Trojaner-Board - Google Chrome und Firefox funktionieren nach Anwendung von Malwarebytes nicht mehr

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Google Chrome und Firefox funktionieren nach Anwendung von Malwarebytes nicht mehr (https://www.trojaner-board.de/157819-google-chrome-firefox-funktionieren-anwendung-malwarebytes-mehr.html)

Google Chrome und Firefox funktionieren nach Anwendung von Malwarebytes nicht mehr

Hallo,

folgende Probleme hatte ich auf meinem Rechner mit dem Firefox/ Chrome und Internet Explorer: Werbung öffnete sich ständig. Neue Fenster gingen auf. Ich installierte Malwarebytes. Nach einem Virenscan verschob ich alles was gefunden wurde in Quarantäne. Werbung war nun weg. Zuerst ging der Firefox noch, dann nicht mehr. Auch andere Browser funktionieren nicht mehr. Habe Malwarebytes deinstalliert. Jetzt geht immer noch nichts mehr. Hoffe, ihr könnt mir helfen.
Ich hoffe das genügt erstmal an Informationen zum Beginnen der Hilfe.

Habe nun Schritt 1- 3 aus der Anleitung für Hilfesuchende auf meinem Rechner durchgeführt. Die Ergebnisse hänge ich euch an.

Mit freundlichen Grüßen, Robert

Hi,

Logs bitte immer in den Thread posten. Zur Not aufteilen und mehrere Posts nutzen.
Ich kann auf Arbeit keine Anhänge öffnen, danke.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

http://www.trojaner-board.de/picture...&pictureid=307

Code:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-08-2014 01

Ran by Norman at 2014-08-20 10:31:08

Running from C:\Users\Norman\Desktop

Boot Mode: Normal

==========================================================
 
 

==================== Security Center ========================
 

(If an entry is included in the fixlist, it will be removed.)
 

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
 

==================== Installed Programs ======================
 

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 

 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)

1&1 Surf-Stick (HKLM-x32\...\{A9E5EDA7-2E6C-49E7-924B-A32B89C24A04}) (Version: 1.0.0.2 - )

7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version:  - )

Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 4.0.0.1390 - Adobe Systems Incorporated)

Adobe AIR (x32 Version: 4.0.0.1390 - Adobe Systems Incorporated) Hidden

Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)

Adobe Reader 9.1 MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated)

AnyProtect (HKLM-x32\...\AnyProtect) (Version: 1.0.0.0 - CMI Limited) <==== ATTENTION

Apple Application Support (HKLM-x32\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)

Apple Mobile Device Support (HKLM\...\{75104836-CAC7-444E-A39E-3F54151942F5}) (Version: 4.0.0.97 - Apple Inc.)

Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

ASUS AI Recovery (HKLM-x32\...\{06585B02-F20D-4AB2-9A64-86EF2AE0F8F0}) (Version: 1.0.9 - ASUS)

ASUS AP Bank (HKLM-x32\...\ASUS AP Bank_is1) (Version: 1.0.0.0 - ASUSTEK)

ASUS CopyProtect (HKLM-x32\...\{6B77A7F6-DD63-4F13-A6FF-83137A5AC354}) (Version: 1.0.0015 - ASUS)

ASUS FancyStart (HKLM-x32\...\{2B81872B-A054-48DA-BE3B-FA5C164C303A}) (Version: 1.0.8 - ASUSTeK Computer Inc.)

ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.20 - ASUS)

ASUS Live Update (HKLM-x32\...\{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}) (Version: 2.5.9 - ASUS)

ASUS MultiFrame (HKLM-x32\...\{9D48531D-2135-49FC-BC29-ACCDA5396A76}) (Version: 1.0.0021 - ASUS)

ASUS Power4Gear Hybrid (HKLM\...\{91EFE3A1-585E-4F66-B5F6-F118F56C4C47}) (Version: 1.1.35 - ASUS)

ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0008 - ASUS)

ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 1.02.0028 - ASUS)

ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.19 - asus)

ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 2.0.46.1429 - eCareme Technologies, Inc.)

ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0003 - ASUS)

awesomehp uninstaller (HKLM-x32\...\awesomehp uninstaller) (Version:  - awesomehp) <==== ATTENTION

BMWi-Softwarepaket 9.1 (HKLM-x32\...\{76C11599-B4CC-4509-B93C-EA8C8D7EE56E}) (Version: 9.1.0 - A2C Software AG, Aachen)

Boingo Wi-Fi (HKLM-x32\...\{B653A2EC-D816-4498-A4FD-651047AB9DC9}) (Version: 1.7.0048 - Boingo Wireless, Inc.)

Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)

Call of Duty(R) 2 (HKLM-x32\...\InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}) (Version: 1.2 - Activision)

Call of Duty(R) 2 (x32 Version: 1.2 - Activision) Hidden

CanoScan LiDE 70 (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ2411) (Version:  - )

Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) Hidden

Citavi (HKLM-x32\...\{E12C6653-1FF0-4686-ADB8-589C13AE761F}) (Version: 3.4.0.2 - Swiss Academic Software)

Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)

Conduit Engine (HKLM-x32\...\conduitEngine) (Version:  - Conduit Ltd.) <==== ATTENTION

Conexant HD Audio (HKLM\...\CNXT_AUDIO_HDA) (Version: 4.98.18.65 - Conexant)

ControlDeck (HKLM-x32\...\{5B65EF64-1DFA-414A-8C94-7BB726158E21}) (Version: 1.0.6 - ASUS)

CooiLSalEECoUpon (HKLM-x32\...\{0C516764-8CFC-C2FE-7BB0-A50A646E4DCD}) (Version:  - CoiolSAleCoUpoN) <==== ATTENTION

CPU Miner (HKLM-x32\...\CPUMiner) (Version: 1.0 - WinTuneUp Apps. )

CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1908 - CyberLink Corp.)

CyberLink LabelPrint (x32 Version: 2.5.1908 - CyberLink Corp.) Hidden

CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)

CyberLink Power2Go (x32 Version: 6.1.3602c - CyberLink Corp.) Hidden

Dream Day Wedding Married in Manhattan (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115233673}) (Version:  - Oberon Media)

DriverTuner 3.0.1.0 (HKLM-x32\...\{520C1D80-935C-42B9-9340-E883849D804F}_is1) (Version: 3.0.0.1 - LionSea SoftWare)

DVDVideoSoftTB Toolbar (HKLM-x32\...\DVDVideoSoftTB Toolbar) (Version: 6.3.3.3 - DVDVideoSoftTB)

EA Download Manager (HKLM-x32\...\InstallShield_{EF7E931D-DC84-471B-8DB6-A83358095474}) (Version: 4.0.0.462 - Electronic Arts)

EA Download Manager (x32 Version: 4.0.0.462 - Electronic Arts) Hidden

ETDWare PS/2-x64 7.0.5.10_WHQL (HKLM\...\Elantech) (Version: 7.0.5.10 - ELAN Microelectronics Corp.)

Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.5 - ASUS)

Free Mp3 Wma Converter V 2.2 (HKLM-x32\...\Free Mp3 Wma Converter_is1) (Version: 2.2.0.0 - Koyote Soft)

Free YouTube to MP3 Converter version 3.11.35.1031 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.11.35.1031 - DVDVideoSoft Ltd.)

FreeCommander XE (HKLM-x32\...\FreeCommander XE_is1) (Version: Preview - Marek Jasinski)

FUSSBALL MANAGER 12 (HKLM-x32\...\FUSSBALL MANAGER 12) (Version: 1.0.0.3 - Electronic Arts)

G*Power 3.1.7 (HKLM-x32\...\{80A4F598-7460-41BC-AC15-B7E4545838E4}) (Version: 3.1.7 - Franz Faul, Uni Kiel, Germany)

Game Park Console (HKLM-x32\...\{C9991C9B-0783-452E-8954-AB93E2AB3B80}_is1) (Version: 6.2.0.2 - Oberon Media, Inc.)

Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.143 - Google Inc.)

Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)

Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden

HP Deskjet 3050A J611 series - Grundlegende Software für das Gerät (HKLM\...\{61ADDE9C-3AE6-46FC-9127-DFFF637AED03}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

HP Deskjet 3050A J611 series Hilfe (HKLM-x32\...\{97DDCAB8-B770-4089-A10F-67568069D78A}) (Version: 140.0.2.2 - Hewlett Packard)

HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)

HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)

ICQ7.2 (HKLM-x32\...\{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}) (Version: 7.2 - ICQ)

IGI 2 (HKLM-x32\...\IGI 2) (Version:  - )

Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)

Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2104 - Intel Corporation)

Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)

Intel(R) Turbo Boost Technology Monitor (HKLM\...\{39F4C6F9-618A-4E5B-8FB2-6BD661174E32}) (Version: 1.0.115.11 - Intel)

Internet Explorer Toolbar 4.6 by SweetPacks (HKLM-x32\...\{C3E85EE9-5892-4142-B537-BCEB3DAC4C3D}) (Version: 4.6.0004 - SweetIM Technologies Ltd.) <==== ATTENTION

Java 7 Update 9 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217009FF}) (Version: 7.0.90 - Oracle)

Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden

JMicron Ethernet Adapter NDIS Driver (HKLM-x32\...\{96DCEE2F-98EE-4F80-8C0F-7C04D1FB9D7F}) (Version: 6.0.17.1 - JMicron Technology Corp.)

JMicron Flash Media Controller Driver (HKLM-x32\...\{26604C7E-A313-4D12-867F-7C6E7820BE4C}) (Version: 1.0.33.2 - JMicron Technology Corp.)

Junk Mail filter update (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

K_Series_ScreenSaver_EN (HKLM-x32\...\K_Series_ScreenSaver_EN) (Version:  - )

Lernspiele Englisch (HKLM-x32\...\Lernspiele Englisch) (Version:  - )

MATLAB R2009b (HKLM\...\MatlabR2009b) (Version: 7.9 - The MathWorks, Inc.)

Medieval II Total War : Kingdoms : Americas (HKLM-x32\...\{75983B66-804C-40D1-BA13-64DAF652A6F1}) (Version: 1.03.000 - SEGA)

Medieval II Total War : Kingdoms : Britannia (HKLM-x32\...\{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}) (Version: 1.03.000 - SEGA)

Medieval II Total War : Kingdoms : Crusades (HKLM-x32\...\{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}) (Version: 1.03.000 - SEGA)

Medieval II Total War : Kingdoms : Teutonic (HKLM-x32\...\{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}) (Version: 1.03.000 - SEGA)

Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)

Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)

Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)

Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Klick-und-Los 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden

Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden

Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden

Microsoft Office XP Professional mit FrontPage (HKLM-x32\...\{90280407-6000-11D3-8CFE-0050048383C9}) (Version: 10.0.6626.0 - Microsoft Corporation)

Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0407-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)

Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden

Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)

Microsoft Sync Framework Runtime Native v1.0 (x86) (HKLM-x32\...\{8A74E887-8F0F-4017-AF53-CBA42211AAA5}) (Version: 1.0.1215.0 - Microsoft Corporation)

Microsoft Sync Framework Services Native v1.0 (x86) (HKLM-x32\...\{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}) (Version: 1.0.1215.0 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)

Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Mobogenie (HKLM-x32\...\Mobogenie) (Version:  - Mobogenie.com) <==== ATTENTION

MotoGP (HKLM-x32\...\MotoGP_is1) (Version:  - THQ)

MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden

MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)

MSXML 4.0 SP3 Parser (KB973685) (HKLM-x32\...\{859DFA95-E4A6-48CD-B88E-A3E483E89B44}) (Version: 4.30.2107.0 - Microsoft Corporation)

MT66 Software Update (HKLM-x32\...\{F2E4F3A5-A8F0-46F4-8E91-E8C1DE1FCFE5}_is1) (Version:  - )

Nero 7 Essentials (HKLM-x32\...\{C6115A28-F277-4E82-B067-84D28BF21031}) (Version: 7.03.1357 - Nero AG)

neroxml (x32 Version: 1.0.0 - Nero AG) Hidden

Nur Deinstallierung der CopyTrans Suite möglich. (HKCU\...\CopyTrans Suite) (Version: 2.23 - WindSolutions)

NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.58.36 - NVIDIA Corporation)

NVIDIA Updatus (x32 Version: 1.0.3 - NVIDIA Corporation) Hidden

OpenOffice.org 3.1 (HKLM-x32\...\{99E862CC-6F69-4D39-99AA-DBF71BF3B585}) (Version: 3.1.9420 - OpenOffice.org)

PATRIZIER II (HKLM-x32\...\PATRIZIER II_is1) (Version:  - )

PDF24 Creator 6.2.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)

PDF-XChange Viewer (HKLM\...\{9A5A07EC-9732-45A1-9DA9-33DE456E40CB}) (Version: 2.0.57.0 - Tracker Software Products Ltd.)

PepperZip 1.0 (HKLM-x32\...\PepperZip) (Version: 1.0 - PepperWare Co.)

