| Shnoxxer | 19.06.2014 18:31 |
Windows Vista: System Speedup
Hallo Trojaner-Board Community,
auf dem PC meiner Freundin ist vor drei Tagen "System Speedup" der gleichnamigen Firma aufgetaucht. Über die Herkunft sind wir uns nicht im Klaren.
Symptome:
Firefox ließ sich nicht starten(mit Fehlermeldung, leider keine genaueren Informationen).
Das Programm ließ sich nicht mehr deinstallieren (über Systemsteuerung), forderte zur Installation weiterer Programme bzw. deren Kauf auf und änderte nach mehrmaliger Ablehnung die Sprache auf Französisch.
Gekauft hat meine Freundin nichts, jedoch wurde trotz Ablehnung mehrmals "Free Software of the Day" installiert.
Meine Freundin hat bereits versucht, das Problem mit Malwarebytes Anti-Malware zu beseitigen, jedoch ohne Erfolg.
Alles, was ich bisher unternommen habe ist ein erneuter Scan mit Malwarebytes, wie erwartet ohne Erfolg.
Das Programm startet nach wie vor beim Windows-Start und verlangsamt den PC sehr, wenn erst einmal gestartet ist.
Vielen Dank im Voraus für die Unterstützung.
Gruß, Simon.
Es folgen nun die Logfiles:
defogger_disable.txt Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:28 on 19/06/2014 (Kristin)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST.txt: Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:18-06-2014
Ran by Kristin (administrator) on KRISTIN-PC on 19-06-2014 17:31:21
Running from C:\Users\Kristin\Downloads
Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Teruten) C:\Windows\System32\FsUsbExService.Exe
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
( ) C:\Windows\System32\lxdxcoms.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Symantec Corporation) C:\Program Files\Norton Internet Security\Engine\21.3.0.12\nis.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
(Realtek Semiconductor) C:\Windows\RtHDVCpl.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
(Nullsoft, Inc.) C:\Program Files\Winamp\winampa.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe
(Geek Software GmbH) C:\Program Files\PDF24\pdf24.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Samsung) C:\Program Files\Samsung\Kies\Kies.exe
() C:\Program Files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
(Samsung) C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Windows\RtHDVCpl.exe [4452352 2007-05-02] (Realtek Semiconductor)
HKLM\...\Run: [LogitechQuickCamRibbon] => C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM\...\Run: [lxdxmon.exe] => C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe [672424 2010-02-04] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [WinampAgent] => C:\Program Files\Winamp\winampa.exe [74752 2011-12-09] (Nullsoft, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-06] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [PDFPrint] => C:\Program Files\PDF24\pdf24.exe [189480 2014-02-06] (Geek Software GmbH)
HKLM\...\Run: [lxdxamon] => C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe [16040 2010-02-04] ()
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [WMPNSCFG] => C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPreload] => C:\Program Files\Samsung\Kies\Kies.exe [1564528 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesAirMessage] => C:\Program Files\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [KiesPDLR] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
HKU\S-1-5-21-3444271574-3087294878-1149490491-1000\...\Run: [] => C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [845168 2013-11-06] (Samsung)
IFEO\DatamngrCoordinator.exe: [Debugger] tasklist.exe
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
==================== Internet (Whitelisted) ====================
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = hxxp://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=DE&ver=21&locale=de_DE&gct=kwd&qsrc=2869
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF NetworkProxy: "autoconfig_url", "https://mediahint.com/default.pac"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @nvidia.com/3DVision - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin: @nvidia.com/3DVisionStreaming - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\user.js
FF SearchPlugin: C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\searchplugins\safesearch.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Rikaichan Japanese-German Dictionary File - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\rikaichan-jpde@polarcloud.com [2013-08-26]
FF Extension: Rikaichan - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2012-11-14]
FF Extension: Media Hint - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\mediahint@jetpack.xpi [2013-03-25]
FF Extension: Adblock Plus - C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-09-22]
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn [2014-06-19]
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
FF HKLM\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-18]
Chrome:
=======
CHR HomePage:
CHR StartupUrls: "hxxp://www.netflix.com/"
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U21) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Media Hint) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja [2013-11-10]
CHR Extension: (Google Docs) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-04-21]
CHR Extension: (Google Drive) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-04-21]
CHR Extension: (YouTube) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-04-21]
CHR Extension: (Adblock Plus) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-05-11]
CHR Extension: (Google-Suche) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-04-21]
CHR Extension: (ZenMate) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcgdnkidjaadafnichfpabhfomcebme [2014-04-26]
CHR Extension: (AdBlock) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-06-15]
CHR Extension: (Norton Identity Safe for Google Chrome™) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-04-21]
CHR Extension: (Google Wallet) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-23]
CHR Extension: (Google Mail) - C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-04-21]
CHR HKLM\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Internet Security\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-25]
========================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2012-04-23] (Adobe Systems) [File not signed]
R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-10-30] (Teruten) [File not signed]
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 lxdx_device; C:\Windows\system32\lxdxcoms.exe [589824 2009-10-16] ( )
R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 NIS; C:\Program Files\Norton Internet Security\Engine\21.3.0.12\NIS.exe [276376 2014-05-11] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================
R1 BHDrvx86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140606.001\BHDrvx86.sys [1101616 2014-05-10] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1503000.00C\ccSetx86.sys [127064 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [377648 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [109872 2014-06-11] (Symantec Corporation)
R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-10-30] () [File not signed]
R1 IDSVix86; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140618.001\IDSvix86.sys [395992 2014-05-08] (Symantec Corporation)
R3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2Mon.sys [25752 2009-10-07] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140618.023\NAVENG.SYS [93272 2014-06-16] (Symantec Corporation)
R3 NAVEX15; C:\Program Files\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140618.023\NAVEX15.SYS [1612376 2014-06-16] (Symantec Corporation)
S3 PID_0928; C:\Windows\System32\DRIVERS\LV561AV.SYS [495768 2009-04-30] (Logitech Inc.)
