {D8D15CC8-3140-4B78-8554-FDEFCB77F00A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {E9D4B398-4D68-4CEA-876F-CAEA7DA96FD7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {F51A8938-76E5-4395-AC86-09AD20B0218D} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2012-10-26] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2009-09-21 15:04 - 2009-09-21 15:04 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2009-09-01 05:31 - 2009-09-01 05:31 - 00022016 _____ () C:\Windows\System32\ssp2ml6.dll
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2011-03-14 17:27 - 2011-03-14 17:27 - 00346976 _____ () C:\ProgramData\DatacardService\HWDeviceService64.exe
2014-03-09 11:47 - 2013-02-05 09:24 - 00671744 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
2011-05-27 09:59 - 2009-01-12 08:15 - 00071096 _____ () C:\Windows\SysWOW64\NMSAccess32.exe
2013-08-12 19:14 - 2013-08-12 19:08 - 00394824 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-03-04 12:49 - 2011-03-04 12:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2014-03-09 11:47 - 2009-01-10 12:32 - 00011362 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\mingwm10.dll
2014-03-09 11:47 - 2009-06-22 20:42 - 00043008 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\libgcc_s_dw2-1.dll
2014-03-09 11:47 - 2012-10-31 11:11 - 02417152 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtCore4.dll
2014-03-09 11:47 - 2012-10-31 11:14 - 01148416 _____ () C:\ProgramData\Internet Manager\OnlineUpdate\QtNetwork4.dll
2011-07-13 15:36 - 2009-11-30 19:20 - 00010752 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2011-07-13 15:36 - 2009-11-30 19:20 - 00009728 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2014-05-14 21:33 - 2014-05-07 04:27 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============

MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: TermService => 3

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/23/2014 05:24:26 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/23/2014 05:24:26 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/21/2014 07:58:15 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/21/2014 07:58:15 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/21/2014 10:25:47 AM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/21/2014 10:25:47 AM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/20/2014 04:56:05 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)

Error: (05/20/2014 04:56:05 PM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {48512A59-C8A5-4805-9048-23C9E4194BFA}) (Fehlercode = 0x80042000)

Error: (05/19/2014 07:35:17 AM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "H:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (05/19/2014 07:25:58 AM) (Source: VzCdbSvc) (EventID: 7) (User: )
Description: Das Plug-In-Modul konnte nicht geladen werden. (GUID = {56F9312C-C989-4E04-8C23-299DEE3A36F5}) (Fehlercode = 0x80042019)


System errors:
=============
Error: (05/23/2014 05:24:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "VAIO Content Folder Watcher" ist vom Dienst "Remotedesktopdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/23/2014 05:24:24 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.

Error: (05/23/2014 05:24:18 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (05/23/2014 05:24:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (05/21/2014 08:23:59 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (05/21/2014 07:58:14 PM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "VAIO Content Folder Watcher" ist vom Dienst "Remotedesktopdienste" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1058

Error: (05/21/2014 07:58:14 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Roxio Upnp Server 10 erreicht.

Error: (05/21/2014 07:58:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Internet Manager. OUC" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053

Error: (05/21/2014 07:58:03 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Internet Manager. OUC erreicht.

Error: (05/21/2014 11:14:48 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme


Microsoft Office Sessions:
=========================
Error: (04/18/2014 02:39:09 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 969 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:26:44 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 181 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:14:23 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (11/24/2012 07:14:13 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 14861 seconds with 7800 seconds of active time.  This session ended with a crash.

Error: (04/25/2012 01:40:43 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6612.1000, Microsoft Office Version: 12.0.6612.1000. This session lasted 18 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/07/2011 08:22:07 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31802 seconds with 5940 seconds of active time.  This session ended with a crash.


==================== Memory info ===========================

Percentage of memory in use: 55%
Total physical RAM: 4014.09 MB
Available physical RAM: 1773.01 MB
Total Pagefile: 8026.36 MB
Available Pagefile: 5521.81 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:230.72 GB) (Free:154.67 GB) NTFS
Drive m: (Volume) (Fixed) (Total:224.93 GB) (Free:66.61 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 06CF34C5)
Partition 1: (Not Active) - (Size=10 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=231 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=225 GB) - (Type=OF Extended)

==================== End Of Log ============================

--- --- ---



FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by user (administrator) on USER-VAIO on 23-05-2014 17:30:58
Running from C:\FRST
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\ipmgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [689744 2014-02-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x477F3E422075CF01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.220.1
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\o3bkt4zv.default-1400696066421
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [440400 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1017424 2014-02-22] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] ()
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation)
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation)