Pro Evolution Soccer 2010 (HKLM-x32\...\{283FFB23-8751-4B08-ACB8-5E0F8BCF7727}) (Version: 1.00.0000 - KONAMI)

Puran Utilities 1.0.3 (HKLM\...\Puran Utilities_is1) (Version:  - Puran Software)

Scan2PDF 1.6 (HKLM-x32\...\Scan2PDF_is1) (Version:  - Koma-Code)

Snap.Do (HKLM-x32\...\{17675027-B1F7-4EA3-BAFD-72E887752385}) (Version: 1.6.0.388 - ReSoft Ltd.) <==== ATTENTION

Sony Ericsson Update Engine (HKLM-x32\...\Update Engine) (Version: 2.12.13.28 - Sony Ericsson Communications AB)

Sony PC Companion 2.10.065 (HKLM-x32\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.065 - Sony)

Studie zur Verbesserung von HP Deskjet 3050A J611 series Produkten (HKLM\...\{EF27865C-E636-47C4-8B35-CE8A88045681}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)

SweetPacks bundle uninstaller (HKLM-x32\...\{953AA732-9AFB-49C9-84A4-7F96CA0A08DA}) (Version: 1.0.0001 - SweetIM Technologies Ltd.) <==== ATTENTION

Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)

Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B2260BC9-D561-46EE-B33D-739CF760A2A9}) (Version:  - Microsoft)

Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)

Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)

Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)

Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)

Update Manager for SweetPacks 1.1 (HKLM-x32\...\{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}) (Version: 1.1.0008 - SweetIM Technologies Ltd.) <==== ATTENTION

USB 2.0 VGA UVC WebCam (HKLM\...\USB 2.0 VGA UVC WebCam) (Version:  - )

VLC media player 1.1.2 (HKLM-x32\...\VLC media player) (Version: 1.1.2 - VideoLAN)

Windows Live Anmelde-Assistent (HKLM-x32\...\{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}) (Version: 5.000.818.6 - Microsoft Corporation)

Windows Live Call (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

Windows Live Communications Platform (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)

Windows Live Essentials (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

Windows Live Family Safety (Version: 14.0.8052.1208 - Microsoft Corporation) Hidden

Windows Live Fotogalerie (x32 Version: 14.0.8051.1204 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

Windows Live Messenger (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

Windows Live Sync (HKLM-x32\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)

Windows Live Writer (x32 Version: 14.0.8050.1202 - Microsoft Corporation) Hidden

Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)

Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version:  - )

Windows Media Encoder 9 Series (x32 Version: 9.00.2980 - Microsoft Corporation) Hidden

WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.30.1 - ASUS)

WinSpeed (HKLM-x32\...\{5F189DF5-2D05-472B-9091-84D9848AE48B}{f1f78e38}) (Version:  - 24soft) <==== ATTENTION

Wireless Console 3 (HKLM-x32\...\{20FDF948-C8ED-4543-A539-F7F4AEF5AFA2}) (Version: 3.0.15 - ASUS)
 

==================== Custom CLSID (selected items): ==========================
 

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
 

==================== Restore Points  =========================
 

20-08-2014 06:13:23 Windows Update

20-08-2014 06:31:18 Wiederherstellungsvorgang

20-08-2014 06:48:34 Windows Update

20-08-2014 07:04:09 Wiederherstellungsvorgang

20-08-2014 07:20:28 Windows Update
 

==================== Hosts content: ==========================
 

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 

==================== Scheduled Tasks (whitelisted) =============
 

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 

Task: {340468B9-F474-4AE9-9BD0-A2C002D348B5} - \ASP No Task File <==== ATTENTION

Task: {3EB501EF-DB60-431C-B933-E4563F76EABE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-08] (Google Inc.)

Task: {3ED39A0D-750A-4A9F-B05E-D26CEB186666} - System32\Tasks\ASPG => C:\Program Files (x86)\ASUS\ASUS CopyProtect\aspg.exe [2009-06-29] (ASUS)

Task: {3F5B9083-AE21-4148-B7B4-997E4FC7D53A} - System32\Tasks\Browser Updater\Browser Updater => C:\Program Files (x86)\HomeTab\WRemoteUpdate.exe

Task: {4358E3E5-9CA1-48E2-A88F-DC0F1690F224} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31] (ASUS)

Task: {499E9417-608B-4F82-8F42-45784072372D} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe [2007-11-30] ()

Task: {6E85ACA0-B527-4137-A686-AB0ED5AF777F} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-06-19] (AnyProtect by CMI) <==== ATTENTION

Task: {72857A1C-9A8E-446B-B81D-3F95A43FFC86} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-09] (Adobe Systems Incorporated)

Task: {7540B1AE-EFEF-4B94-9830-0D09AF938341} - System32\Tasks\WC3 => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2010-01-05] ()

Task: {7822837E-1607-4FED-8A3B-1CC0207D9F6B} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2012-07-03] (Sun Microsystems, Inc.)

Task: {86B06355-5B78-40DB-B550-17ADE6CDBB19} - \EPUpdater No Task File <==== ATTENTION

Task: {87F05C42-EB42-42FE-B716-12173125D4C1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-06-08] (Google Inc.)

Task: {919B53E6-0C03-457F-A060-4190C0FAD6F7} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-06-19] (AnyProtect by CMI) <==== ATTENTION

Task: {9DC0B0F6-5FDE-4D37-AC3D-5361EA784A23} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2009-07-23] (ATK)

Task: {B240F418-91F5-4638-B1AB-B2C6AC97A74E} - System32\Tasks\HPCustParticipation HP Deskjet 3050A J611 series => C:\Program Files\HP\HP Deskjet 3050A J611 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)

Task: {B48DA01E-00AB-48DC-8585-7DB3E36FDE05} - System32\Tasks\ASUSControlDeck => C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe [2010-02-08] (asus)

Task: {C320C4AC-1699-4E30-9168-0706112341FF} - System32\Tasks\SystemSockets\SystemSockets => C:\Program Files (x86)\HomeTab\WConnectorSockets.exe

Task: {C5E5F5B0-356A-437E-AB53-2D8410DD450D} - System32\Tasks\ProtectedSearch\Protected Search => C:\Program Files (x86)\HomeTab\WHomepageArmor.exe

Task: {D2C81AA9-2C08-4B83-AC7A-66C96494B4A5} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2010-04-09] (ATK)

Task: {D385FC90-2C02-4C74-AF60-D5ADB21E210B} - System32\Tasks\MT66 Software Update => C:\Program Files (x86)\Common Files\MT66 Software Update\UpdateClient.exe [2009-11-18] (MedienTeam66)

Task: {D3B5D397-BFA4-44D2-8CDD-91F5AE3FF3B3} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe [2014-06-19] (AnyProtect by CMI) <==== ATTENTION

Task: {F09B0C3A-39C6-4E55-AE91-33DD656E8EA0} - System32\Tasks\Games\UpdateCheck_S-1-5-21-420645628-1813877703-113317616-1001

Task: {F2B13C76-5D00-4BC9-AB81-2ADE678E909E} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION

Task: C:\Windows\Tasks\ASUS SmartLogon Console Sensor.job => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\MT66 Software Update.job => C:\Program Files (x86)\Common Files\MT66 Software Update\UpdateClient.exe

