Trojaner-Board - searchGolTB.A, plusHD.A u.a. .. gründlich zu entfernen von Windows7-Rechner

Erledigt ...

(da hatte ich mich aber sehr blond angestellt ... dachte das In-Quarantäne-verschieben reicht, anstatt die Funde dann auch aus der Quarantäne zu löschen)

FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:22-06-2014

Ran by Armin (administrator) on ANGELIQUE-PC on 27-06-2014 07:19:33

Running from C:\Users\Armin\Desktop

Platform: Microsoft Windows 7 Home Premium  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

() C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe

() C:\Windows\System32\Rezip.exe

() C:\Program Files\CyberLink\Shared files\RichVideo.exe

(Secunia) C:\Program Files\Secunia\PSI\psia.exe

(TeamViewer GmbH) C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE

(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

(Secunia) C:\Program Files\Secunia\PSI\sua.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe

(SAMSUNG Electronics) C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe

(SEC) C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe

(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe

(1und1 Mail und Media GmbH) C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Secunia) C:\Program Files\Secunia\PSI\psi_tray.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Microsoft Corporation) C:\Windows\System32\wuauclt.exe

(Opera Software) C:\Program Files\Opera\opera.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
 
 

==================== Registry (Whitelisted) ==================
 

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8120864 2009-12-15] (Realtek Semiconductor)

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1713448 2010-02-26] (Synaptics Incorporated)

HKLM\...\Run: [UpdateLBPShortCut] => C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-06-03] (CyberLink)

HKLM\...\Run: [UpdateP2GoShortCut] => C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM\...\Run: [UpdatePDRShortCut] => C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe [222504 2008-01-04] (CyberLink Corp.)

HKLM\...\Run: [UpdatePPShortCut] => C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe [218408 2008-12-03] (CyberLink Corp.)

HKLM\...\Run: [UpdatePSTShortCut] => C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [210216 2009-07-21] (CyberLink Corp.)

HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)

HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM\...\Run: [Cm108Sound] => RunDll32 cm108.cpl,CMICtrlWnd

HKLM\...\Run: [AppleSyncNotifier] => C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-10-06] (Apple Inc.)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)

HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-24] (Avira Operations GmbH & Co. KG)

HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)

HKLM\...\Run: [] => [X]

HKLM\...\Run: [MailCheck IE Broker] => C:\Program Files\GMX MailCheck\IE\GMX_MailCheck_Broker.exe [1728064 2013-10-17] (1und1 Mail und Media GmbH)

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: F - F:\AutoRun.exe

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {32a285c4-0323-11e1-9b96-0024548754ef} - F:\AutoRun.exe

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {4f2ba709-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {4f2ba72a-fd98-11e0-bd08-0024548754ef} - F:\AutoRun.exe

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {4f2ba786-fd98-11e0-bd08-001e101faa49} - F:\AutoRun.exe

HKU\S-1-5-21-2339853823-2107313754-116825072-1000-{637FE20B-9A5B-4F51-B1BE-D10045625B40}-0\...\MountPoints2: {a253fd9b-317b-11df-a1e6-806e6f6e6963} - E:\Autorun.exe

HKU\S-1-5-21-2339853823-2107313754-116825072-1003\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3595608 2014-06-23] (Electronic Arts)

HKU\S-1-5-21-2339853823-2107313754-116825072-1003-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3595608 2014-06-23] (Electronic Arts)

HKU\S-1-5-21-2339853823-2107313754-116825072-1004-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-03-05] (Google Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Biet-O-Matic.lnk

ShortcutTarget: Biet-O-Matic.lnk -> C:\Program Files\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\phase-6 Reminder.lnk

ShortcutTarget: phase-6 Reminder.lnk -> C:\Program Files\phase-6\phase-6\reminder\reminder.exe (phase-6)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Secunia PSI Tray.lnk

ShortcutTarget: Secunia PSI Tray.lnk -> C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)

Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Armin\AppData\Roaming\Dropbox\bin\Dropbox.exe (No File)

Startup: C:\Users\Angelique\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files\OpenOffice.org 3\program\quickstart.exe (No File)

ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} =>  No File

ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} =>  No File
 

==================== Internet (Whitelisted) ====================
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.gmx.net/br/ie11_startpage

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN

SearchScopes: HKCU - {0149E807-B987-4E2D-BD54-EDC158FCC679} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&fr=vc_trans_8140&type=protegere