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [108440 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [131576 2013-12-21] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [119512 2014-05-23] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63192 2014-04-03] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-21 20:14 - 2014-05-21 20:14 - 00000000 ____D () C:\Users\user\Desktop\Alte Firefox-Daten
2014-05-17 21:28 - 2014-05-17 21:58 - 01459016 _____ () C:\Users\user\Desktop\Photos vor und nach HIFU.pptx
2014-05-17 21:13 - 2014-05-17 21:13 - 00001048 _____ () C:\Users\user\Desktop\HIFU_Review.lnk
2014-05-17 21:04 - 2014-05-17 22:30 - 00066497 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140517.pptx
2014-05-17 17:56 - 2014-05-23 17:30 - 00000000 ____D () C:\FRST
2014-05-16 19:31 - 2014-05-21 20:18 - 00000000 ____D () C:\Tr.board
2014-05-15 22:16 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 22:16 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 22:16 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 22:16 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 22:15 - 2014-05-05 21:20 - 09073664 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:15 - 2014-05-05 21:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:15 - 2014-05-05 20:39 - 06041600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:15 - 2014-05-05 20:39 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 22:15 - 2014-05-05 18:28 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:15 - 2014-05-05 17:50 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:15 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 22:15 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 22:15 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 22:15 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 22:15 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 22:15 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 22:15 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 22:15 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 22:15 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 22:15 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 22:15 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 22:15 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 22:15 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 22:15 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 22:15 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 22:15 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 22:15 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-14 21:34 - 2014-05-14 21:34 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 21:33 - 2014-05-14 21:34 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:33 - 2014-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:32 - 2014-05-14 21:33 - 00283144 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 29.0.1.exe
2014-05-11 19:10 - 2014-05-11 19:12 - 00002230 _____ () C:\DelFix.txt
2014-05-11 19:01 - 2014-05-11 19:01 - 00283144 _____ (Mozilla) C:\Users\user\Firefox Setup Stub 29.0.1.exe
2014-05-11 16:18 - 2014-05-11 19:04 - 00173470 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-05-11 16:18 - 2014-05-11 16:19 - 00000000 ____D () C:\Users\user\Desktop\EndNote_HIFU.Data
2014-05-11 12:23 - 2014-05-11 12:39 - 00835072 _____ () C:\Users\user\Desktop\Erste HIFU-Therapie in Bonn b.pptx.ppt
2014-05-07 03:02 - 2014-05-16 19:04 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 18:46 - 2014-05-05 18:46 - 17305528 _____ (Malwarebytes Corporation ) C:\mbam_premium.exe
2014-05-03 15:47 - 2014-05-03 15:47 - 00000000 ____D () C:\Users\user\Desktop\BPaper_Endnote.Data
2014-04-30 08:29 - 2014-04-30 08:30 - 00000548 _____ () C:\Windows\LkmdfCoInst.log
2014-04-23 18:42 - 2014-04-23 18:42 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-23 18:42 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-23 18:42 - 2012-08-21 13:01 - 00033240 _____ (GEAR Software Inc.) C:\Windows\system32\Drivers\GEARAspiWDM.sys
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\Program Files\iTunes
2014-04-23 18:41 - 2014-04-23 18:42 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-23 18:41 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iPod
2014-04-23 18:39 - 2014-04-23 18:39 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-23 18:33 - 2014-04-23 18:33 - 148885840 _____ (Apple Inc.) C:\Users\user\iTunes64Setup.exe