Task: C:\Windows\Tasks\User_Feed_Synchronization-{F29BB976-EE78-451D-926D-D0607B097FA2}.job => C:\Windows\system32\msfeedssync.exe
 

==================== Loaded Modules (whitelisted) =============
 

2011-04-01 18:32 - 2011-04-01 18:32 - 00053760 _____ () C:\Windows\system32\msratiog.dll

2014-08-20 07:57 - 2014-08-20 07:57 - 04304896 _____ () C:\ProgramData\WinSpeed\WinSpeed_x64.dll

2014-07-29 08:11 - 2014-07-28 20:24 - 04795904 _____ () C:\Windows\score.exe

2012-04-18 10:29 - 2012-01-17 18:49 - 00270672 _____ () C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe

2010-03-16 03:48 - 2010-03-16 03:48 - 00148816 _____ () C:\Program Files (x86)\ASUS\ASUS WebStorage\EcaremeDLL.dll

2010-06-08 23:07 - 2010-06-08 23:07 - 00030032 _____ () C:\Windows\assembly\GAC_MSIL\SqliteShared\1.0.3726.20828__0d0f4b69e50e559b\SqliteShared.dll

2010-06-08 23:07 - 2010-06-08 23:07 - 00931840 _____ () C:\Windows\assembly\GAC_64\System.Data.SQLite\1.0.60.0__db937bc2d44ff139\System.Data.SQLite.dll

2014-07-23 12:50 - 2014-07-23 12:50 - 00121344 _____ () C:\Program Files (x86)\PepperZip\shell\PPZShellExtension_x64.dll

2010-06-08 23:31 - 2007-11-30 20:20 - 00051768 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

2008-10-01 08:02 - 2008-10-01 08:08 - 00011264 _____ () C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll

2010-01-11 19:27 - 2010-01-11 19:27 - 00017920 _____ () C:\Program Files\P4G\DevMng.dll

2010-02-04 02:14 - 2010-02-04 02:14 - 00033792 _____ () C:\Program Files\P4G\OvrClk.dll

2010-01-05 02:43 - 2010-01-05 02:43 - 01597440 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

2011-04-10 17:40 - 2011-04-10 17:40 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll

2014-03-11 10:15 - 2014-03-13 10:49 - 00764096 _____ () C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

2014-08-20 07:57 - 2014-08-20 07:57 - 04127232 _____ () c:\ProgramData\WinSpeed\WinSpeed.dll

2014-08-20 07:57 - 2014-08-20 07:57 - 00186192 _____ () c:\ProgramData\WinSpeed\WinSpeedSvc.dll

2010-02-03 01:51 - 2010-02-03 01:51 - 00041472 _____ () C:\Program Files (x86)\ASUS\ControlDeck\HelpFunc.dll

2010-02-03 01:51 - 2010-02-03 01:51 - 00071680 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Brightness.dll

2010-02-03 01:51 - 2010-02-03 01:51 - 00076288 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Volume.dll

2010-02-03 01:51 - 2010-02-03 01:51 - 00186880 _____ () C:\Program Files (x86)\ASUS\ControlDeck\Resolution.dll

2010-02-03 01:51 - 2010-02-03 01:51 - 00050688 _____ () C:\Program Files (x86)\ASUS\ControlDeck\P4GControl.dll

2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll

2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll

2014-08-13 13:40 - 2014-08-07 05:20 - 00718152 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libglesv2.dll

2014-08-13 13:40 - 2014-08-07 05:20 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\libegl.dll

2014-08-13 13:40 - 2014-08-07 05:20 - 08537928 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll

2014-08-13 13:40 - 2014-08-07 05:20 - 00353096 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll

2014-08-13 13:40 - 2014-08-07 05:20 - 01732936 _____ () C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ffmpegsumo.dll

2014-03-11 10:15 - 2014-03-13 10:49 - 00065728 _____ () C:\Program Files (x86)\Mobogenie\Device.dll

2014-03-11 10:15 - 2014-03-13 10:49 - 00474816 _____ () C:\Program Files (x86)\Mobogenie\DCR.dll
 

==================== Alternate Data Streams (whitelisted) =========
 

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 

==================== Safe Mode (whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SecureAssist => ""="service"
 

==================== EXE Association (whitelisted) =============
 

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 

HKU\S-1-5-21-420645628-1813877703-113317616-1001\Software\Classes\.exe:  =>  <===== ATTENTION!
 

==================== MSCONFIG/TASK MANAGER disabled items =========
 

(Currently there is no automatic fix for this section.)
 

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^SRS Premium Sound.lnk => C:\Windows\pss\SRS Premium Sound.lnk.CommonStartup

MSCONFIG\startupreg: (default) => 

MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"

MSCONFIG\startupreg: ADSMTray => C:\Program Files (x86)\ASUS\ASUS Data Security Manager\ADSMTray.exe

MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe

MSCONFIG\startupreg: ASUS WebStorage => C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe

MSCONFIG\startupreg: ATKMEDIA => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

MSCONFIG\startupreg: ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

MSCONFIG\startupreg: avgnt => "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min

MSCONFIG\startupreg: Boingo Wi-Fi => "C:\Program Files (x86)\Boingo\Boingo Wi-Fi\Boingo.lnk"

MSCONFIG\startupreg: BrowserSafeguard => "C:\Program Files (x86)\Browsersafeguard\BrowserSafeguard.exe"

MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"

MSCONFIG\startupreg: DATAMNGR => C:\PROGRA~2\WIA6EB~1\Datamngr\DATAMN~1.EXE

MSCONFIG\startupreg: ETDWare => %ProgramFiles%\Elantech\ETDCtrl.exe

MSCONFIG\startupreg: facemoods => "C:\Program Files (x86)\facemoods.com\facemoods\1.4.17.9\facemoodssrv.exe" /md I

MSCONFIG\startupreg: GrooveMonitor => "C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"

MSCONFIG\startupreg: HControlUser => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

MSCONFIG\startupreg: HotKeysCmds => C:\Windows\system32\hkcmd.exe

MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe

MSCONFIG\startupreg: IgfxTray => C:\Windows\system32\igfxtray.exe

MSCONFIG\startupreg: MSC => "C:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey

MSCONFIG\startupreg: NvCplDaemon => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe

MSCONFIG\startupreg: Persistence => C:\Windows\system32\igfxpers.exe

MSCONFIG\startupreg: SmartAudio => C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t

MSCONFIG\startupreg: Sweetpacks Communicator => C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe

MSCONFIG\startupreg: UIExec => "C:\Program Files (x86)\1&1 Surf-Stick\UIExec.exe"

MSCONFIG\startupreg: UpdateLBPShortCut => "C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"

MSCONFIG\startupreg: UpdateP2GoShortCut => "C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
 

==================== Faulty Device Manager Devices =============
 

Name: Lexmark X422

Description: Lexmark X422

Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}

Manufacturer: Lexmark

Service: usbscan

Problem: : This device cannot start. (Code10)

Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.