SearchScopes: HKCU - {267EF3C0-6969-4EBB-925C-C129CFC7431B} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {4C7D8CE6-99D1-42C5-A5DC-F15028CF0CE4} URL = hxxp://go.mail.com/tb/en-us/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN_deDE386

SearchScopes: HKCU - {A82DC977-0F54-4431-88CB-77F900DAD944} URL = hxxp://go.1und1.de/tb/ie_searchplugin/?su={searchTerms}

SearchScopes: HKCU - {D90868E5-DB4F-41F1-8491-E8922913A21A} URL = hxxp://go.web.de/tb/ie_searchplugin/?q={searchTerms}&enc=UTF-8

SearchScopes: HKCU - {F3A90CB4-A8AF-447D-9F47-4E22DB5C8DC8} URL = hxxp://search.gmx.com/web?q={searchTerms}&origin=tb_splugin_ie

BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: GMX MailCheck BHO - {BF42D4A8-016E-4fcd-B1EB-837659FD77C6} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)

BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-48514E463B27} -  No File

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab

DPF: {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx

DPF: {CAFEEFAC-0017-0000-0055-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_55-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: gmx - {8FAF0273-9CA8-4efc-9536-1E35E254D5CD} - C:\Program Files\GMX MailCheck\IE\GMX_MailCheck.dll (1und1 Mail und Media GmbH)

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Winsock: Catalog5 10 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
 

FireFox:

========

FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)

FF Extension: Kaspersky Anti-Banner - C:\Program Files\Mozilla Firefox\extensions\KavAntiBanner@Kaspersky.ru [2012-11-03]

FF Extension: Kaspersky URL Advisor - C:\Program Files\Mozilla Firefox\extensions\linkfilter@kaspersky.ru [2012-11-03]

FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012-11-03]

FF Extension: Skype extension for Firefox - C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2012-11-03]

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-01]

FF HKLM\...\Firefox\Extensions: [{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}] - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi

FF Extension: Download Protect - C:\windows\Installer\{967637D2-BA8E-485A-82AF-BAF00B595051}\{528C49FC-FEDF-41D8-A2F7-E0E81A6D445A}.xpi [2014-05-19]
 

Chrome: 

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "hxxp://www.google.com"

CHR Extension: (Google Docs) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-13]

CHR Extension: (Google Drive) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-13]

CHR Extension: (YouTube) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-13]

CHR Extension: (Google-Suche) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-13]

CHR Extension: (Google Wallet) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-13]

CHR Extension: (Google Mail) - C:\Users\Armin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-13]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

========================== Services (Whitelisted) =================
 

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)

R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-24] (Avira Operations GmbH & Co. KG)

R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [106248 2014-06-23] (SurfRight B.V.)

R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files\HP\Digital Imaging\bin\HPSLPSVC32.DLL [694784 2009-09-20] (Hewlett-Packard Co.) [File not signed]

S2 Net Driver HPZ12; C:\windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]

R2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()

S2 Pml Driver HPZ12; C:\windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]

R2 Rezip; C:\windows\SYSTEM32\Rezip.exe [311296 2009-03-05] () [File not signed]

R2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()

R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)

R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
 

==================== Drivers (Whitelisted) ====================
 

R2 avgntflt; C:\windows\System32\DRIVERS\avgntflt.sys [97648 2014-06-24] (Avira Operations GmbH & Co. KG)

R1 avipbb; C:\windows\System32\DRIVERS\avipbb.sys [136216 2014-06-03] (Avira Operations GmbH & Co. KG)

R1 avkmgr; C:\windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)

S3 DxVGrb; C:\windows\System32\drivers\DxVGrb.sys [179200 2012-01-10] (Dexetek )

S3 Netaapl; C:\windows\System32\DRIVERS\netaapl.sys [18432 2011-08-02] (Apple Inc.) [File not signed]

R3 PSI; C:\windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)

R1 ssmdrv; C:\windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)

S3 USBPNPA; C:\windows\System32\drivers\CM108.sys [1499648 2008-09-10] (C-Media Electronics Inc)

R3 yukonw7; C:\windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()

R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}Gw.sys [52928 2014-04-24] (StdLib)

R1 {e63d9559-e4c3-499e-867a-a3c9d0a21400}w; C:\windows\System32\drivers\{e63d9559-e4c3-499e-867a-a3c9d0a21400}w.sys [52928 2014-04-24] (StdLib)

S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X]

S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]

S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]

S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]

S3 XDva389; \??\C:\windows\system32\XDva389.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 
 