==================== One Month Modified Files and Folders =======

2014-05-23 17:31 - 2011-07-13 15:15 - 01786727 _____ () C:\Windows\WindowsUpdate.log
2014-05-23 17:30 - 2014-05-17 17:56 - 00000000 ____D () C:\FRST
2014-05-23 17:27 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-05-23 17:26 - 2014-04-19 23:42 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-23 17:24 - 2012-11-26 13:52 - 00150910 _____ () C:\SUService.log
2014-05-23 17:24 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-05-23 17:23 - 2014-04-11 11:14 - 00006540 _____ () C:\Windows\setupact.log
2014-05-23 17:23 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-21 20:23 - 2014-04-11 13:46 - 00401473 _____ () C:\Windows\IE11_main.log
2014-05-21 20:18 - 2014-05-16 19:31 - 00000000 ____D () C:\Tr.board
2014-05-21 20:14 - 2014-05-21 20:14 - 00000000 ____D () C:\Users\user\Desktop\Alte Firefox-Daten
2014-05-21 20:05 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-05-21 20:05 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-21 20:05 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-21 20:01 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-17 22:30 - 2014-05-17 21:04 - 00066497 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140517.pptx
2014-05-17 21:58 - 2014-05-17 21:28 - 01459016 _____ () C:\Users\user\Desktop\Photos vor und nach HIFU.pptx
2014-05-17 21:13 - 2014-05-17 21:13 - 00001048 _____ () C:\Users\user\Desktop\HIFU_Review.lnk
2014-05-17 21:12 - 2014-03-23 17:36 - 00001062 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-05-17 18:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 19:04 - 2014-05-07 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:42 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-05-15 22:41 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:40 - 2011-08-21 19:51 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-14 21:34 - 2014-05-14 21:34 - 00001117 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-05-14 21:34 - 2014-05-14 21:33 - 00001129 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-14 21:34 - 2014-02-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-14 21:33 - 2014-05-14 21:33 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-14 21:33 - 2014-05-14 21:32 - 00283144 _____ (Mozilla) C:\Program Files (x86)\Firefox Setup Stub 29.0.1.exe
2014-05-14 21:31 - 2012-06-12 12:19 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-14 09:01 - 2012-06-01 16:25 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 09:01 - 2012-06-01 16:25 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:01 - 2012-06-01 16:25 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-11 19:12 - 2014-05-11 19:10 - 00002230 _____ () C:\DelFix.txt
2014-05-11 19:10 - 2014-04-20 00:39 - 00000000 ____D () C:\Windows\ERUNT
2014-05-11 19:04 - 2014-05-11 16:18 - 00173470 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-05-11 19:01 - 2014-05-11 19:01 - 00283144 _____ (Mozilla) C:\Users\user\Firefox Setup Stub 29.0.1.exe
2014-05-11 16:19 - 2014-05-11 16:18 - 00000000 ____D () C:\Users\user\Desktop\EndNote_HIFU.Data
2014-05-11 12:39 - 2014-05-11 12:23 - 00835072 _____ () C:\Users\user\Desktop\Erste HIFU-Therapie in Bonn b.pptx.ppt
2014-05-10 21:00 - 2011-07-27 21:19 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315
2014-05-10 21:00 - 2011-07-27 21:19 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26
2014-05-10 16:03 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-05-10 16:03 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-05-10 16:03 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-09 08:14 - 2014-05-15 22:16 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 22:16 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-05 21:20 - 2014-05-15 22:15 - 09073664 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-05 21:20 - 2014-05-15 22:15 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-05 20:39 - 2014-05-15 22:15 - 06041600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-05 20:39 - 2014-05-15 22:15 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 18:47 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-05 18:47 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-05 18:47 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-05 18:46 - 2014-05-05 18:46 - 17305528 _____ (Malwarebytes Corporation ) C:\mbam_premium.exe
2014-05-05 18:28 - 2014-05-15 22:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-05 17:50 - 2014-05-15 22:15 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-03 15:47 - 2014-05-03 15:47 - 00000000 ____D () C:\Users\user\Desktop\BPaper_Endnote.Data
2014-05-01 17:22 - 2014-04-22 10:46 - 00100906 _____ () C:\Users\user\Desktop\BPaper_Endnote.enl
2014-04-30 08:30 - 2014-04-30 08:29 - 00000548 _____ () C:\Windows\LkmdfCoInst.log
2014-04-30 08:29 - 2012-03-11 17:04 - 00018960 _____ (Logitech, Inc.) C:\Windows\system32\Drivers\LNonPnP.sys
2014-04-23 18:42 - 2014-04-23 18:42 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-04-23 18:42 - 2014-04-23 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iTunes
2014-04-23 18:42 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-04-23 18:41 - 2014-04-23 18:41 - 00000000 ____D () C:\Program Files\iPod
2014-04-23 18:39 - 2014-04-23 18:39 - 00002519 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Windows\System32\Tasks\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-04-23 18:39 - 2014-04-23 18:39 - 00000000 ____D () C:\Program Files (x86)\Apple Software Update
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files\Bonjour
2014-04-23 18:35 - 2014-04-23 18:35 - 00000000 ____D () C:\Program Files (x86)\Bonjour
2014-04-23 18:34 - 2011-07-28 20:01 - 00000000 ____D () C:\ProgramData\Apple
2014-04-23 18:33 - 2014-04-23 18:33 - 148885840 _____ (Apple Inc.) C:\Users\user\iTunes64Setup.exe

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe
C:\Users\user\Firefox Setup Stub 29.0.1.exe
C:\Users\user\iTunes64Setup.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 22:15] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 08:18

==================== End Of Log ============================

--- --- ---

schrauber 24.05.2014 11:21

Setz mal bitte den Router zurück auf Werkseinstellungen.