On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 

==================== Event log errors: =========================
 

Application errors:

==================

Error: (08/20/2014 09:33:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 2059
 

Error: (08/20/2014 09:33:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 2059
 

Error: (08/20/2014 09:33:26 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (08/20/2014 09:33:25 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 1014
 

Error: (08/20/2014 09:33:25 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 1014
 

Error: (08/20/2014 09:33:25 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (08/20/2014 07:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 63034279
 

Error: (08/20/2014 07:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledEvent 63034279
 

Error: (08/20/2014 07:52:20 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: Continuously busy for more than a second
 

Error: (08/20/2014 07:52:19 AM) (Source: Bonjour Service) (EventID: 100) (User: )

Description: Task Scheduling Error: m->NextScheduledSPRetry 63033265
 
 

System errors:

=============

Error: (08/20/2014 10:26:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "globalUpdate Update Service (globalUpdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (08/20/2014 10:25:39 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (08/20/2014 09:23:58 AM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )

Description: Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt
 

        Feature: %%886
 

        Fehlercode: 0x80070020
 

        Fehlerbeschreibung: Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird. 
 

        Grund: %%858
 

Error: (08/20/2014 09:11:51 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "globalUpdate Update Service (globalUpdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (08/20/2014 09:10:45 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 

Error: (08/20/2014 09:09:12 AM) (Source: Microsoft Antimalware) (EventID: 2004) (User: )

Description: Beim Laden der Signaturen wurde von %60 ein Fehler festgestellt. Es wird versucht, einen als gültig bekannten Signatursatz wiederherzustellen.
 

        Versuchte Signaturen: %24
 

        Fehlercode: 0x80070002
 

        Fehlerbeschreibung: Das System kann die angegebene Datei nicht finden. 
 

        Signaturversion: 0.0.0.0;0.0.0.0
 

        Modulversion: %600
 

Error: (08/20/2014 09:00:15 AM) (Source: VDS Basic Provider) (EventID: 1) (User: )

Description: Unerwarteter Fehler. Fehlercode: 490@01010004
 

Error: (08/20/2014 08:58:02 AM) (Source: Service Control Manager) (EventID: 7000) (User: )

Description: Der Dienst "globalUpdate Update Service (globalUpdate)" wurde aufgrund folgenden Fehlers nicht gestartet: 

%%2
 

Error: (08/20/2014 08:56:00 AM) (Source: Service Control Manager) (EventID: 7022) (User: )

Description: Der Dienst "MBAMService" wurde nicht richtig gestartet.
 

Error: (08/20/2014 08:55:37 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)

Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
 
 

Microsoft Office Sessions:

=========================

Error: (06/27/2012 05:22:54 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 20 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (04/27/2012 07:44:35 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 2, Application Name: Microsoft Office Access, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 70 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (04/27/2012 07:44:33 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 2, Application Name: Microsoft Office Access, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 72 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (11/17/2011 08:20:35 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (11/16/2011 10:29:24 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 22 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (10/04/2011 00:12:04 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1585 seconds with 960 seconds of active time.  This session ended with a crash.
 

Error: (09/22/2011 11:53:39 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 209 seconds with 180 seconds of active time.  This session ended with a crash.
 

Error: (08/27/2011 06:09:27 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 23 seconds with 0 seconds of active time.  This session ended with a crash.
 

Error: (07/13/2011 06:05:06 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 251 seconds with 60 seconds of active time.  This session ended with a crash.
 

Error: (07/05/2011 02:01:44 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )

Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 29 seconds with 0 seconds of active time.  This session ended with a crash.
 
 

==================== Memory info =========================== 
 

Processor: Intel(R) Core(TM) i5 CPU M 450 @ 2.40GHz

Percentage of memory in use: 55%

Total physical RAM: 3884.55 MB

Available physical RAM: 1714.91 MB

Total Pagefile: 7767.29 MB

Available Pagefile: 5157.57 MB

Total Virtual: 8192 MB

Available Virtual: 8191.82 MB
 

==================== Drives ================================
 

Drive c: (OS) (Fixed) (Total:116.44 GB) (Free:1.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]

Drive d: (DATA) (Fixed) (Total:329.79 GB) (Free:285.56 GB) NTFS

Drive g: (CANON_DC) (Removable) (Total:0.95 GB) (Free:0.37 GB) FAT

Drive h: (ROBERT) (Removable) (Total:14.44 GB) (Free:8.82 GB) FAT32
 

==================== MBR & Partition Table ==================
 

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E0C5913D)

Partition 1: (Not Active) - (Size=19.5 GB) - (Type=1C)

Partition 2: (Active) - (Size=116.4 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=329.8 GB) - (Type=OF Extended)
 

========================================================

Disk: 1 (Size: 968.8 MB) (Disk ID: 00000000)
 

Partition: GPT Partition Type.
 

========================================================

Disk: 2 (Size: 14.5 GB) (Disk ID: F716AB20)

Partition 1: (Not Active) - (Size=14.5 GB) - (Type=0B)
 

==================== End Of Log ============================

Code:

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 10:21 on 20/08/2014 (Norman)
 

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.
 

Checking for services/drivers...

SPTD -> Disabled (Service running -> reboot required)
 
 

-=E.O.F=-

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2014 01

Ran by Norman (administrator) on ROBERT on 20-08-2014 10:29:29

Running from C:\Users\Norman\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Windows\System32\rundll32.exe

(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe

(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe

() C:\Windows\score.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

() C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\ASPG.exe

(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(ASUS) C:\Windows\AsScrPro.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [764096 2014-03-13] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\Run: [GoogleChromeAutoLaunch_29B69EEE740A47DF7549CA7579BEBBEF] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-08-07] (Google Inc.)

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: F - F:\setup_vmc_lite.exe /checkApplicationPresence

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: G - G:\LaunchU3.exe

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: H - H:\setup_vmc_lite.exe /checkApplicationPresence

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {199fad6e-5f89-11e0-bc40-485b395fdc69} - G:\SETUP.EXE

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {811f5be9-3175-11e1-9993-485b395fdc69} - F:\Startme.exe

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {9e61451a-e3fa-11df-acb8-001e101f2c0e} - F:\USBAutoRun.exe

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {bf537bf7-d7b5-11df-a63a-485b395fdc69} - F:\setup_vmc_lite.exe /checkApplicationPresence

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {bf537c8a-d7b5-11df-a63a-485b395fdc69} - F:\setup_vmc_lite.exe /checkApplicationPresence

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {cb41fb04-daca-11df-88df-485b395fdc69} - F:\setup_vmc_lite.exe /checkApplicationPresence

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\MountPoints2: {ea323089-2600-11e0-9876-485b395fdc69} - I:\setup_vmc_lite.exe /checkApplicationPresence

AppInit_DLLs: c:\windows\system32\nvinitx.dll => c:\windows\system32\nvinitx.dll [95848 2010-03-27] (NVIDIA Corporation)

AppInit_DLLs:  C:\PROGRA~3\WinSpeed\WINSPE~1.DLL => C:\ProgramData\WinSpeed\WinSpeed_x64.dll [4304896 2014-08-20] ()

AppInit_DLLs-x32: c:\progra~3\winspeed\winspeed.dll => c:\ProgramData\WinSpeed\WinSpeed.dll [4127232 2014-08-20] ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk

ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.)

ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.)

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab

HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSSE

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.awesomehp.com/web/?type=ds&ts=1394522550&from=adks&uid=ST9500325AS_6VE7HBS1XXXX6VE7HBS1&q={searchTerms}

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab

URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

URLSearchHook: HKLM-x32 - (No Name) - {855F3B16-6D32-4fe6-8A56-BBB695989046} - No File

URLSearchHook: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

SearchScopes: HKLM - DefaultScope {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKLM - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=82443&st=bs&tid=24086&ver=6.7&ts=1.000008&tguid=0&q={searchTerms}

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

SearchScopes: HKLM-x32 - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}

SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.certified-toolbar.com?si=82443&st=bs&tid=24086&ver=6.7&ts=1.000008&tguid=0&q={searchTerms}

SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://startsear.ch/?aff=1&q={searchTerms}

SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2410} URL = hxxp://dts.search-results.com/sr?src=ieb&appid=0&systemid=410&sr=0&q={searchTerms}

SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: DVDVideoSoftTB Toolbar -> {872b5b88-9db5-4310-bdd0-ac189557e5f5} -> C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Toolbar: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)

Toolbar: HKLM-x32 - Snap.Do - {ae07101b-46d4-4a98-af68-0333ea26e113} - C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Winsock: Catalog9 01 C:\Windows\system32\SecureAssist.dll File Not found ()

Winsock: Catalog9 02 C:\Windows\system32\SecureAssist.dll File Not found ()

Winsock: Catalog9 03 C:\Windows\system32\SecureAssist.dll File Not found ()

Winsock: Catalog9 04 C:\Windows\system32\SecureAssist.dll File Not found ()

Winsock: Catalog9 15 C:\Windows\system32\SecureAssist.dll File Not found ()

Winsock: Catalog9-x64 01 C:\Windows\system32\SecureAssist64.dll [338120] (SecureAssist)

Winsock: Catalog9-x64 02 C:\Windows\system32\SecureAssist64.dll [338120] (SecureAssist)

Winsock: Catalog9-x64 03 C:\Windows\system32\SecureAssist64.dll [338120] (SecureAssist)

Winsock: Catalog9-x64 04 C:\Windows\system32\SecureAssist64.dll [338120] (SecureAssist)

Winsock: Catalog9-x64 15 C:\Windows\system32\SecureAssist64.dll [338120] (SecureAssist)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default

FF NewTab: about:home

FF DefaultSearchEngine: Web Search

FF SearchEngineOrder.1: Web Search

FF SelectedSearchEngine: Web Search

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Extension: Widget context - C:\Users\Norman\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-03-05]

FF Extension: deal4me - C:\Users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\Extensions\vamchw@ovy.co.uk [2014-08-19]

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Optimization Client\addon

FF HKCU\...\Firefox\Extensions: [{550bb1da-ebf2-411a-bf29-902df8b1066c}] - C:\Program Files (x86)\Re-markit-soft\157.xpi
 

Chrome: 

=======

CHR HomePage: hxxp://start.androidnewtab.com/?1=1__PARAM__

CHR StartupUrls: "about:newtab?source=home"

CHR NewTab: "chrome-extension://mmmdbehjiieocihhncnaggngbccgdcpo/bundler/newtab.html", "chrome-extension://jlceijfdfeghdhmmbhbcffanmcggoojf/bundler/newtab.html"

CHR DefaultSearchKeyword: search.certified-toolbar.com

CHR DefaultSearchProvider: Web Search

CHR DefaultSearchURL: hxxp://search.certified-toolbar.com?si=82443&st=bs&tid=24086&ver=6.4&ts=1403128800000.000008&tguid=82443-24086-1403180553023-A2CB6C8DBEA53F83093D8CA04D4D2B61&q={searchTerms}

CHR DefaultSuggestURL: 

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\36.0.1985.143\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File

CHR Plugin: (Java(TM) Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File

CHR Plugin: (Windows LiveÃƒÂ‚Ã‚Â® Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (PDF-XChange Viewer) - C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

CHR Extension: (Google Docs) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-05]

CHR Extension: (Google Drive) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-05]

CHR Extension: (YouTube) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-05]

CHR Extension: (Web Search) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\canneacfbhohinchadcbleedjidnpejc [2014-08-04]

CHR Extension: (Super Tab Homepage) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\cchedanbhebbgjmnhcpmpcniijnfbdha [2014-08-04]

CHR Extension: (Google-Suche) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-05]

CHR Extension: (video MediaPlayer) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb [2014-06-24]

CHR Extension: (Follow) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij [2014-08-19]

CHR Extension: (Web Search) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlceijfdfeghdhmmbhbcffanmcggoojf [2014-06-19]

CHR Extension: (vshare plugin) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj [2013-06-05]

CHR Extension: (Super Tab) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmmdbehjiieocihhncnaggngbccgdcpo [2014-08-04]

CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-06-05]

CHR Extension: (Google Wallet) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]

CHR Extension: (Widget context) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-03-05]

CHR Extension: (Color Icons for Gmail) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn [2014-08-18]

CHR Extension: (Google Mail) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-05]

CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\Norman\AppData\Roaming\DVDVideoSoft\DVDVideoSoftBrowserExtension.crx [2012-11-09]

CHR HKLM-x32\...\Chrome\Extension: [bciilgdpfoijonnahfpinfnhpckkokna] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home9526\ch\MediaWatchV1home9526.crx [2012-11-09]

CHR HKLM-x32\...\Chrome\Extension: [ejdbaenpnnpklfljeihebmljibepmimo] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode7295\ch\MediaBuzzV1mode7295.crx [2012-11-09]

CHR HKLM-x32\...\Chrome\Extension: [kpionmjnkbpcdpcflammlgllecmejgjj] - C:\Program Files (x86)\vShare.tv plugin\vshareplg.crx [2011-08-31]

CHR HKLM-x32\...\Chrome\Extension: [ldjojcbkmecbbllcopnbbkanahggohkj] - C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6977\ch\TrustMediaViewerV1alpha6977.crx [2011-08-31]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

R2 f1f78e38; c:\ProgramData\WinSpeed\WinSpeedSvc.dll [186192 2014-08-20] () [File not signed]

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]

R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)

R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]

S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [292736 2012-08-13] (Puran Software) [File not signed]

R2 scores; C:\Windows\score.exe [4795904 2014-07-28] () [File not signed]

S3 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [155344 2011-06-29] (Avanquest Software) [File not signed]

S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed]

R2 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [270672 2012-01-17] ()

R2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]

S2 globalUpdate; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /svc [X]

S3 globalUpdatem; C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe /medsvc [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [133632 2009-11-04] (Huawei Technologies Co., Ltd.)