==================== One Month Created Files and Folders ========
 

2014-06-27 07:19 - 2014-06-27 07:19 - 00020697 _____ () C:\Users\Armin\Desktop\FRST.txt

2014-06-25 07:00 - 2014-06-25 07:04 - 00000000 ____D () C:\AdwCleaner

2014-06-25 06:59 - 2014-06-25 06:59 - 01342659 _____ () C:\Users\Armin\Desktop\adwcleaner_3.213.exe

2014-06-23 20:48 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\OpenOffice

2014-06-23 20:09 - 2014-06-25 07:13 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe

2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe

2014-06-22 21:05 - 2014-06-27 07:19 - 00000000 ____D () C:\FRST

2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe

2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer

2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe

2014-06-20 23:28 - 2014-06-20 23:29 - 00000000 ____D () C:\Program Files\SpywareBlaster

2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk

2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster

2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses

2014-06-20 23:27 - 2014-06-20 23:28 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll

2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe

2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi

2014-06-20 23:03 - 2014-06-20 23:12 - 00000794 _____ () C:\windows\SecuniaPackage.log

2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI

2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk

2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia

2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe

2014-06-20 22:35 - 2014-06-20 22:36 - 00000988 _____ () C:\DelFix.txt

2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP

2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp

2014-06-18 19:46 - 2014-06-18 19:48 - 00000000 ____D () C:\PC-Säuberung

2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk

2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro

2014-06-18 18:29 - 2014-06-20 22:35 - 00000000 ____D () C:\windows\ERUNT

2014-06-18 18:22 - 2014-06-26 06:25 - 00003714 _____ () C:\windows\PFRO.log

2014-06-18 17:12 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\windows\system32\sqlite3.dll

2014-06-18 16:26 - 2014-06-27 07:07 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-06-18 16:26 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys

2014-06-18 16:26 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys

2014-06-18 16:26 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-06-17 10:13 - 2014-06-25 06:54 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin

2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin

2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList

2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList

2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker

2014-06-15 11:20 - 2014-06-26 17:42 - 00001288 _____ () C:\windows\setupact.log

2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log

2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD

2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository

2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD

2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe

2014-06-12 13:53 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-06-12 13:53 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-06-12 13:53 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2014-06-12 13:53 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-06-12 13:53 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-06-12 13:53 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2014-06-12 13:53 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-06-12 13:53 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-06-12 13:53 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-06-12 13:53 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-06-12 13:53 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2014-06-12 13:53 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2014-06-12 13:53 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2014-06-12 13:53 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2014-06-12 13:53 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-06-12 13:53 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2014-06-12 13:53 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-06-12 13:53 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-06-12 13:53 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-06-12 13:53 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-06-12 13:53 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-06-12 13:53 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-06-12 13:53 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2014-06-12 13:53 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-06-12 13:53 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-06-12 13:53 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-06-12 13:53 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-06-12 13:53 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2014-06-12 13:52 - 2014-06-08 10:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2014-06-12 13:52 - 2014-06-08 10:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2014-06-12 13:52 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll

2014-06-12 13:52 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys

2014-06-12 13:52 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS

2014-06-12 13:52 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll

2014-06-12 13:52 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll

2014-06-12 13:52 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll

2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt

2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
 

==================== One Month Modified Files and Folders =======
 

2014-06-27 07:20 - 2014-06-27 07:19 - 00020697 _____ () C:\Users\Armin\Desktop\FRST.txt

2014-06-27 07:19 - 2014-06-22 21:05 - 00000000 ____D () C:\FRST

2014-06-27 07:14 - 2012-09-16 01:09 - 00000944 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000UA.job

2014-06-27 07:14 - 2010-03-05 06:29 - 01636738 _____ () C:\windows\WindowsUpdate.log

2014-06-27 07:13 - 2010-06-29 21:14 - 00001098 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-06-27 07:07 - 2014-06-18 16:26 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-06-27 07:04 - 2013-09-08 22:15 - 00000000 ____D () C:\Program Files\Origin

2014-06-27 07:03 - 2014-05-17 09:01 - 00000000 ___RD () C:\Users\Angelique\Dropbox

2014-06-27 07:03 - 2013-09-08 14:39 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\BOM

2014-06-27 07:03 - 2010-06-29 21:14 - 00001094 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-06-27 06:04 - 2012-09-16 01:09 - 00000922 _____ () C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2339853823-2107313754-116825072-1000Core.job