R3 SRTSP; C:\Windows\System32\Drivers\NIS\1503000.00C\SRTSP.SYS [664280 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NIS\1503000.00C\SRTSPX.SYS [32344 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NIS\1503000.00C\SYMDS.SYS [367704 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NIS\1503000.00C\SYMEFA.SYS [936152 2014-03-04] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142936 2013-11-18] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NIS\1503000.00C\Ironx86.SYS [206936 2013-09-27] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\NIS\1503000.00C\SYMTDIV.SYS [384728 2014-02-18] (Symantec Corporation)
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys [55232 2014-06-09] (StdLib)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
U2 wuaserv;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-06-19 17:31 - 2014-06-19 17:31 - 00019447 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:31 - 2014-06-19 17:31 - 00000000 ____D () C:\FRST
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 17:19 - 2014-06-19 17:19 - 00032744 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malware.txt
2014-06-19 16:47 - 2014-06-19 17:18 - 00002015 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malware.txt
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:05 - 2014-06-19 16:54 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-17 21:02 - 2014-06-17 21:03 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 21:02 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-17 21:02 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-17 20:40 - 2014-06-09 12:15 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-16 23:37 - 2014-06-19 16:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-16 22:13 - 2014-06-17 21:04 - 00000892 _____ () C:\Users\Kristin\Desktop\Continue VuuPC Installation.lnk
2014-06-16 22:01 - 2014-06-19 16:26 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\VOPackage
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-16 22:01 - 2014-06-16 22:01 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-06-16 22:00 - 2014-06-16 23:12 - 00000284 _____ () C:\Windows\Tasks\System Speedup_UPDATES.job
2014-06-16 22:00 - 2014-06-16 23:12 - 00000276 _____ () C:\Windows\Tasks\System Speedup_DEFAULT.job
2014-06-16 21:59 - 2014-06-19 16:09 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\System Speedup
2014-06-16 21:59 - 2014-06-17 20:39 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\systweak
2014-06-16 21:59 - 2014-06-16 21:59 - 00000873 _____ () C:\Users\Public\Desktop\System Speedup.lnk
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\Program Files\System Speedup
2014-06-12 11:47 - 2014-06-12 11:48 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-12 10:18 - 2014-06-14 14:21 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 15:05 - 2014-04-26 18:01 - 00502784 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 15:05 - 2014-04-05 04:42 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 15:05 - 2014-03-10 03:22 - 01401344 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 15:04 - 2014-05-28 18:48 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 15:04 - 2014-05-28 18:39 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 15:04 - 2014-05-28 18:38 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 15:04 - 2014-05-28 18:33 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 15:04 - 2014-05-28 18:32 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 15:04 - 2014-05-28 18:32 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-06-11 15:04 - 2014-05-28 18:31 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 15:04 - 2014-05-28 18:30 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 15:04 - 2014-05-28 18:30 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 15:04 - 2014-05-28 18:29 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 15:04 - 2014-05-28 18:29 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-06-11 15:04 - 2014-05-28 18:29 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-06-11 15:04 - 2014-05-28 18:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 15:04 - 2014-03-10 03:22 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-21 09:29 - 2014-03-25 15:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
==================== One Month Modified Files and Folders =======
2014-06-19 17:31 - 2014-06-19 17:31 - 00019447 _____ () C:\Users\Kristin\Downloads\FRST.txt
2014-06-19 17:31 - 2014-06-19 17:31 - 00000000 ____D () C:\FRST
2014-06-19 17:30 - 2014-06-19 17:30 - 01072128 _____ (Farbar) C:\Users\Kristin\Downloads\FRST.exe
2014-06-19 17:29 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-19 17:29 - 2006-11-02 14:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-19 17:28 - 2014-06-19 17:28 - 00000476 _____ () C:\Users\Kristin\Downloads\defogger_disable.log
2014-06-19 17:28 - 2014-06-19 17:28 - 00000000 _____ () C:\Users\Kristin\defogger_reenable
2014-06-19 17:28 - 2012-04-19 14:37 - 00000000 ____D () C:\Users\Kristin
2014-06-19 17:24 - 2014-05-10 20:53 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-19 17:23 - 2014-06-19 17:23 - 00050477 _____ () C:\Users\Kristin\Downloads\Defogger.exe
2014-06-19 17:19 - 2014-06-19 17:19 - 00032744 _____ () C:\Users\Kristin\Desktop\17-6-2014-Malware.txt
2014-06-19 17:18 - 2014-06-19 16:47 - 00002015 _____ () C:\Users\Kristin\Desktop\19-6-2014-Malware.txt
2014-06-19 17:00 - 2006-11-02 14:52 - 01594648 _____ () C:\Windows\WindowsUpdate.log
2014-06-19 16:54 - 2014-06-17 21:05 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-19 16:54 - 2013-04-21 09:39 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-19 16:54 - 2012-04-20 10:36 - 00195936 _____ () C:\Windows\PFRO.log
2014-06-19 16:54 - 2012-04-19 16:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-06-19 16:54 - 2006-11-02 15:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-19 16:52 - 2006-11-02 15:01 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-06-19 16:44 - 2013-04-21 09:40 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-19 16:37 - 2014-06-16 23:37 - 00000000 ____D () C:\Program Files\ToggleMark
2014-06-19 16:35 - 2012-05-02 20:27 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-19 16:26 - 2014-06-16 22:01 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\VOPackage
2014-06-19 16:09 - 2014-06-16 21:59 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\System Speedup
2014-06-17 21:25 - 2006-11-02 12:23 - 00000246 _____ () C:\Windows\win.ini
2014-06-17 21:24 - 2014-06-17 21:24 - 00032739 _____ () C:\malwarebytes.txt
2014-06-17 21:04 - 2014-06-16 22:13 - 00000892 _____ () C:\Users\Kristin\Desktop\Continue VuuPC Installation.lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000901 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-17 21:03 - 2014-06-17 21:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-17 21:03 - 2014-06-17 21:02 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-17 21:02 - 2014-06-17 21:02 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-17 20:56 - 2014-06-17 20:56 - 00961360 _____ (Chip Digital GmbH) C:\Users\Kristin\Downloads\Malwarebytes Anti Malware Malware Scanner - CHIP-Installer.exe
2014-06-17 20:45 - 2012-04-23 10:19 - 00000000 ____D () C:\Program Files\Lexmark 3600-4600 Series
2014-06-17 20:39 - 2014-06-16 21:59 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\systweak
2014-06-16 23:12 - 2014-06-16 22:00 - 00000284 _____ () C:\Windows\Tasks\System Speedup_UPDATES.job
2014-06-16 23:12 - 2014-06-16 22:00 - 00000276 _____ () C:\Windows\Tasks\System Speedup_DEFAULT.job
2014-06-16 23:11 - 2013-07-09 17:39 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-16 22:09 - 2012-04-20 08:54 - 00000860 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-06-16 22:09 - 2012-04-20 08:54 - 00000848 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-06-16 22:03 - 2013-04-21 09:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-06-16 22:03 - 2012-04-23 10:05 - 00000000 ____D () C:\ProgramData\lx_Cats
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\spool
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\system32\Msdtc
2014-06-16 22:03 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\registration
2014-06-16 22:03 - 2006-11-02 12:22 - 39583744 _____ () C:\Windows\system32\config\software_previous
2014-06-16 22:03 - 2006-11-02 12:22 - 25690112 _____ () C:\Windows\system32\config\system_previous
2014-06-16 22:01 - 2014-06-16 22:01 - 28852416 _____ (Mozilla) C:\Users\Kristin\Downloads\Firefox%20Setup%2029.0.1.exe
2014-06-16 22:01 - 2014-06-16 22:01 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VOPackage
2014-06-16 21:59 - 2014-06-16 21:59 - 00000873 _____ () C:\Users\Public\Desktop\System Speedup.lnk
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Speedup
2014-06-16 21:59 - 2014-06-16 21:59 - 00000000 ____D () C:\Program Files\System Speedup
2014-06-16 21:58 - 2006-11-02 12:22 - 42991616 _____ () C:\Windows\system32\config\components_previous
2014-06-16 21:58 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\sam_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\security_previous
2014-06-16 17:22 - 2006-11-02 12:22 - 00262144 _____ () C:\Windows\system32\config\default_previous
2014-06-14 14:21 - 2014-06-12 10:18 - 00000000 ____D () C:\Program Files\Mozilla Firefox(3)
2014-06-12 12:21 - 2006-11-02 13:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-06-12 11:48 - 2014-06-12 11:47 - 336407184 _____ () C:\Users\Kristin\Downloads\20140611-032-v5i32.exe
2014-06-11 20:38 - 2012-04-23 09:39 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-11 20:36 - 2014-06-11 20:36 - 00000000 ____D () C:\Program Files\Common Files\DESIGNER
2014-06-11 20:32 - 2013-08-14 10:59 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 14:59 - 2012-05-28 18:15 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\Winamp
2014-06-09 12:15 - 2014-06-17 20:40 - 00055232 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
2014-06-01 17:18 - 2006-11-02 12:24 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-05-30 17:12 - 2013-11-24 23:41 - 00000000 ____D () C:\Users\Kristin\AppData\Roaming\vlc
2014-05-30 11:55 - 2012-04-23 10:21 - 00010752 _____ () C:\Users\Kristin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-05-30 11:43 - 2013-03-24 21:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
2014-05-28 18:48 - 2014-06-11 15:04 - 12356608 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-28 18:39 - 2014-06-11 15:04 - 01810432 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-28 18:38 - 2014-06-11 15:04 - 09711104 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-28 18:33 - 2014-06-11 15:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-28 18:32 - 2014-06-11 15:04 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-28 18:32 - 2014-06-11 15:04 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-05-28 18:31 - 2014-06-11 15:04 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-28 18:30 - 2014-06-11 15:04 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-28 18:30 - 2014-06-11 15:04 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-28 18:29 - 2014-06-11 15:04 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-28 18:29 - 2014-06-11 15:04 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-05-28 18:29 - 2014-06-11 15:04 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-05-28 18:28 - 2014-06-11 15:04 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-26 15:08 - 2014-05-26 15:08 - 00807928 _____ () C:\Users\Kristin\Downloads\New player.exe
2014-05-25 21:31 - 2013-11-18 20:49 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2014-05-25 21:31 - 2012-04-20 10:50 - 00002215 _____ () C:\Users\Public\Desktop\Norton Internet Security.lnk
2014-05-25 21:31 - 2012-04-20 10:49 - 00000000 ____D () C:\Windows\system32\Drivers\NIS
2014-05-21 10:35 - 2012-05-02 20:27 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-21 10:35 - 2012-05-02 20:27 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-21 09:19 - 2012-04-29 20:41 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
Some content of TEMP:
====================
C:\Users\Kristin\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe
C:\Users\Kristin\AppData\Local\Temp\ose00000.exe
C:\Users\Kristin\AppData\Local\Temp\qc_a402013b_7656_4f6f_b57f_5a8ef69f5fc4_32.exe
C:\Users\Kristin\AppData\Local\Temp\vlc-2.1.3-win32.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-06-19 17:01
==================== End Of Log ============================
Addition.txt: Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:18-06-2014
Ran by Kristin at 2014-06-19 17:32:20
Running from C:\Users\Kristin\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Norton Internet Security (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton Internet Security (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton Internet Security (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft)
Adobe Bridge 1.0 (Version: 001.000.001 - Adobe Systems) Hidden
Adobe Common File Installer (Version: 1.00.001 - Adobe System Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Help Center 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
Adobe Photoshop CS2 (HKLM\...\Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0407-1E257A25E34D}) (Version: 9.0 - Adobe Systems, Inc.)