TintenfischM 26.05.2014 19:31

Hallo,

sorry für die späte Antwort.

Habe ich gemacht.. trotzdem alles gleich geblieben.

Oder was meinst Du genau mit "auf Werkeinstellungen zurücksetzen"?

Schönen gruß

MM

schrauber 27.05.2014 18:07

na so als wenn DU ihn neu auspackst, Reset Knopf.

TintenfischM 14.06.2014 19:55

Hallo Schrauber,

sorry, dass ich lange nicht geantwortet habe... viel um die Ohren gehabt..

Also, habe ich gemacht.. Es hat sich nichts wesentlich geändert.

Ich versuche morgen nochmal.

Schönen Gruß

MM

TintenfischM 14.06.2014 20:16

Liste der Anhänge anzeigen (Anzahl: 1)
Es taucht immer eine Spybot-Meldung auf, jedes Mal, wenn ich den PC neu starte. Solange ich diese nicht geschlossen habe, funktioniert auch einiges nicht, z.B. habe ich ca.10 x versucht, mich im Trojaner-Board anzumelden, ging nicht; nachdem ich die Meldung geschlossen habe, hat es sofort geklappt.
Im Anhang die Fehlermeldung. Meinst du, es hangt damit zusammen, dass der PC wieder langsamer geworden ist?

Schönen Gruß

MM

schrauber 15.06.2014 06:27

bei der Meldung bitte auf Info klicken, davon einen Screenshot. Und ein frisches FRST log bitte.

TintenfischM 15.06.2014 21:28

Liste der Anhänge anzeigen (Anzahl: 1)
Hey ..

hier einmal der Screenshot. Und frisches FRST.

Schönen Gruß

MM


FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-06-2014
Ran by user (administrator) on USER-VAIO on 15-06-2014 22:24:34
Running from C:\Trojaner Board
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Microsoft Corporation) C:\Windows\System32\UI0Detect.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2011-07-13] (Sun Microsystems, Inc.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
HKU\S-1-5-21-1344524881-3095286266-3356523038-1000\...\Run: [SpybotSD TeaTimer] => C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2144088 2009-01-26] (Safer Networking Limited)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC69F371B7888CF01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.220.1
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\o3bkt4zv.default-1400696066421
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] () [File not signed]
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation) [File not signed]
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation) [File not signed]
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [821760 2009-11-25] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-15] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-15 16:39 - 2014-06-15 16:39 - 00096677 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140615.pptx
2014-06-15 12:12 - 2014-06-15 12:12 - 00000000 ____D () C:\Users\user\AppData\Local\Adobe
2014-06-15 12:07 - 2014-06-15 08:57 - 00000030 _____ () C:\AVScanner.ini
2014-06-14 19:56 - 2014-06-14 19:56 - 00093845 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140614.pptx
2014-06-12 17:04 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 17:04 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-12 17:04 - 2014-05-28 01:53 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 12258816 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 09079296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 02457600 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 01496576 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 17:04 - 2014-05-28 01:50 - 01538048 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 17:04 - 2014-05-28 01:50 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 17:04 - 2014-05-28 01:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-12 17:04 - 2014-05-28 01:50 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-12 17:04 - 2014-05-28 01:49 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 10992128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 06043136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 01234432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 17:04 - 2014-05-28 01:46 - 01466368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 17:04 - 2014-05-28 01:46 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 17:04 - 2014-05-28 01:46 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-06-12 17:04 - 2014-05-28 01:46 - 00016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-06-12 17:04 - 2014-05-27 23:04 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 17:04 - 2014-05-27 22:40 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 17:04 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 17:04 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 17:04 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 17:04 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 17:04 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 17:04 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 17:04 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 17:04 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 17:04 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 17:04 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 17:04 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 17:04 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-05 21:17 - 2014-06-05 21:17 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-05 21:17 - 2014-06-05 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-05 21:16 - 2014-06-05 21:17 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-05 21:16 - 2014-06-05 21:17 - 00000000 ____D () C:\Program Files\iTunes
2014-06-05 21:16 - 2014-06-05 21:17 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-06-05 21:16 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files\iPod
2014-06-01 13:44 - 2014-06-01 13:45 - 04589568 _____ () C:\Users\user\Desktop\MUB_Figure EPMA13proof.ppt
2014-05-17 21:13 - 2014-05-17 21:13 - 00001048 _____ () C:\Users\user\Desktop\HIFU_Review.lnk
2014-05-17 17:56 - 2014-06-15 22:24 - 00000000 ____D () C:\FRST
2014-05-16 19:31 - 2014-05-21 20:18 - 00000000 ____D () C:\Tr.board