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-04-30] (Duplex Secure Ltd.)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] ()

S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

S3 nmwcdc; system32\drivers\ccdcmbox64.sys [X]

U3 tmlwf; 

U3 tmwfp; 

S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-20 10:29 - 2014-08-20 10:30 - 00027354 _____ () C:\Users\Norman\Desktop\FRST.txt

2014-08-20 10:27 - 2014-08-20 10:29 - 00000000 ____D () C:\FRST

2014-08-20 10:21 - 2014-08-20 10:21 - 00000584 _____ () C:\Users\Norman\Desktop\defogger_disable.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000020 _____ () C:\Users\Norman\defogger_reenable

2014-08-20 10:19 - 2014-08-20 10:19 - 00380416 _____ () C:\Users\Norman\Desktop\Gmer-19357.exe

2014-08-20 10:18 - 2014-08-20 10:18 - 02101760 _____ (Farbar) C:\Users\Norman\Desktop\FRST64.exe

2014-08-20 10:16 - 2014-08-20 10:16 - 00050477 _____ () C:\Users\Norman\Desktop\Defogger.exe

2014-08-20 10:02 - 2014-08-20 10:02 - 00096430 _____ () C:\Users\Norman\Desktop\Extras.Txt

2014-08-20 09:59 - 2014-08-20 09:59 - 00142852 _____ () C:\Users\Norman\Desktop\OTL.Txt

2014-08-20 09:38 - 2014-08-20 09:38 - 00602112 _____ (OldTimer Tools) C:\Users\Norman\Desktop\otl.exe

2014-08-20 07:57 - 2014-08-20 09:07 - 00000000 ____D () C:\ProgramData\WinSpeed

2014-08-20 07:57 - 2014-08-20 07:57 - 00000000 ____D () C:\ProgramData\374311380

2014-08-19 08:05 - 2014-08-20 09:07 - 00000000 ____D () C:\ProgramData\CooiLSalEECoUpon

2014-08-18 12:20 - 2014-08-20 09:07 - 00000000 ____D () C:\ProgramData\8e27c8f07b9e9861

2014-08-17 13:50 - 2014-08-17 13:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(2).exe

2014-08-14 08:32 - 2014-08-14 08:32 - 01058200 _____ (Adobe) C:\Users\Norman\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe

2014-08-13 14:02 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll

2014-08-13 14:02 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll

2014-08-13 14:02 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe

2014-08-13 14:02 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll

2014-08-13 14:02 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe

2014-08-13 14:02 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

2014-08-13 14:01 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe

2014-08-13 14:01 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe

2014-08-13 13:15 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-08-13 13:15 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls

2014-08-13 13:14 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-08-13 13:14 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-08-13 13:13 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2014-08-13 13:13 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-08-13 13:13 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-08-13 13:13 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2014-08-13 13:12 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-13 13:12 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-13 13:12 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-13 13:12 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-08-13 13:12 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-08-13 13:12 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-08-13 13:11 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-13 13:11 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-13 13:11 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-13 13:11 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-13 13:11 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 13:11 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-13 13:11 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-13 13:11 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-13 13:11 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-13 13:11 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-13 13:11 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-13 13:11 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-13 13:11 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-13 13:11 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-13 13:11 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-13 13:11 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-13 13:11 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-13 13:11 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-13 13:11 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 13:11 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-13 13:11 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-13 13:11 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-13 13:11 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-13 13:11 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-13 13:11 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-13 13:11 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 13:11 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-13 13:11 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-13 13:11 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-13 13:11 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-13 13:11 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-13 13:11 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-13 13:11 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-13 13:11 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-13 13:11 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-13 13:11 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-13 13:11 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-13 13:11 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-13 13:11 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-13 13:11 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-13 13:11 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-13 13:11 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-13 13:11 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-13 13:11 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-13 13:11 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-13 13:11 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-13 13:11 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-13 13:11 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-13 13:11 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-13 13:11 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-13 13:11 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-13 13:11 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-13 13:11 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-13 13:11 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-13 13:11 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-13 13:11 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-13 13:05 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2014-08-13 13:05 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2014-08-13 13:05 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-08-13 13:05 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll

2014-08-13 13:05 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-08-13 13:05 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-08-13 13:04 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-13 13:04 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 12:59 - 2014-08-06 13:00 - 00000000 ____D () C:\Users\Norman\Downloads\FM 2013

2014-08-06 12:59 - 2014-08-06 12:59 - 00921280 _____ () C:\Users\Norman\Downloads\FM 2013.rar

2014-08-06 12:59 - 2014-08-06 12:59 - 00183405 _____ () C:\Users\Norman\Downloads\FM2013 1.jpeg

2014-08-06 08:02 - 2014-08-20 09:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-06 08:02 - 2014-08-13 12:46 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-06 08:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-06 08:00 - 2014-08-06 08:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(1).exe

2014-08-06 08:00 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 07:54 - 2014-08-06 07:54 - 00000687 _____ () C:\awh81A.tmp

2014-08-06 07:44 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-08-06 07:44 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-08-06 07:44 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-08-06 07:44 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-08-06 07:44 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-08-06 07:44 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-08-06 07:44 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-08-06 07:44 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-08-06 07:44 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-08-06 07:44 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-08-06 07:44 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-08-06 07:44 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-08-06 07:44 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-08-06 07:44 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-08-06 07:44 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-08-06 07:44 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-08-06 07:42 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2014-08-06 07:42 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2014-08-06 07:42 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll

2014-08-06 07:42 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll

2014-08-06 07:41 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-08-06 07:41 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-08-06 07:40 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-08-06 07:40 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

2014-08-06 07:26 - 2014-08-06 07:26 - 00000687 _____ () C:\awh4AE4.tmp

2014-08-04 11:22 - 2014-08-04 11:22 - 00000687 _____ () C:\awh2D46.tmp

2014-08-04 07:32 - 2014-08-04 07:32 - 00000687 _____ () C:\awhCDC9.tmp

2014-08-04 07:09 - 2014-08-04 07:09 - 00000687 _____ () C:\awh6C78.tmp

2014-08-02 13:29 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-02 13:29 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-02 13:29 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-02 13:29 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-02 13:29 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-02 13:29 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-02 13:29 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-02 13:29 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-02 13:29 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-02 13:26 - 2014-08-02 13:26 - 00000687 _____ () C:\awh4FB5.tmp