Adobe Photoshop CS2 (Version: 9.0 - Adobe Systems, Inc.) Hidden
Adobe Reader X (10.1.10) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Adobe Stock Photos 1.0 (Version: 1.0.1 - Adobe Systems) Hidden
ASUS nVidia Driver (Version: 1.00.0000 - ASUSTek) Hidden
Dell Resource CD (HKLM\...\{42929F0F-CE14-47AF-9FC7-FF297A603021}) (Version: 1.10.0000 - Ihr Firmenname)
FEZ (HKLM\...\Steam App 224760) (Version: - )
GCH Guitar academy (HKLM\...\GCH Guitar academy) (Version: - )
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
ICQ7.7 (HKLM\...\{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE}) (Version: 7.7 - ICQ)
Installer (HKLM\...\VOPackage) (Version: 1.0.0.0 - ) <==== ATTENTION
Intel(R) PRO Network Connections 12.1.11.0 (HKLM\...\PROSetDX) (Version: - Intel)
Intel(R) PRO Network Connections 12.1.11.0 (Version: - Intel) Hidden
Japanese Fonts Support For Adobe Reader X (HKLM\...\{AC76BA86-7AD7-5760-0000-A00000000003}) (Version: 10.0.0 - Adobe Systems Incorporated)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) SE Runtime Environment 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160000}) (Version: 1.6.0.0 - Sun Microsystems, Inc.)
Lexmark 3600-4600 Series (HKLM\...\Lexmark 3600-4600 Series) (Version: - Lexmark International, Inc.)
Logitech Webcam Software (HKLM\...\{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}) (Version: 12.10.1113 - Logitech Inc.)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 Language Pack SP1 - deu (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 29.0.1 (x86 de) (HKLM\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Norton Internet Security (HKLM\...\NIS) (Version: 21.3.0.12 - Symantec Corporation)
NVIDIA 3D Vision Controller Driver (Version: 267.67 - NVIDIA Corporation) Hidden
NVIDIA 3D Vision Controller Driver 267.85 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 267.85 - NVIDIA Corporation)
NVIDIA 3D Vision Treiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 311.06 - NVIDIA Corporation)
NVIDIA Grafiktreiber 311.06 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 311.06 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.718 - NVIDIA Corporation) Hidden
NVIDIA PhysX (Version: 9.10.0514 - NVIDIA Corporation) Hidden
NVIDIA PhysX-Systemsoftware 9.10.0514 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.10.0514 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 311.06 (Version: 311.06 - NVIDIA Corporation) Hidden
NVIDIA Update 1.11.3 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update) (Version: 1.11.3 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
OpenAL (HKLM\...\OpenAL) (Version: - )
PDF24 Creator 6.3.2 (HKLM\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.3.2 - Frank Heindörfer, Philip Chinery)
Portal 2 (HKLM\...\Steam App 620) (Version: - Valve)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5408 - Realtek Semiconductor Corp.)
Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12064_9 - Samsung Electronics Co., Ltd.)
Samsung Kies (Version: 2.3.2.12064_9 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.6.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.11 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
South Park™: The Stick of Truth™ (HKLM\...\Steam App 213670) (Version: - Obsidian Entertainment)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
System Speedup (HKLM\...\System Speedup_is1) (Version: 2.1 - systemspeedup.com)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version: - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version: - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version: - Microsoft)
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Winamp (HKLM\...\Winamp) (Version: 5.623 - Nullsoft, Inc)
==================== Restore Points =========================
10-04-2014 15:31:55 Windows Update
11-04-2014 17:06:12 Geplanter Prüfpunkt
11-05-2014 08:59:09 Installed Java 7 Update 55
11-05-2014 17:14:26 Windows Update
30-05-2014 18:21:59 Geplanter Prüfpunkt
02-06-2014 10:03:48 Geplanter Prüfpunkt
05-06-2014 16:44:34 Geplanter Prüfpunkt
06-06-2014 12:39:35 Geplanter Prüfpunkt
11-06-2014 18:17:09 Windows Update
12-06-2014 13:41:54 Geplanter Prüfpunkt
16-06-2014 11:40:34 Geplanter Prüfpunkt
16-06-2014 20:07:29 System Speedup Mo, Jun 16, 14 22:06
==================== Hosts content: ==========================
2006-11-02 12:23 - 2006-09-18 23:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {02B9630A-9B27-4FC1-BA2E-5D75A4BBBEC6} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\VistaSP1CEIP => C:\Windows\servicing\vsp1ceip.exe [2008-01-19] (Microsoft Corporation)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1DD41E3C-5E1C-4231-A703-A99311E1C120} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-21] (Adobe Systems Incorporated)
Task: {3297E159-68F0-4907-88FD-094802B97CE8} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3387847C-483B-49CE-AD9A-DE6797754805} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {47A1F49B-ADE4-4DBC-AED3-0DE8CC4864B2} - System32\Tasks\Installation App Launcher => C:\Program Files\Lexmark 3600-4600 Series\ezprint.exe [2010-02-04] (Lexmark International Inc.)
Task: {4B4D2A08-8934-4DF4-9994-678DA97B3A65} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: {4C8F8085-8F06-4A52-8CBC-706608DAC37F} - System32\Tasks\System Speedup_UPDATES => C:\Program Files\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {5F8969D4-8A4F-43E6-A12C-B158089289A7} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation)
Task: {678565CE-91B9-4E05-9911-EDEE0991DDDC} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {85F64572-F867-4226-8ACC-D37AFA26DC0A} - System32\Tasks\System Speedup => C:\Program Files\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {A728AE6B-5AB8-4223-AD3E-E6341441A01C} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2012-04-19] ()
Task: {ED92F7AF-2B46-470D-BF99-776340A819E0} - System32\Tasks\System Speedup_DEFAULT => C:\Program Files\System Speedup\SystemSpeedup.exe [2013-12-13] (System Speedup)
Task: {EDB2F028-14E7-45F9-BAF2-619CFE4255AF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-21] (Google Inc.)