==================== One Month Modified Files and Folders =======

2014-06-15 22:25 - 2011-07-13 17:22 - 00000000 ____D () C:\Users\user\AppData\Local\Temp
2014-06-15 22:24 - 2014-05-17 17:56 - 00000000 ____D () C:\FRST
2014-06-15 22:24 - 2014-04-18 13:53 - 00000000 ____D () C:\Trojaner Board
2014-06-15 22:10 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-15 22:10 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-15 22:05 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-06-15 22:05 - 2011-07-13 15:15 - 02056154 _____ () C:\Windows\WindowsUpdate.log
2014-06-15 22:02 - 2014-04-19 23:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-15 22:02 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-15 21:59 - 2012-11-26 13:52 - 00161470 _____ () C:\SUService.log
2014-06-15 21:58 - 2014-04-11 11:14 - 00008847 _____ () C:\Windows\setupact.log
2014-06-15 21:58 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-06-15 21:58 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-15 20:27 - 2014-04-11 13:46 - 00532205 _____ () C:\Windows\IE11_main.log
2014-06-15 20:03 - 2014-05-11 16:18 - 00291950 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-06-15 16:39 - 2014-06-15 16:39 - 00096677 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140615.pptx
2014-06-15 14:36 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-06-15 12:12 - 2014-06-15 12:12 - 00000000 ____D () C:\Users\user\AppData\Local\Adobe
2014-06-15 12:08 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-15 08:57 - 2014-06-15 12:07 - 00000030 _____ () C:\AVScanner.ini
2014-06-15 08:57 - 2012-06-01 16:25 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-15 08:57 - 2011-07-13 15:20 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-15 08:56 - 2012-06-01 16:25 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-15 08:56 - 2012-06-01 16:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-14 22:27 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-06-14 22:27 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-06-14 22:27 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-14 19:56 - 2014-06-14 19:56 - 00093845 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140614.pptx
2014-06-12 17:10 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 17:08 - 2011-08-21 19:51 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 17:08 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 17:07 - 2014-05-07 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-08 11:13 - 2014-06-12 17:04 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-12 17:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-05 21:17 - 2014-06-05 21:17 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-05 21:17 - 2014-06-05 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-05 21:17 - 2014-06-05 21:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-05 21:17 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files\iTunes
2014-06-05 21:17 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-06-05 21:16 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files\iPod
2014-06-03 20:44 - 2013-08-12 19:14 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-03 20:44 - 2013-08-12 19:14 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-01 22:20 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-01 22:20 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-01 22:20 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-01 13:45 - 2014-06-01 13:44 - 04589568 _____ () C:\Users\user\Desktop\MUB_Figure EPMA13proof.ppt
2014-05-28 01:53 - 2014-06-12 17:04 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 12258816 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 09079296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 02457600 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 01496576 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 01:50 - 2014-06-12 17:04 - 01538048 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 01:50 - 2014-06-12 17:04 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 01:50 - 2014-06-12 17:04 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 01:50 - 2014-06-12 17:04 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 01:49 - 2014-06-12 17:04 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 10992128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 06043136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 01234432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-28 01:46 - 2014-06-12 17:04 - 01466368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-28 01:46 - 2014-06-12 17:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-28 01:46 - 2014-06-12 17:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-05-28 01:46 - 2014-06-12 17:04 - 00016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-05-27 23:04 - 2014-06-12 17:04 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-27 22:40 - 2014-06-12 17:04 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-25 13:26 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-21 20:18 - 2014-05-16 19:31 - 00000000 ____D () C:\Tr.board
2014-05-17 21:13 - 2014-05-17 21:13 - 00001048 _____ () C:\Users\user\Desktop\HIFU_Review.lnk
2014-05-17 21:12 - 2014-03-23 17:36 - 00001062 _____ () C:\Users\user\Desktop\BPaper_CT-DXA.lnk
2014-05-17 18:30 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 19:08 - 2011-07-13 17:33 - 00000000 ___RD () C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe
C:\Users\user\Firefox Setup Stub 29.0.1.exe
C:\Users\user\iTunes64Setup.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-08 14:16

==================== End Of Log ============================

--- --- ---

[/CODE]

schrauber 16.06.2014 21:22

Spybot bitte mal komplett deinstallieren, ebenso alles von Java.