2014-06-26 17:50 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-26 17:50 - 2009-07-14 06:34 - 00014512 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-26 17:43 - 2014-05-17 09:01 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\DropboxMaster

2014-06-26 17:43 - 2014-05-17 08:59 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Dropbox

2014-06-26 17:43 - 2013-09-08 14:40 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\BOM

2014-06-26 17:42 - 2014-06-15 11:20 - 00001288 _____ () C:\windows\setupact.log

2014-06-26 17:42 - 2009-07-14 06:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-06-26 06:25 - 2014-06-18 18:22 - 00003714 _____ () C:\windows\PFRO.log

2014-06-26 06:25 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\IME

2014-06-25 22:54 - 2013-09-08 22:15 - 00000000 ____D () C:\ProgramData\Origin

2014-06-25 22:53 - 2014-05-17 08:18 - 00000008 __RSH () C:\ProgramData\ntuser.pol

2014-06-25 22:51 - 2009-07-14 04:37 - 00000000 ___HD () C:\windows\system32\GroupPolicy

2014-06-25 07:13 - 2014-06-23 20:09 - 01073152 _____ (Farbar) C:\Users\Armin\Desktop\FRST.exe

2014-06-25 07:04 - 2014-06-25 07:00 - 00000000 ____D () C:\AdwCleaner

2014-06-25 06:59 - 2014-06-25 06:59 - 01342659 _____ () C:\Users\Armin\Desktop\adwcleaner_3.213.exe

2014-06-25 06:54 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Origin

2014-06-24 11:01 - 2012-11-30 22:59 - 00097648 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys

2014-06-23 20:59 - 2011-10-23 19:03 - 00000000 ____D () C:\Program Files\Mobile Partner

2014-06-23 20:57 - 2012-12-18 23:58 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Google

2014-06-23 20:48 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\OpenOffice

2014-06-23 20:25 - 2012-12-15 10:10 - 00000000 ____D () C:\Users\Armin\AppData\Local\Google

2014-06-22 22:00 - 2014-06-22 22:00 - 00000000 ____D () C:\Users\Armin\AppData\Local\Adobe

2014-06-22 22:00 - 2013-05-29 07:29 - 00000000 ____D () C:\Program Files\Adobe

2014-06-22 21:43 - 2010-06-29 20:57 - 00000000 ____D () C:\Users\Angelique\AppData\Local\Google

2014-06-22 21:04 - 2014-06-22 21:04 - 01070592 _____ (Farbar) C:\Users\Angelique\Desktop\FRST.exe

2014-06-21 11:38 - 2009-07-26 22:06 - 01620612 _____ () C:\windows\system32\PerfStringBackup.INI

2014-06-20 23:54 - 2010-03-05 06:31 - 00000000 ____D () C:\ProgramData\Temp

2014-06-20 23:47 - 2014-06-20 23:47 - 00001753 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iTunes

2014-06-20 23:47 - 2014-06-20 23:47 - 00000000 ____D () C:\Program Files\iPod

2014-06-20 23:47 - 2011-02-25 19:59 - 00000000 ____D () C:\Program Files\Common Files\Apple

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Apple Computer

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default\AppData\Local\Apple Computer

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Apple Computer

2014-06-20 23:46 - 2014-06-20 23:46 - 00000000 ____D () C:\Users\Default User\AppData\Local\Apple Computer

2014-06-20 23:41 - 2014-06-20 23:41 - 00448512 _____ (OldTimer Tools) C:\Users\Angelique\Desktop\TFC.exe

2014-06-20 23:29 - 2014-06-20 23:28 - 00000000 ____D () C:\Program Files\SpywareBlaster

2014-06-20 23:28 - 2014-06-20 23:28 - 00001037 _____ () C:\Users\Public\Desktop\SpywareBlaster.lnk

2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpywareBlaster

2014-06-20 23:28 - 2014-06-20 23:28 - 00000000 ____D () C:\ProgramData\Licenses

2014-06-20 23:28 - 2014-06-20 23:27 - 04095448 _____ (BrightFort LLC ) C:\Users\Angelique\Desktop\spywareblastersetup50.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00264616 _____ (Oracle Corporation) C:\windows\system32\javaws.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00175528 _____ (Oracle Corporation) C:\windows\system32\javaw.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00175016 _____ (Oracle Corporation) C:\windows\system32\java.exe

2014-06-20 23:14 - 2014-06-20 23:14 - 00094632 _____ (Oracle Corporation) C:\windows\system32\WindowsAccessBridge.dll