Task: {F8B4F1CA-6854-4362-9913-696FF21B55BD} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files\Norton Internet Security\Engine\21.3.0.12\SymErr.exe [2014-01-30] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\System Speedup_DEFAULT.job => C:\Program Files\System Speedup\SystemSpeedup.exe
Task: C:\Windows\Tasks\System Speedup_UPDATES.job => C:\Program Files\System Speedup\SystemSpeedup.exe
==================== Loaded Modules (whitelisted) =============
2012-04-23 10:05 - 2009-10-16 18:12 - 00147968 _____ () C:\Windows\system32\spool\PRTPROCS\W32X86\lxdxdrpp.dll
2012-04-23 10:02 - 2009-10-16 18:09 - 00811008 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdxptpc.dll
2012-04-23 10:02 - 2009-10-16 18:12 - 00162816 _____ () C:\Windows\system32\spool\DRIVERS\W32X86\3\lxdxdrui.dll
2012-04-23 09:56 - 2009-08-19 14:06 - 00782336 _____ () C:\Windows\system32\lxdxdrs.dll
2012-04-23 09:56 - 2009-08-19 14:06 - 00081920 _____ () C:\Windows\system32\lxdxcaps.dll
2012-04-23 09:56 - 2009-08-19 14:00 - 00069632 _____ () C:\Windows\system32\lxdxcnv4.dll
2009-10-14 13:36 - 2009-10-14 13:36 - 02793304 _____ () C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
2012-04-23 10:19 - 2010-02-04 01:27 - 00672424 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
2012-04-23 10:19 - 2010-02-04 00:41 - 00380928 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxscw.dll
2012-04-23 10:19 - 2010-02-04 00:52 - 00589824 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxdatr.dll
2012-04-23 10:19 - 2010-02-04 00:41 - 00782336 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxDRS.dll
2012-04-23 10:19 - 2010-02-04 00:41 - 00081920 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcaps.dll
2012-04-23 10:19 - 2010-02-04 00:28 - 00069632 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxcnv4.dll
2014-03-30 13:00 - 2014-03-30 13:00 - 00186368 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Commonc65c5a95#\21871ce315d4257cfe2052454e583368\Kies.Common.DeviceServiceLib.Interface.ni.dll
2014-03-30 13:01 - 2014-03-30 13:01 - 14971904 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.Theme\c94e1e76e67ad518b4310a539f072832\Kies.Theme.ni.dll
2014-03-30 13:00 - 2014-03-30 13:00 - 01842688 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.UI\0107366ee1ddeb3e9873c6fac6344bc1\Kies.UI.ni.dll
2014-03-30 13:00 - 2014-03-30 13:00 - 00081920 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\Kies.MVVM\8375369d3ac9c732c2ec8f6b5c9f2bb8\Kies.MVVM.ni.dll
2014-03-30 13:01 - 2014-03-30 13:01 - 00236032 _____ () C:\Windows\assembly\NativeImages_v4.0.30319_32\ASF_cSharpAPI\cffeb31975c17760187d713cf2d7934d\ASF_cSharpAPI.ni.dll
2014-04-10 17:39 - 2010-02-04 01:28 - 00025256 _____ () C:\Program Files\Lexmark 3600-4600 Series\lxdxMsdMon.exe
2014-04-10 17:39 - 2010-02-02 03:30 - 00028672 _____ () C:\Program Files\Lexmark 3600-4600 Series\App4R.Monitor.Common.dll
2014-04-10 17:39 - 2010-02-02 03:30 - 00036864 _____ () C:\Program Files\Lexmark 3600-4600 Series\App4R.Monitor.Core.dll
2014-04-10 17:39 - 2010-02-02 03:29 - 00061440 _____ () C:\Program Files\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.dll
2014-04-10 17:39 - 2007-11-22 03:55 - 00011776 _____ () C:\Program Files\Lexmark 3600-4600 Series\app4r.devmons.mcmdevmon.autoplayutil.dll
2009-10-14 13:34 - 2009-10-14 13:34 - 00560472 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
2014-05-10 20:53 - 2014-05-07 04:27 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
==================== EXE Association (whitelisted) =============
==================== MSCONFIG/TASK MANAGER disabled items =========
==================== Faulty Device Manager Devices =============
Name: Broadcom 802.11g-Netzwerkadapter
Description: Broadcom 802.11g-Netzwerkadapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Broadcom
Service: BCM43XV
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (06/17/2014 08:44:55 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm TUTO.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 16b4
Anfangszeit: 01cf8a5c2c35beea
Zeitpunkt der Beendigung: 1706
Error: (06/17/2014 08:44:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm package_plushd_offer_multilang.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 3e4
Anfangszeit: 01cf8a5bca0b969a
Zeitpunkt der Beendigung: 3
Error: (06/17/2014 08:44:22 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm predm.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 7c8
Anfangszeit: 01cf8a5bcd70ba9a
Zeitpunkt der Beendigung: 5
Error: (06/17/2014 08:43:54 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm _iu14D2N.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 10ec
Anfangszeit: 01cf8a5bcbdd706a
Zeitpunkt der Beendigung: 2
Error: (06/17/2014 08:43:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm majfst.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: d40
Anfangszeit: 01cf8a5b0b6bd83a
Zeitpunkt der Beendigung: 9
Error: (06/16/2014 11:38:58 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm dm.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1294
Anfangszeit: 01cf89aafb1ad088
Zeitpunkt der Beendigung: 4
Error: (06/16/2014 11:38:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm PLUSHD.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 15fc
Anfangszeit: 01cf89ab11cce758
Zeitpunkt der Beendigung: 3
Error: (06/16/2014 11:38:27 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm predm.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 11f0
Anfangszeit: 01cf89aaf2e538b8
Zeitpunkt der Beendigung: 5
Error: (06/16/2014 11:38:17 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm _iu14D2N.tmp, Version 51.52.0.0 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 1540
Anfangszeit: 01cf89aaedecf198
Zeitpunkt der Beendigung: 3
Error: (06/16/2014 11:06:43 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm firefox.exe, Version 29.0.1.5239 arbeitet nicht mehr mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem zu suchen.
Prozess-ID: 10ec
Anfangszeit: 01cf89a1263e19fc
Zeitpunkt der Beendigung: 28461
System errors:
=============
Error: (06/19/2014 04:57:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069
Error: (06/19/2014 04:57:12 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330
Error: (06/19/2014 04:55:35 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (06/19/2014 04:07:40 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069
Error: (06/19/2014 04:07:40 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330
Error: (06/19/2014 04:07:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: 30000Microsoft .NET Framework NGEN v4.0.30319_X86
Error: (06/19/2014 04:06:24 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (06/17/2014 08:35:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: NVIDIA Update Service Daemon%%1069
Error: (06/17/2014 08:35:36 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: nvUpdatusService.\UpdatusUser%%1330
Error: (06/17/2014 08:33:50 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Microsoft Office Sessions:
=========================
CodeIntegrity Errors:
===================================
Date: 2014-06-19 17:32:12.752
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:12.648
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:12.542
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:12.431
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:12.157
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:12.052
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:11.948
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:32:11.792
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:31:52.303
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\SYMEVENT.SYS" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2014-06-19 17:31:52.195
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\SYMEVENT.SYS" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 73%
Total physical RAM: 2045.45 MB
Available physical RAM: 539.12 MB
Total Pagefile: 4333.91 MB
Available Pagefile: 2492.31 MB
Total Virtual: 2047.88 MB
Available Virtual: 1888.23 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:288.04 GB) (Free:140.57 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (DATAPART1) (Fixed) (Total:298.09 GB) (Free:53.55 GB) NTFS
Drive e: (RECOVERY) (Fixed) (Total:10 GB) (Free:6.17 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 58000000)
Partition 1: (Not Active) - (Size=55 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=288 GB) - (Type=07 NTFS)
========================================================
Disk: 1 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: D9F1FF73)
Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Gmer.txt: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-19 17:54:00
Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-1 SAMSUNG_HD321KJ rev.CP100-11 298,09GB
Running: Gmer-19357.exe; Driver: C:\Users\Kristin\AppData\Local\Temp\fxdiafoc.sys
---- System - GMER 2.1 ----
SSDT 86DB3660 ZwAlertResumeThread
SSDT 86DB36F8 ZwAlertThread
SSDT 86DEDB88 ZwAllocateVirtualMemory
SSDT 86BF4A00 ZwAlpcConnectPort
SSDT 86DB30D8 ZwAssignProcessToJobObject
SSDT 86DB3488 ZwCreateMutant
SSDT 8733FA88 ZwCreateSymbolicLinkObject
SSDT 86EC5958 ZwCreateThread
SSDT 86DB3170 ZwDebugActiveProcess
SSDT 86DD5248 ZwDuplicateObject
SSDT 86DEDA18 ZwFreeVirtualMemory
SSDT 86DB3530 ZwImpersonateAnonymousToken
SSDT 86DB35C8 ZwImpersonateThread
SSDT 86B956E0 ZwLoadDriver
SSDT 86DED960 ZwMapViewOfSection
SSDT 86DB33F0 ZwOpenEvent
SSDT 8702E7C0 ZwOpenProcess
SSDT 86DEDC10 ZwOpenProcessToken
SSDT 86DB32C0 ZwOpenSection
SSDT 8702E398 ZwOpenThread
SSDT 86DB3030 ZwProtectVirtualMemory
SSDT 86DB3790 ZwResumeThread
SSDT 86DED7C8 ZwSetContextThread
SSDT 86DED820 ZwSetInformationProcess
SSDT 86DB3208 ZwSetSystemInformation
SSDT 86DB3358 ZwSuspendProcess
SSDT 86DB3828 ZwSuspendThread
SSDT 86D75848 ZwTerminateProcess
SSDT 86DB38C0 ZwTerminateThread
SSDT 86DED8C8 ZwUnmapViewOfSection
SSDT 86DEDAC0 ZwWriteVirtualMemory
SSDT 8733FB30 ZwCreateThreadEx
---- Kernel code sections - GMER 2.1 ----
.text ntkrnlpa.exe!KeSetEvent + 11D 826B0768 8 Bytes [60, 36, DB, 86, F8, 36, DB, ...] {PUSHA ; FILD DWORD [SS:ESI-0x7924c908]}
.text ntkrnlpa.exe!KeSetEvent + 131 826B077C 4 Bytes [88, DB, DE, 86]
.text ntkrnlpa.exe!KeSetEvent + 13D 826B0788 4 Bytes [00, 4A, BF, 86]
.text ntkrnlpa.exe!KeSetEvent + 191 826B07DC 4 Bytes [D8, 30, DB, 86]
.text ntkrnlpa.exe!KeSetEvent + 1F5 826B0840 4 Bytes [88, 34, DB, 86]
.text ...