TintenfischM 17.06.2014 21:25

Hi Schrauber,

habe ich gemacht..

Schönen Gruß

MM

P.S. Soll ich Spybot nicht wieder installieren? Braucht man es nicht?

schrauber 18.06.2014 17:58

Spybot ist ewig alt, behalte lieber MBAM.

FRisches FRST log bitte. Noch Probleme?

TintenfischM 19.06.2014 19:23

Hey,

ich konnte mich erst beim 9. Mal beim Trojaner-Biard anmelden. Voll komisch...

Frisches FRST habe ich gemacht, s. unten.

Eine Frage habe ich noch: soll ich AVIRA deinstallieren? Ich habe MBAM, sogar die erweiterte Version..


Gruß

MM


FRST Logfile:

FRST Logfile:
Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-06-2014
Ran by user (administrator) on USER-VAIO on 19-06-2014 20:17:24
Running from C:\Trojaner Board
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 8
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VAIOCareService.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBVolumeWatcher.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
() C:\ProgramData\DatacardService\HWDeviceService64.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
() C:\ProgramData\Internet Manager\OnlineUpdate\ouc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\SUService.exe
(IBM) C:\Program Files (x86)\lotus\notes\nsd.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(IBM Corp) C:\Program Files (x86)\lotus\notes\ntmulti.exe
() C:\Windows\SysWOW64\NMSAccess32.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files (x86)\SONY\PMB\PMBDeviceInfoProvider.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApntEx.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_ActiveX.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-10-13] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] => C:\Windows\system32\NvCpl.dll [16395880 2009-11-02] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] => C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\System32\LogiLDA.dll [1580368 2010-11-03] (Logitech, Inc.)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [ISBMgr.exe] => C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] => c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2009-10-24] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] => C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2011-07-13] (Sony Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [163000 2012-12-12] (Geek Software GmbH)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-03] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\VESWinlogon-x32: VESWinlogon.dll [X]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC69F371B7888CF01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKCU - {8F0AEF21-E021-4B82-B6FD-3AEAB110B73B} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {95492057-1011-4AA0-B4DA-89EF261884E5} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SVEC_deDE442
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {C840E246-6B95-475E-9BD7-CAA1C7ECA9F2} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 172.20.10.1
Tcpip\..\Interfaces\{DA9AED26-3BE3-4836-BC76-D13C43387048}: [NameServer]10.74.210.210 10.74.210.211

FireFox:
========
FF ProfilePath: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\o3bkt4zv.default-1400696066421
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-03] (Avira Operations GmbH & Co. KG)
R2 HWDeviceService64.exe; C:\ProgramData\DatacardService\HWDeviceService64.exe [346976 2011-03-14] ()
S2 Internet Manager. RunOuc; C:\Program Files (x86)\T-Mobile\InternetManager_H\UpdateDog\ouc.exe [671744 2013-02-05] () [File not signed]
R2 LNSUSvc; C:\Program Files (x86)\lotus\notes\SUService.exe [189832 2011-09-16] (IBM Corp)
R2 Lotus Notes Diagnostics; C:\Program Files (x86)\lotus\notes\nsd.exe [4453768 2011-09-16] (IBM)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Multi-user Cleanup Service; C:\Program Files (x86)\lotus\notes\ntmulti.exe [71048 2011-09-16] (IBM Corp)
R2 NMSAccess; C:\Windows\SysWOW64\NMSAccess32.exe [71096 2009-01-12] ()
S3 Roxio UPnP Renderer 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUPnPRenderer10.exe [313840 2009-08-31] (Sonic Solutions)
S2 Roxio Upnp Server 10; C:\Program Files (x86)\Roxio\Digital Home 10\RoxioUpnpService10.exe [362992 2009-08-31] (Sonic Solutions)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [167424 2009-09-16] (Intel Corporation) [File not signed]
S3 SOHDBSvr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDBSvr.exe [70952 2009-10-15] (Sony Corporation)
S3 SOHPlMgr; C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHPlMgr.exe [91432 2009-10-15] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2009-09-14] (Sony Corporation) [File not signed]
S2 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [642416 2009-09-14] (Sony Corporation)
R2 VSNService; C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [821760 2009-11-25] (Sony Corporation) [File not signed]
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [206336 2009-09-14] (Sony Corporation) [File not signed]