2014-06-20 23:14 - 2014-06-20 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-06-20 23:14 - 2011-01-04 11:24 - 00000000 ____D () C:\Program Files\Java

2014-06-20 23:12 - 2014-06-20 23:03 - 00000794 _____ () C:\windows\SecuniaPackage.log

2014-06-20 23:11 - 2014-06-20 23:11 - 01064488 _____ (BillP Studios) C:\Users\Angelique\Desktop\wpsetup.exe

2014-06-20 23:10 - 2011-02-25 19:59 - 00000000 ____D () C:\ProgramData\Apple

2014-06-20 23:05 - 2014-06-20 23:05 - 02434048 _____ () C:\Users\Armin\Downloads\msxml.msi

2014-06-20 22:58 - 2014-06-20 22:58 - 00000000 ____D () C:\Users\Armin\AppData\Local\Secunia PSI

2014-06-20 22:57 - 2014-06-20 22:57 - 00001027 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Secunia PSI.lnk

2014-06-20 22:57 - 2014-06-20 22:57 - 00000000 ____D () C:\Program Files\Secunia

2014-06-20 22:56 - 2014-06-20 22:56 - 05329480 _____ (Secunia) C:\Users\Angelique\Desktop\PSISetup_3.0.0.9016.exe

2014-06-20 22:36 - 2014-06-20 22:35 - 00000988 _____ () C:\DelFix.txt

2014-06-20 22:35 - 2014-06-18 18:29 - 00000000 ____D () C:\windows\ERUNT

2014-06-20 22:32 - 2012-12-04 10:52 - 00000000 ____D () C:\Users\Armin

2014-06-18 20:19 - 2014-06-18 20:19 - 418005171 _____ () C:\windows\MEMORY.DMP

2014-06-18 20:19 - 2014-06-18 20:19 - 00154352 _____ () C:\windows\Minidump\061814-18158-01.dmp

2014-06-18 20:19 - 2013-11-18 10:24 - 00000000 ____D () C:\windows\Minidump

2014-06-18 19:57 - 2010-09-02 10:16 - 00000000 ____D () C:\Program Files\Opera

2014-06-18 19:48 - 2014-06-18 19:46 - 00000000 ____D () C:\PC-Säuberung

2014-06-18 19:20 - 2013-09-08 14:39 - 00000000 ____D () C:\Program Files\Biet-O-Matic

2014-06-18 18:55 - 2014-06-18 18:55 - 00001905 _____ () C:\Users\Public\Desktop\HitmanPro.lnk

2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro

2014-06-18 18:55 - 2014-06-18 18:55 - 00000000 ____D () C:\Program Files\HitmanPro

2014-06-18 18:55 - 2014-02-21 21:01 - 00000000 ____D () C:\Users\Katja

2014-06-18 18:21 - 2012-12-04 10:52 - 00001162 _____ () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk

2014-06-18 18:21 - 2012-11-30 22:48 - 00000933 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Opera.lnk

2014-06-18 18:21 - 2012-11-30 22:48 - 00000921 _____ () C:\Users\Public\Desktop\Opera.lnk

2014-06-18 16:26 - 2014-06-18 16:26 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-06-18 16:26 - 2014-06-18 16:26 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2014-06-18 06:45 - 2009-07-14 04:04 - 00000683 _____ () C:\windows\win.ini

2014-06-17 19:25 - 2010-06-29 19:54 - 00000000 ____D () C:\Users\Angelique

2014-06-17 19:24 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\system32\wfp

2014-06-17 19:23 - 2010-03-05 06:39 - 00000000 ____D () C:\ProgramData\WinClon

2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public

2014-06-17 19:23 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\registration

2014-06-17 10:13 - 2014-06-17 10:13 - 00000000 ____D () C:\Users\Armin\AppData\Local\Origin

2014-06-17 10:07 - 2013-02-10 23:22 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Apple Computer

2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieUserList

2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 __SHD () C:\Users\Armin\AppData\Local\EmieSiteList

2014-06-17 09:57 - 2014-06-17 09:57 - 00000000 ____D () C:\Users\Armin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CleanMyPC Popup Blocker

2014-06-15 11:20 - 2014-06-15 11:20 - 00000000 _____ () C:\windows\setuperr.log

2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\OCD

2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\Shared Application Data Repository

2014-06-13 11:13 - 2014-06-13 11:13 - 00000000 ____D () C:\Users\Angelique\AppData\Roaming\OCD