? System32\drivers\bfpro.sys Das System kann den angegebenen Pfad nicht finden. !
---- User code sections - GMER 2.1 ----
.text C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[3804] ntdll.dll!DbgBreakPoint 770D878E 1 Byte [C3]
.text C:\Program Files\Mozilla Firefox\firefox.exe[4348] ntdll.dll!LdrLoadDll 770B9378 5 Bytes JMP 5B8C1EB1 C:\Program Files\Mozilla Firefox\mozglue.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!HeapSetInformation + 26 76E1A9B8 2 Bytes JMP 52C03A32 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!HeapSetInformation + 29 76E1A9BB 4 Bytes [DE, DB, EB, F9]
.text C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!LockResource + C 76E36BD3 7 Bytes JMP 535884D6 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4348] kernel32.dll!VirtualAllocEx + 54 76E3B030 7 Bytes JMP 535884F9 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4348] GDI32.dll!SetStretchBltMode + 256 76B3745C 7 Bytes JMP 53588457 C:\Program Files\Mozilla Firefox\xul.dll
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\tdx \Device\Tcp {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
AttachedDevice \Driver\tdx \Device\Tcp SYMTDIV.SYS
AttachedDevice \Driver\tdx \Device\Udp {af16abf4-eac1-49b4-93fc-58f6ca799135}Gt.sys
AttachedDevice \Driver\tdx \Device\Udp SYMTDIV.SYS
AttachedDevice \Driver\tdx \Device\RawIp SYMTDIV.SYS
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys
---- EOF - GMER 2.1 ----
bei GMER gab es ein Problem, bei dem ein Laufwerk nicht gefunden werden konnte.
17-6-2014-Malwarebytes-Scan.txt: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 17.06.2014
Scan Time: 21:06:17
Logfile: 17-6-2014-Malware.txt
Administrator: Yes
Version: 2.00.2.1012
Malware Database: v2014.06.17.10
Rootkit Database: v2014.06.02.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Kristin
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 277104
Time Elapsed: 16 min, 36 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 7
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.exe, 2564, , [e4aa2e4b0c6ff5417170a5c9cf320df3]
Adware.Tuto4PC, C:\Program Files\fst_de_36\fst_de_36.exe, 3848, , [137bd9a01a6136004bea69a3f50c16ea]
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, 3820, , [a6e850294e2dd56131b07bf3f8094fb1]
PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, 2740, , [dbb3bdbccbb0280e2b13acf7cd354fb1]
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.BrowserAdapter.exe, 3176, , [58363f3a4536e94da77d08af56aca35d]
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.PurBrowse.exe, 5724, , [58363f3a4536e94da77d08af56aca35d]
PUP.Optional.FirstSeenToday.A, C:\Program Files\fst_de_36\fst_de_36.exe, 3848, , [7b1317624833b284820ea80825dd1ee2]
Modules: 1
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll, , [58363f3a4536e94da77d08af56aca35d],
Registry Keys: 29
PUP.Optional.ToggleMark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update ToggleMark, , [e4aa2e4b0c6ff5417170a5c9cf320df3],
PUP.Optional.ToggleMark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util ToggleMark, , [a6e850294e2dd56131b07bf3f8094fb1],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\CLSID\{24ac098d-eb44-41b3-abaa-f4bc67d4d64d}, , [7a145722b7c4ad8935abde902cd522de],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{0ea930ca-41da-4b13-aad5-bc86c2a8ea17}, , [7a145722b7c4ad8935abde902cd522de],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{E2D6EC1B-0DB2-4B28-BBCB-FE6025A7A966}, , [7a145722b7c4ad8935abde902cd522de],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{24AC098D-EB44-41B3-ABAA-F4BC67D4D64D}, , [7a145722b7c4ad8935abde902cd522de],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\CLSID\{24AC098D-EB44-41B3-ABAA-F4BC67D4D64D}\INPROCSERVER32, , [7a145722b7c4ad8935abde902cd522de],
PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, , [335bb7c2de9d5adcba510f699d65a55b],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}, , [bdd1fc7db6c5f64001950e334db5c23e],
PUP.Optional.Softonic.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{E87806B5-E908-45FD-AF5E-957D83E58E68}, , [f6982e4b9ae12016c0d799a8d52d13ed],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{68B81CCD-A80C-4060-8947-5AE69ED01199}, , [523cf1880774cb6b7ab73246d72bfa06],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOW RIGHTS\ELEVATIONPOLICY\{E6B969FB-6D33-48d2-9061-8BBD4899EB08}, , [b8d680f9265555e1ef439bdd966c04fc],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, , [e6a85128cdae8aac0abc97e0de240df3],
PUP.Optional.VOPackage.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\vosr, , [dbb3bdbccbb0280e2b13acf7cd354fb1],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ToggleMark, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\Iminent, , [37579adf651687affd4eac1940c224dc],
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\ToggleMark, , [e7a75821ff7c3ff784a1a4130101c33d],
PUP.Optional.Iminent.A, HKLM\SOFTWARE\CLASSES\Iminent, , [1d710b6e55266accd8b33eb1ef1403fd],
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\FREE_SOFT_TODAY\fst_de_40, , [a9e583f6fc7fb284404fc0f0679baf51],
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\FREE_SOFT_TODAY\fst_de_48, , [3f4f126785f6f4422669416f679b27d9],
PUP.Optional.FreeSoftToday.A, HKLM\SOFTWARE\FST\fst_de_36, , [305e2356423945f156a705a1fa080df3],
PUP.Optional.ToggleMark.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\ToggleMark, , [cdc1c0b981fa11254dd9368123df36ca],
Adware.EoRezo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\fst_de_36_is1, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\fst_de_40_is1, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\fst_de_48_is1, , [6628a9d0d5a678be5b03563ed23044bc],
Registry Values: 8
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_36, "C:\Program Files\fst_de_36\fst_de_36.exe", , [137bd9a01a6136004bea69a3f50c16ea]
Adware.Tuto4PC, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_40, "C:\Program Files\fst_de_40\fst_de_40.exe", , [a0ee0b6e364552e48da837d5d829956b]
Backdoor.Bot.ED, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE|upfst_de_40.exe, C:\Users\Kristin\AppData\Local\fst_de_40\upfst_de_40.exe -runonce, , [5e306217cfac6accce8d631afd046f91]
PUP.Optional.Iminent.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS|{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, , [e6a85128cdae8aac0abc97e0de240df3],
PUP.Optional.Iminent.A, HKU\S-1-5-21-3444271574-3087294878-1149490491-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\URLSEARCHHOOKS\{84FF7BD6-B47F-46F8-9130-01B2696B36CB}, , [29650d6c265556e09a2cef888c769769],
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_36, "C:\Program Files\fst_de_36\fst_de_36.exe", , [7b1317624833b284820ea80825dd1ee2]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_40, "C:\Program Files\fst_de_40\fst_de_40.exe", , [55393445235876c05040fcb4bf433dc3]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_de_48, "C:\Program Files\fst_de_48\fst_de_48.exe", , [8a045a1f87f45cdabfd1a10f0002b54b]
Registry Data: 0
(No malicious items detected)
Folders: 27
PUP.Optional.FreeSoftToday.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst, , [dbb31e5bccafa69015e7188e8d75d828],
Adware.EoRezo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFT_TODAY, , [48468bee5f1c92a4ec68961d56acae52],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\TEMP, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.Iminent.A, C:\Program Files\IminentToolbar, , [197514659edd47ef579253379c6602fe],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy, , [eda15425136866d06a88543644bed62a],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\1988B6C156854B0C9A2CB4A2DFD14133, , [eda15425136866d06a88543644bed62a],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\2AFCA6F2C7994406BF5F38B8E3075A52, , [eda15425136866d06a88543644bed62a],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\OpenCandy_1988B6C156854B0C9A2CB4A2DFD14133, , [eda15425136866d06a88543644bed62a],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\OpenCandy_2AFCA6F2C7994406BF5F38B8E3075A52, , [eda15425136866d06a88543644bed62a],
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Local\Temp\Iminent, , [bdd17dfccfaca19559b28803936f1be5],