==================== Drivers (Whitelisted) ====================

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [112080 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-26] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
S3 huawei_wwanecm; C:\Windows\System32\DRIVERS\ew_juwwanecm.sys [241152 2012-12-03] (Huawei Technologies Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R2 regi; C:\Windows\SysWOW64\drivers\regi.sys [11032 2007-04-17] (InterVideo)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)
S3 TVICHW64; C:\Windows\system32\DRIVERS\TVICHW64.SYS [21200 2011-08-16] (EnTech Taiwan)
R1 wStLib64; C:\Windows\System32\drivers\wStLib64.sys [61112 2014-03-23] (StdLib)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-15 16:39 - 2014-06-15 16:39 - 00096677 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140615.pptx
2014-06-15 12:12 - 2014-06-15 12:12 - 00000000 ____D () C:\Users\user\AppData\Local\Adobe
2014-06-15 12:07 - 2014-06-15 08:57 - 00000030 _____ () C:\AVScanner.ini
2014-06-12 17:04 - 2014-06-08 11:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 17:04 - 2014-06-08 11:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-12 17:04 - 2014-05-28 01:53 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 12258816 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 09079296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 02457600 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 01496576 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-12 17:04 - 2014-05-28 01:52 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 17:04 - 2014-05-28 01:50 - 01538048 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 17:04 - 2014-05-28 01:50 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 17:04 - 2014-05-28 01:50 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-12 17:04 - 2014-05-28 01:50 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-12 17:04 - 2014-05-28 01:49 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 10992128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 06043136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 01234432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-06-12 17:04 - 2014-05-28 01:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 17:04 - 2014-05-28 01:46 - 01466368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 17:04 - 2014-05-28 01:46 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 17:04 - 2014-05-28 01:46 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-06-12 17:04 - 2014-05-28 01:46 - 00016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-06-12 17:04 - 2014-05-27 23:04 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 17:04 - 2014-05-27 22:40 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 17:04 - 2014-04-25 04:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 17:04 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 17:04 - 2014-04-05 04:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 17:04 - 2014-04-05 04:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 17:04 - 2014-03-26 16:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 17:04 - 2014-03-26 16:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 17:04 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 17:04 - 2014-03-26 16:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 17:04 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 17:04 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 17:04 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 17:04 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-05 21:17 - 2014-06-05 21:17 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-05 21:17 - 2014-06-05 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-05 21:16 - 2014-06-05 21:17 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-05 21:16 - 2014-06-05 21:17 - 00000000 ____D () C:\Program Files\iTunes
2014-06-05 21:16 - 2014-06-05 21:17 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-06-05 21:16 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files\iPod
2014-06-01 13:44 - 2014-06-01 13:45 - 04589568 _____ () C:\Users\user\Desktop\MUB_Figure EPMA13proof.ppt