2014-06-13 09:26 - 2009-07-14 04:37 - 00000000 ____D () C:\windows\rescache

2014-06-13 08:27 - 2014-06-13 08:27 - 04748896 _____ (Piriform Ltd) C:\Users\Angelique\Documents\ccsetup414.exe

2014-06-13 08:27 - 2012-11-30 23:23 - 00000965 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-06-13 08:27 - 2012-11-30 23:23 - 00000000 ____D () C:\Program Files\CCleaner

2014-06-13 06:29 - 2014-05-02 18:14 - 00000000 ___SD () C:\windows\system32\CompatTel

2014-06-13 06:13 - 2013-08-14 23:51 - 00000000 ____D () C:\windows\system32\MRT

2014-06-13 06:10 - 2010-06-30 11:23 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-06-11 22:11 - 2014-05-01 09:17 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-06-08 10:48 - 2014-06-12 13:52 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2014-06-08 10:43 - 2014-06-12 13:52 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2014-06-05 13:20 - 2014-06-05 13:20 - 00011881 _____ () C:\Users\Angelique\Documents\Thaimassage 1.odt

2014-06-03 12:26 - 2012-11-30 22:59 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys

2014-05-30 11:18 - 2014-06-12 13:53 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-05-30 11:02 - 2014-06-12 13:53 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-05-30 11:02 - 2014-06-12 13:53 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2014-05-30 10:44 - 2014-06-12 13:53 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-05-30 10:43 - 2014-06-12 13:53 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-05-30 10:42 - 2014-06-12 13:53 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2014-05-30 10:38 - 2014-06-12 13:53 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-05-30 10:34 - 2014-06-12 13:53 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-05-30 10:33 - 2014-06-12 13:53 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-05-30 10:30 - 2014-06-12 13:53 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-05-30 10:28 - 2014-06-12 13:53 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2014-05-30 10:28 - 2014-06-12 13:53 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2014-05-30 10:27 - 2014-06-12 13:53 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2014-05-30 10:21 - 2014-06-12 13:53 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2014-05-30 10:16 - 2014-06-12 13:53 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-05-30 10:10 - 2014-06-12 13:53 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2014-05-30 10:06 - 2014-06-12 13:53 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-05-30 10:04 - 2014-06-12 13:53 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-05-30 10:02 - 2014-06-12 13:53 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-05-30 09:57 - 2014-06-12 13:53 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-05-30 09:56 - 2014-06-12 13:53 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-05-30 09:54 - 2014-06-12 13:53 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-05-30 09:50 - 2014-06-12 13:53 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2014-05-30 09:49 - 2014-06-12 13:53 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-05-30 09:40 - 2014-06-12 13:53 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-05-30 09:21 - 2014-06-12 13:53 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-05-30 09:15 - 2014-06-12 13:53 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-05-30 09:13 - 2014-06-12 13:53 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2014-05-28 08:28 - 2014-05-28 08:28 - 01110476 _____ () C:\Users\Angelique\Documents\7z920.exe
 

Some content of TEMP:

====================

C:\Users\Angelique\AppData\Local\Temp\avgnt.exe

C:\Users\Angelique\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphyicji.dll

C:\Users\Armin\AppData\Local\Temp\avgnt.exe

C:\Users\Armin\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

C:\windows\explorer.exe => File is digitally signed

C:\windows\system32\winlogon.exe => File is digitally signed

C:\windows\system32\wininit.exe => File is digitally signed

C:\windows\system32\svchost.exe => File is digitally signed

C:\windows\system32\services.exe => File is digitally signed

C:\windows\system32\User32.dll => File is digitally signed

C:\windows\system32\userinit.exe => File is digitally signed

C:\windows\system32\rpcss.dll => File is digitally signed

C:\windows\system32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-06-18 13:18
 

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

Ergebnis:

Ich kann mich auf einem Profil (nicht das Admin-Profil) nicht mehr normal anmelden, bekomme die Nachricht: Sie wurden mit einem temporären Profil angemeldet ...

Shit ...
Jetzt hab ich ein großes Problem ...
Komme auch an sämtliche Daten/Dokumente, die in diesem Profil erstellt wurden, nicht mehr ran.

ENTWARNUNG:

Nach komplettem Neustart ist alles wieder gut, kann mich richtig anmelden und auf alle Dateien wieder zugreifen .. puh .. *schwitz* .. das war nicht herzfreundlich ;)