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Roaming\IminentToolbar, , [eea07009d7a40a2c447604883dc5ba46],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS, , [513d4732f08b6dc9acd58012cd3515eb],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36, , [533b4f2a6f0ca690c695474daf53b050],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36, , [533b4f2a6f0ca690c695474daf53b050],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36\1.10, , [533b4f2a6f0ca690c695474daf53b050],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\Download, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_48, , [bcd28cede794a98d164599fb59a948b8],
Adware.EoRezo, C:\Program Files\fst_de_36, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, C:\Program Files\fst_de_40, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, C:\Program Files\fst_de_48, , [6628a9d0d5a678be5b03563ed23044bc],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft, , [345ad6a3b2c9c175419ba9ef7c86718f],
Files: 136
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.exe, , [e4aa2e4b0c6ff5417170a5c9cf320df3],
Adware.Tuto4PC, C:\Program Files\fst_de_36\fst_de_36.exe, , [137bd9a01a6136004bea69a3f50c16ea],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, , [a6e850294e2dd56131b07bf3f8094fb1],
Adware.Tuto4PC, C:\Program Files\fst_de_40\fst_de_40.exe, , [a0ee0b6e364552e48da837d5d829956b],
Backdoor.Bot.ED, C:\Users\Kristin\AppData\Local\fst_de_40\upfst_de_40.exe, , [5e306217cfac6accce8d631afd046f91],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\ToggleMarkBHO.dll, , [7a145722b7c4ad8935abde902cd522de],
PUP.Optional.AirInstaller, C:\$Recycle.Bin\S-1-5-21-3444271574-3087294878-1149490491-1000\$RQDVMBM.exe, , [0985a6d3f28983b3b89ff62946bb1ae6],
PUP.Optional.SoftonicTB.A, C:\Users\Kristin\AppData\Local\Temp\softonic_ggl_1.6.7.4.exe, , [4f3f7504afcc70c67d98780344bd1be5],
PUP.Optional.FirstSeenToday, C:\Users\Kristin\AppData\Local\Temp\n4660\fst_de_0606-88a44852.exe, , [6e206712d2a9b0865808b0d406fb837d],
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Local\Temp\n4660\Iminent_1712-b2fcad5e.exe, , [bbd329507407989e9ff105425da4a15f],
PUP.Optional.BundleInstaller.A, C:\Users\Kristin\AppData\Local\Temp\n4660\s4660.exe, , [2e60d4a597e46ec8401e8dba36ca2ed2],
PUP.Optional.GenericExt.A, C:\Users\Kristin\AppData\Local\Temp\igdhbblpcellaljokkpfhcjlagemhgjl87d4\minibarchrome.exe, , [75194e2bf18adc5aa79a82bb9b656b95],
PUP.Optional.InstallMonetizer.NS, C:\Users\Kristin\AppData\Local\Temp\is-4JCBD.tmp\IMNS.exe, , [f599f8815427d363b19162285ba62ed2],
PUP.Optional.InstallMonetizer.NS, C:\Users\Kristin\AppData\Local\Temp\is-URVQ7.tmp\IMNS.exe, , [75194e2badce5dd979c91575fd04b64a],
PUP.Optional.Softonic.A, C:\Users\Kristin\Downloads\SoftonicDownloader_fuer_free-guitar-tuner.exe, , [543a7dfc750667cf1a816eb5a25fdf21],
PUP.Optional.OpenCandy, C:\Users\Kristin\Downloads\winamp5623_full_emusic-7plus_de-de(1).exe, , [f09e97e2b7c4d0664428920d7e8650b0],
PUP.Optional.OpenCandy, C:\Users\Kristin\Downloads\winamp5623_full_emusic-7plus_de-de.exe, , [99f5b3c67cff82b4b0bc4f508183dc24],
Backdoor.Bot.ED, C:\Users\Kristin\AppData\Local\fst_de_36\upfst_de_36.exe, , [4a4442373a4139fdfe5ddba2ed14d42c],
PUP.Optional.FreeSoft, C:\Users\Kristin\AppData\Local\fst_de_40\Download\majfst.exe, , [69256316cead112508e3710b52af8b75],
PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, , [dbb3bdbccbb0280e2b13acf7cd354fb1],
PUP.Optional.FreeSoftToday.A, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\fst\Freesofttoday.lnk, , [dbb31e5bccafa69015e7188e8d75d828],
PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOPackage.exe, , [39552d4ce39874c25c64cbe108fa1ee2],
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage, , [444a4237374410260c49bdf0659dd22e],
Adware.EoRezo, C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFT_TODAY\Freesofttoday.lnk, , [48468bee5f1c92a4ec68961d56acae52],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\ToggleMark.ico, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\0, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\7za.exe, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\ToggleMarkUninstall.exe, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.InstallState, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\7za.exe, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\BrowserAdapterS.7z, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.BrowserAdapter.exe, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.PurBrowse.exe, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMark.PurBrowseG.zip, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\ToggleMarkBAApp.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.InstallState, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.Bromon.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.BroStats.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.BrowserAdapterS.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.CompatibilityChecker.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.FFUpdate.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.IEUpdate.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\plugins\ToggleMark.PurBrowseG.dll, , [58363f3a4536e94da77d08af56aca35d],
PUP.Optional.PCPerformer.A, C:\Windows\System32\roboot.exe, , [523c3544fb8080b668f0aa311fe4e11f],
PUP.Optional.FirstSeenToday.A, C:\Program Files\fst_de_36\fst_de_36.exe, , [7b1317624833b284820ea80825dd1ee2],
PUP.Optional.FirstSeenToday.A, C:\Program Files\fst_de_40\fst_de_40.exe, , [55393445235876c05040fcb4bf433dc3],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\1988B6C156854B0C9A2CB4A2DFD14133\driverscannerROE.exe, , [eda15425136866d06a88543644bed62a],
PUP.Optional.OpenCandy, C:\Users\Kristin\AppData\Roaming\OpenCandy\2AFCA6F2C7994406BF5F38B8E3075A52\speedupmypcROE.exe, , [eda15425136866d06a88543644bed62a],
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Roaming\IminentToolbar\sqlite3.dll, , [eea07009d7a40a2c447604883dc5ba46],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\174.crx, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\174.dll, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\174.xpi, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\a.db, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\b.db, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurf.exe, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfA.exe, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfbx174.bin, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfbx174.dll, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfbx174.exe, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\Sqlite3.dll, , [513d4732f08b6dc9acd58012cd3515eb],
PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\Uninstall.exe, , [513d4732f08b6dc9acd58012cd3515eb],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\upfst_de_36.cyp, , [533b4f2a6f0ca690c695474daf53b050],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36\1.10\cnf.cyl, , [533b4f2a6f0ca690c695474daf53b050],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_36\fst_de_36\1.10\eorezo.cyl, , [533b4f2a6f0ca690c695474daf53b050],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\upfst_de_40.cyp, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\Download\majfst.exe, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10\cnf.cyl, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10\eorezo.cyl, , [276738411863c86e5803157f1be7e11f],
Adware.EoRezo, C:\Program Files\fst_de_36\freeSoftToday_widget.exe, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, C:\Program Files\fst_de_36\predm.exe, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, C:\Program Files\fst_de_36\unins000.dat, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, C:\Program Files\fst_de_36\unins000.exe, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, C:\Program Files\fst_de_36\unins000.msg, , [bbd32f4afc7f8fa7035b8e0607fbd22e],
Adware.EoRezo, C:\Program Files\fst_de_40\freeSoftToday_widget.exe, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, C:\Program Files\fst_de_40\predm.exe, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, C:\Program Files\fst_de_40\unins000.dat, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, C:\Program Files\fst_de_40\unins000.exe, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, C:\Program Files\fst_de_40\unins000.msg, , [7816e39644373df993cbc0d4e31f5aa6],