==================== One Month Modified Files and Folders =======

2014-06-19 20:17 - 2014-05-17 17:56 - 00000000 ____D () C:\FRST
2014-06-19 20:17 - 2014-04-18 13:53 - 00000000 ____D () C:\Trojaner Board
2014-06-19 20:16 - 2014-04-19 23:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-19 20:09 - 2012-06-01 16:25 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-19 20:09 - 2011-07-27 21:19 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA1cc4c9221e98315.job
2014-06-19 20:09 - 2011-07-13 15:15 - 01176994 _____ () C:\Windows\WindowsUpdate.log
2014-06-19 09:09 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 09:09 - 2009-07-14 06:45 - 00010096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 09:03 - 2011-07-13 17:33 - 00003930 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{B26FBD29-0CC1-4B4A-8D17-063AB54DB0FB}
2014-06-19 09:00 - 2012-11-26 13:52 - 00163230 _____ () C:\SUService.log
2014-06-19 09:00 - 2011-07-27 21:19 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cc4c92216b5a26.job
2014-06-19 08:59 - 2014-04-11 11:14 - 00009183 _____ () C:\Windows\setupact.log
2014-06-19 08:59 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-18 10:31 - 2014-04-11 13:46 - 00566077 _____ () C:\Windows\IE11_main.log
2014-06-17 22:23 - 2011-09-07 11:10 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-17 22:23 - 2011-09-07 11:10 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-06-15 20:03 - 2014-05-11 16:18 - 00291950 _____ () C:\Users\user\Desktop\EndNote_HIFU.enl
2014-06-15 16:39 - 2014-06-15 16:39 - 00096677 _____ () C:\Users\user\Desktop\HIFU_Review_Tables_140615.pptx
2014-06-15 12:12 - 2014-06-15 12:12 - 00000000 ____D () C:\Users\user\AppData\Local\Adobe
2014-06-15 08:57 - 2014-06-15 12:07 - 00000030 _____ () C:\AVScanner.ini
2014-06-15 08:57 - 2012-06-01 16:25 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-15 08:57 - 2011-07-13 15:20 - 00000000 ____D () C:\ProgramData\McAfee
2014-06-15 08:56 - 2012-06-01 16:25 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-06-15 08:56 - 2012-06-01 16:25 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-06-14 22:27 - 2011-07-13 15:44 - 00699682 _____ () C:\Windows\system32\perfh007.dat
2014-06-14 22:27 - 2011-07-13 15:44 - 00149790 _____ () C:\Windows\system32\perfc007.dat
2014-06-14 22:27 - 2009-07-14 07:13 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-12 17:10 - 2013-08-22 08:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 17:08 - 2011-08-21 19:51 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 17:08 - 2011-07-13 15:24 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 17:07 - 2014-05-07 03:02 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-08 11:13 - 2014-06-12 17:04 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 11:08 - 2014-06-12 17:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-05 21:17 - 2014-06-05 21:17 - 00001749 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-05 21:17 - 2014-06-05 21:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-05 21:17 - 2014-06-05 21:16 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-05 21:17 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files\iTunes
2014-06-05 21:17 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-06-05 21:16 - 2014-06-05 21:16 - 00000000 ____D () C:\Program Files\iPod
2014-06-03 20:44 - 2013-08-12 19:14 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-03 20:44 - 2013-08-12 19:14 - 00112080 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-01 22:20 - 2014-04-19 23:42 - 00001072 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-01 22:20 - 2014-04-19 23:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-01 22:20 - 2014-04-19 23:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-01 13:45 - 2014-06-01 13:44 - 04589568 _____ () C:\Users\user\Desktop\MUB_Figure EPMA13proof.ppt
2014-05-28 01:53 - 2014-06-12 17:04 - 01188864 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 12258816 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 09079296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 02457600 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 01496576 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00735232 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00134144 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00082944 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 01:52 - 2014-06-12 17:04 - 00065024 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 01:50 - 2014-06-12 17:04 - 01538048 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 01:50 - 2014-06-12 17:04 - 00174592 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 01:50 - 2014-06-12 17:04 - 00047616 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 01:50 - 2014-06-12 17:04 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 01:49 - 2014-06-12 17:04 - 00981504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 10992128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 06043136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 02078208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 01234432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00627712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00132096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00067584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-05-28 01:48 - 2014-06-12 17:04 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-28 01:46 - 2014-06-12 17:04 - 01466368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-28 01:46 - 2014-06-12 17:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-28 01:46 - 2014-06-12 17:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-05-28 01:46 - 2014-06-12 17:04 - 00016384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-05-27 23:04 - 2014-06-12 17:04 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-27 22:40 - 2014-06-12 17:04 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-25 13:26 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-05-21 20:18 - 2014-05-16 19:31 - 00000000 ____D () C:\Tr.board

Files to move or delete:
====================
C:\ProgramData\Dropbox 1.4.3.exe
C:\Users\user\Firefox Setup Stub 29.0.1.exe
C:\Users\user\iTunes64Setup.exe


Some content of TEMP:
====================
C:\Users\user\AppData\Local\Temp\avgnt.exe
C:\Users\user\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\user\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 10:19

==================== End Of Log ============================

--- --- ---

--- --- ---

[/CODE]

schrauber 20.06.2014 18:18

ja kannste machen. Alles is besser als Antivir :)


Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

TintenfischM 20.06.2015 21:45

Hallo,

bitte diesen Eintrag ignorieren, da ich ein neues Thema eröffnet habe; mein Rechner hat zwischendurch auch gewechselt..

Danke und sorry, dass ich dies auch abgeschickt habe..

MM

schrauber 21.06.2015 11:11

ok :)


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:34 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131