Adware.EoRezo, C:\Program Files\fst_de_48\freeSoftToday_widget.exe, , [6628a9d0d5a678be5b03563ed23044bc],
Adware.EoRezo, C:\Program Files\fst_de_48\predm.exe, , [6628a9d0d5a678be5b03563ed23044bc],
Adware.EoRezo, C:\Program Files\fst_de_48\unins000.dat, , [6628a9d0d5a678be5b03563ed23044bc],
Adware.EoRezo, C:\Program Files\fst_de_48\unins000.exe, , [6628a9d0d5a678be5b03563ed23044bc],
Adware.EoRezo, C:\Program Files\fst_de_48\unins000.msg, , [6628a9d0d5a678be5b03563ed23044bc],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\173.dll, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\173.xpi, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\a.db, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\b.db, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\Sqlite3.dll, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\Uninstall.exe, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordFIXQNw.exe, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordKT173.bin, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordKT173.dll, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft\ViewPasswordKT173.exe, , [345ad6a3b2c9c175419ba9ef7c86718f],
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.admin", false);), ,[226c9edb6f0cd06633d65f4a739125db]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.aflt", "SD");), ,[3b53e3965328d1656c9d41688d7717e9]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.autoRvrt", "false");), ,[85094435fd7e35017a8f3376768ec33d]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.cntry", "us");), ,[cac4f4856c0f48ee24e5c4e500046e92]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.cv", "cv5");), ,[434b31485b2067cf15f46c3d16ee23dd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dfltLng", "de");), ,[d4badf9a0873fe3847c29613d232e51b]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.dfltsrch", "false");), ,[b7d76c0d6219e94d1ced149520e438c8]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.envrmnt", "production");), ,[4e40fc7d215abd79f6137d2c15ef33cd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.excTlbr", false);), ,[47470b6e136810264bbe7e2b20e455ab]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hdrMd5", "E370ED6FEB49DCC81B588F9B58078655");), ,[ade19ddcadcec2743bced6d372927b85]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hmpg", false);), ,[3658bebbdd9ed75ff1187a2f18ec52ae]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.hrdid", "d2a4837e000000000000001aa099324c");), ,[fb9337423f3ce25437d2d6d3c143ab55]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.id", "d2a4837e000000000000001aa099324c");), ,[513d1a5fd7a47fb706033970cb39f010]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.instlDay", "15590");), ,[a3eb5920cface74ff1185d4c46be7987]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.instlRef", "MON00015");), ,[f896f782bdbeb08663a62881e32123dd]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.isdcmntcmplt", "false");), ,[5e304c2d83f8a492e9205b4ee024fb05]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.keywordurl", "");), ,[5e303b3ef7842c0a8287ecbd59ab26da]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.lastVrsnTs", "1.6.7.419:01:44");), ,[632b542553280c2a49c06a3fe61e35cb]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.mntrvrsn", "1.3.0");), ,[206ee693cdaec86e0cfdb3f65ea67888]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.monitorreport", true);), ,[c5c989f0b4c7d75f7f8a218833d1b64a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newTab", false);), ,[dbb34732f88366d0c8415a4f09fb639d]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newtab", "false");), ,[28664c2d1269ca6c51b87336bd47c63a]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.newtaburl", "");), ,[088694e5b2c960d65aaf1e8bba4a7987]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.prdct", "Softonic");), ,[b7d73544374473c35eab02a7d2327888]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.propectorlck", 86165111);), ,[701ea9d09edd65d1719870391ce8ef11]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.prtnrId", "softonic");), ,[e4aa1267106bc76f23e6b3f60bf9ac54]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.radiomystations", "[{\"id\":\"1069\",\"name\":\"ORS Rom�ntica en espa�ol\",\"url\":\"hxxp://www.orsradio.com/oldies56k.asx\",\"streamType\":\"mp\"},{\"id\":\"1213\",\"name\":\"ORS Top Hits\",\"url\":\"hxxp://www.orsradio.com/tophits128k.asx\",\"streamType\":\"mp\"},{\"id\":\"1952\",\"name\":\"Dance Radio\",\"url\":\"hxxp://www.play.cz/radio/danceradio128.asx\",\"streamType\":\"mp\"},{\"id\":\"323\",\"name\":\"Sky Love\",\"url\":\"hxxp://www.sky.fm/wma/lovemusic.asx\",\"streamType\":\"mp\"},{\"id\":\"3300\",\"name\":\"Sky Blue Radio\",\"url\":\"hxxp://www.skyblueradio.com/skyblueradio.asx\",\"streamType\":\"mp\"},{\"id\":\"3672\",\"name\":\"RIGHTONSCALES REGGAE RADIO\",\"url\":\"mms://win2.fast-serv.com/ros\",\"streamType\":\"mp\"},{\"id\":\"4948\",\"name\":\"ORS Radio - Poptop\",\"url\":\"hxxp://www.orsradio.com/poptop128k.asx\",\"streamType\":\"mp\"},{\"id\":\"5375\",\"name\":\"ORS Radio - Country\",\"url\":\"hxxp://www.orsradio.com/country128k.asx\",\"streamType\":\"mp\"},{\"id\":\"5440\",\"name\":\"SomaFM: Space Station 128k\",\"url\":\"hxxp://somafm.com/wma128/spacestation.asx\",\"streamType\":\"mp\"},{\"id\":\"5464\",\"name\":\"Community listening network - garinger.org\",\"url\":\"hxxp://asx.abacast.com/ccr-ccr-20.asx\",\"streamType\":\"mp\"},{\"id\":\"560\",\"name\":\"Soma FM Sonic Universe\",\"url\":\"hxxp://somafm.com/wma128/sonicuniverse.asx\",\"streamType\":\"mp\"},{\"id\":\"8396\",\"name\":\"Radio.isg.si\",\"url\":\"hxxp://radio.isg.si:8000/radio.isg.si.mp3.m3u\",\"streamType\":\"mp\"},{\"id\":\"9639\",\"name\":\"soma fm - DroneZone 32K\",\"url\":\"hxxp://somafm.com/wma/dronezone.asx\",\"streamType\":\"mp\"}]");), ,[305e2851dba07bbb25e461480ff5bb45]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.rvrtMsg", "Click Yes to keep current home page and default search settings, Click No to restore original settings");), ,[672721581f5c1c1a0bfedbcec93b05fb]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.savedVrsnTs", "1");), ,[226c5326116a63d38a7f1297b74de719]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.sg", "az");), ,[8905da9f3645cd6919f033762bd98c74]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.smplGrp", "none");), ,[5638fe7b2b502e082edb2d7cad5714ec]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.srch", "");), ,[c2ccadcc81facf6779906643b94b1be5]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.srchprvdr", "");), ,[e8a6e0995526181e54b5b4f51aea13ed]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.tlbrId", "base");), ,[b0ded2a7700b67cfee1b9019e51fac54]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MON00015/tb_v1?SearchSource=1&cc=&q=");), ,[dab43e3b4536eb4bee1b713806fe19e7]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsn", "1.6.7.4");), ,[e9a57207c7b40333e9206f3a0400c53b]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsnTs", "1.6.7.419:01:44");), ,[c8c6344516655dd947c2cadf9a6ad030]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic.vrsni", "1.6.7.4");), ,[e2ac3f3a7b005ed8a8618227f50f45bb]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic_i.newTab", false);), ,[f9958ced0378ed4932d744658381f010]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic_i.smplGrp", "none");), ,[9df162173b4060d63dccccdd0cf824dc]
PUP.Optional.Softonic.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\prefs.js, Good: (), Bad: (user_pref("extensions.Softonic_i.vrsnTs", "1.6.7.419:01:44");), ,[39553346a3d8cb6bfd0cccdd5ca8e51b]
PUP.Optional.Iminent.A, C:\Users\Kristin\AppData\Roaming\Mozilla\Firefox\Profiles\e4x2ivuo.default\user.js, Good: (), Bad: (user_pref("extensions.iminent.tlbrSrchUrl", "hxxp://start.iminent.com/?ref=toolbarm#q=");), ,[8c024c2d255661d506f7a9ff11f3a060]
Physical Sectors: 0
(No malicious items detected)
(end)
17-6-2014-Malwarebytes-Protection.txt: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Protection, 17.06.2014 21:05:02, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting,
Protection, 17.06.2014 21:05:04, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started,
Protection, 17.06.2014 21:05:04, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Update, 17.06.2014 21:05:30, SYSTEM, KRISTIN-PC, Manual, Rootkit Database, 2014.2.20.1, 2014.6.2.1,
Update, 17.06.2014 21:05:47, SYSTEM, KRISTIN-PC, Manual, Malware Database, 2014.3.4.9, 2014.6.17.10,
Protection, 17.06.2014 21:05:59, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting,
Protection, 17.06.2014 21:06:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Protection, 17.06.2014 21:06:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 17.06.2014 21:06:02, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 17.06.2014 21:06:06, SYSTEM, KRISTIN-PC, Protection, Refresh, Success,
Protection, 17.06.2014 21:06:06, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 17.06.2014 21:06:06, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Detection, 17.06.2014 21:06:20, Kristin, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.FreeSoftToday.A, C:\Users\Kristin\AppData\Local\Temp\nsc915C.tmp, Quarantine, [f69856234f2ce155b9593f4cf70a837d]
Protection, 17.06.2014 21:06:20, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Local\Temp\nsc915C.tmp,
Error, 17.06.2014 21:06:20, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Local\Temp\nsc915C.tmp,
Detection, 17.06.2014 21:07:00, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, Adware.Tuto4PC, C:\Program Files\fst_de_48\fst_de_48.exe, Quarantine, [404e35442d4eb482e45135d712ef3ac6]
Detection, 17.06.2014 21:07:02, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_48\upfst_de_48.exe, Quarantine, [67279bde364531055efd61335da57e82]
Detection, 17.06.2014 21:07:46, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.BlockAndSurf.A, C:\Program Files\BlockAndSurfS\BlockAndSurfB72.exe, Quarantine, [abe35425cab111253a4793ff41c1ec14]
Detection, 17.06.2014 21:31:36, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\updateToggleMark.exe, Quarantine, [91fdd8a192e93ff77e63452947ba0af6]
Protection, 17.06.2014 21:31:36, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\updateToggleMark.exe,
Error, 17.06.2014 21:31:36, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\updateToggleMark.exe,
Detection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.ToggleMark.A, C:\Program Files\ToggleMark\bin\utilToggleMark.exe, Quarantine, [e4aa82f7a7d40e28b62bf777c23f6898]
Protection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\bin\utilToggleMark.exe,
Error, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Program Files\ToggleMark\bin\utilToggleMark.exe,
Detection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, Malware Protection, File, PUP.Optional.VOPackage.A, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe, Quarantine, [266889f0e992f14581bdbae9c04240c0]
Protection, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe,
Error, 17.06.2014 21:31:37, SYSTEM, KRISTIN-PC, Protection, DeleteFile, 5, Failed, C:\Users\Kristin\AppData\Roaming\VOPackage\VOsrv.exe,
(end)
19-6-2014-Malwarebytes-Scan.txt: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Scan Date: 19.06.2014
Scan Time: 16:23:26
Logfile: 19-6-2014-Malware.txt
Administrator: Yes
Version: 2.00.2.1012
Malware Database: v2014.06.19.06
Rootkit Database: v2014.06.02.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled
OS: Windows Vista Service Pack 2
CPU: x86
File System: NTFS
User: Kristin
Scan Type: Threat Scan
Result: Completed
Objects Scanned: 277468
Time Elapsed: 20 min, 22 sec
Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled
Processes: 0
(No malicious items detected)
Modules: 0
(No malicious items detected)
Registry Keys: 0
(No malicious items detected)
Registry Values: 0
(No malicious items detected)
Registry Data: 0
(No malicious items detected)
Folders: 9
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40, Quarantined, [56fca2d8e8932f071ddd12839969d62a],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\Download, Quarantined, [56fca2d8e8932f071ddd12839969d62a],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40, Quarantined, [56fca2d8e8932f071ddd12839969d62a],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_40\fst_de_40\1.10, Quarantined, [56fca2d8e8932f071ddd12839969d62a],
Adware.EoRezo, C:\Users\Kristin\AppData\Local\fst_de_48, Quarantined, [f959a6d48bf0c86ec337791cf60c946c],
Adware.EoRezo, C:\Program Files\fst_de_36, Quarantined, [034ff387c2b92c0a96679005b74bde22],
Adware.EoRezo, C:\Program Files\fst_de_40, Quarantined, [6ae84f2ba5d62511619cc2d3c939b24e],
Adware.EoRezo, C:\Program Files\fst_de_48, Quarantined, [60f2a5d5d1aa122439c4b4e1b44e8b75],
PUP.Optional.ViewPassword.A, C:\Program Files\ViewPassword-soft, Quarantined, [f260f585c1baaa8cd5a41486010120e0],
Files: 0
(No malicious items detected)
Physical Sectors: 0
(No malicious items detected)
(end)
19-6-2014-Malwarebytes-Protection.txt: Code:
Malwarebytes Anti-Malware
www.malwarebytes.org
Protection, 19.06.2014 16:04:55, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting,
Protection, 19.06.2014 16:04:55, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started,
Protection, 19.06.2014 16:04:55, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 19.06.2014 16:05:18, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Update, 19.06.2014 16:23:16, SYSTEM, KRISTIN-PC, Manual, Malware Database, 2014.6.17.10, 2014.6.19.6,
Protection, 19.06.2014 16:23:19, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting,
Protection, 19.06.2014 16:23:19, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 19.06.2014 16:23:20, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 19.06.2014 16:23:31, SYSTEM, KRISTIN-PC, Protection, Refresh, Success,
Protection, 19.06.2014 16:23:31, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 19.06.2014 16:24:04, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Update, 19.06.2014 16:41:26, SYSTEM, KRISTIN-PC, Scheduler, Malware Database, 2014.6.19.6, 2014.6.19.7,
Protection, 19.06.2014 16:42:00, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting,
Protection, 19.06.2014 16:42:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 19.06.2014 16:42:00, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 19.06.2014 16:42:59, SYSTEM, KRISTIN-PC, Protection, Refresh, Success,
Protection, 19.06.2014 16:42:59, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 19.06.2014 16:43:06, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Protection, 19.06.2014 16:54:38, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting,
Protection, 19.06.2014 16:54:38, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started,
Protection, 19.06.2014 16:54:38, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 19.06.2014 16:54:57, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Protection, 19.06.2014 17:36:10, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 19.06.2014 17:36:11, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 19.06.2014 17:36:11, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Stopping,
Protection, 19.06.2014 17:36:27, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Stopped,
Protection, 19.06.2014 18:15:23, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Starting,
Protection, 19.06.2014 18:15:23, SYSTEM, KRISTIN-PC, Protection, Malware Protection, Started,
Protection, 19.06.2014 18:15:23, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 19.06.2014 18:15:24, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
Update, 19.06.2014 18:46:01, SYSTEM, KRISTIN-PC, Scheduler, Malware Database, 2014.6.19.7, 2014.6.19.8,
Protection, 19.06.2014 18:46:19, SYSTEM, KRISTIN-PC, Protection, Refresh, Starting,
Protection, 19.06.2014 18:46:19, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopping,
Protection, 19.06.2014 18:46:19, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Stopped,
Protection, 19.06.2014 18:46:23, SYSTEM, KRISTIN-PC, Protection, Refresh, Success,
Protection, 19.06.2014 18:46:23, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Starting,
Protection, 19.06.2014 18:46:24, SYSTEM, KRISTIN-PC, Protection, Malicious Website Protection, Started,
(end)
Noch einmal vielen Dank für die Hilfe. |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