2014-07-31 08:56 - 2014-08-20 09:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-31 08:44 - 2014-07-31 08:44 - 00000687 _____ () C:\awh5292.tmp

2014-07-30 20:23 - 2014-07-30 20:23 - 00000687 _____ () C:\awhAD4E.tmp

2014-07-30 08:25 - 2014-07-30 08:25 - 00000687 _____ () C:\awh3957.tmp

2014-07-29 09:11 - 2014-07-29 09:11 - 00000687 _____ () C:\awh4587.tmp

2014-07-29 08:15 - 2014-07-29 08:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\com

2014-07-29 08:13 - 2014-07-29 08:13 - 00001903 _____ () C:\Users\UpdatusUser\Desktop\NewPlayer.lnk

2014-07-29 08:12 - 2014-08-20 09:08 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro

2014-07-29 08:11 - 2014-08-06 12:25 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\VOPackage

2014-07-29 08:11 - 2014-07-29 08:11 - 00001021 _____ () C:\Users\UpdatusUser\Desktop\PepperZip.lnk

2014-07-29 08:11 - 2014-07-29 08:11 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PepperZip

2014-07-29 08:11 - 2014-07-29 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip

2014-07-29 08:11 - 2014-07-29 08:11 - 00000000 ____D () C:\Program Files (x86)\PepperZip

2014-07-29 08:11 - 2014-07-28 20:24 - 04795904 _____ () C:\Windows\score.exe

2014-07-29 08:10 - 2014-07-29 08:10 - 00000687 _____ () C:\awh1812.tmp

2014-07-29 08:09 - 2014-07-29 08:09 - 01505024 _____ () C:\Users\Norman\Downloads\Player Setup.exe

2014-07-28 07:13 - 2014-07-28 07:13 - 00000687 _____ () C:\awh17F2.tmp

2014-07-27 20:10 - 2014-07-27 20:10 - 00000687 _____ () C:\awh63A2.tmp

2014-07-27 18:56 - 2014-07-27 18:56 - 00000687 _____ () C:\awh5C71.tmp

2014-07-27 11:26 - 2014-07-27 11:26 - 00000687 _____ () C:\awh26C1.tmp

2014-07-26 12:38 - 2014-07-26 12:38 - 00000687 _____ () C:\awh6315.tmp

2014-07-25 17:47 - 2014-07-25 17:47 - 00000687 _____ () C:\awh1525.tmp

2014-07-25 07:50 - 2014-07-25 07:50 - 00000687 _____ () C:\awh20F7.tmp

2014-07-24 18:49 - 2014-07-24 18:49 - 00000687 _____ () C:\awh7FC9.tmp

2014-07-24 08:47 - 2014-07-24 08:47 - 00000687 _____ () C:\awh3C06.tmp

2014-07-23 08:18 - 2014-07-23 08:18 - 00000687 _____ () C:\awh15E0.tmp

2014-07-21 19:35 - 2014-07-21 19:35 - 00000687 _____ () C:\awh4A3D.tmp
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-20 10:30 - 2014-08-20 10:29 - 00027354 _____ () C:\Users\Norman\Desktop\FRST.txt

2014-08-20 10:29 - 2014-08-20 10:27 - 00000000 ____D () C:\FRST

2014-08-20 10:29 - 2010-06-08 22:48 - 01615503 _____ () C:\Windows\WindowsUpdate.log

2014-08-20 10:24 - 2010-06-08 23:07 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-20 10:24 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-20 10:24 - 2009-07-14 06:51 - 00419139 _____ () C:\Windows\setupact.log

2014-08-20 10:24 - 2009-07-14 06:45 - 00435744 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-20 10:22 - 2010-06-08 23:14 - 01185340 _____ () C:\Windows\PFRO.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000584 _____ () C:\Users\Norman\Desktop\defogger_disable.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000020 _____ () C:\Users\Norman\defogger_reenable

2014-08-20 10:21 - 2010-10-13 16:57 - 00000000 ____D () C:\Users\Norman

2014-08-20 10:19 - 2014-08-20 10:19 - 00380416 _____ () C:\Users\Norman\Desktop\Gmer-19357.exe

2014-08-20 10:18 - 2014-08-20 10:18 - 02101760 _____ (Farbar) C:\Users\Norman\Desktop\FRST64.exe

2014-08-20 10:16 - 2014-08-20 10:16 - 00050477 _____ () C:\Users\Norman\Desktop\Defogger.exe

2014-08-20 10:02 - 2014-08-20 10:02 - 00096430 _____ () C:\Users\Norman\Desktop\Extras.Txt

2014-08-20 09:59 - 2014-08-20 09:59 - 00142852 _____ () C:\Users\Norman\Desktop\OTL.Txt

2014-08-20 09:46 - 2012-11-17 13:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-20 09:38 - 2014-08-20 09:38 - 00602112 _____ (OldTimer Tools) C:\Users\Norman\Desktop\otl.exe

2014-08-20 09:38 - 2010-06-08 23:07 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-20 09:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-08-20 09:19 - 2014-07-31 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-20 09:16 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-20 09:16 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-20 09:08 - 2014-08-06 08:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-20 09:08 - 2014-07-29 08:12 - 00000000 ____D () C:\Program Files (x86)\Optimizer Pro

2014-08-20 09:07 - 2014-08-20 07:57 - 00000000 ____D () C:\ProgramData\WinSpeed

2014-08-20 09:07 - 2014-08-19 08:05 - 00000000 ____D () C:\ProgramData\CooiLSalEECoUpon

2014-08-20 09:07 - 2014-08-18 12:20 - 00000000 ____D () C:\ProgramData\8e27c8f07b9e9861

2014-08-20 09:07 - 2012-04-18 10:29 - 00000000 ____D () C:\Program Files (x86)\1&1 Surf-Stick

2014-08-20 09:07 - 2011-01-09 18:46 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\vlc

2014-08-20 09:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration

2014-08-20 07:57 - 2014-08-20 07:57 - 00000000 ____D () C:\ProgramData\374311380

2014-08-20 07:52 - 2011-07-03 19:09 - 00045056 _____ () C:\Windows\system32\acovcnt.exe

2014-08-19 08:09 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Offline Web Pages

2014-08-18 11:20 - 2011-09-27 21:19 - 00000000 ____D () C:\Program Files (x86)\vShare.tv plugin

2014-08-18 11:20 - 2011-08-23 08:48 - 00000000 ____D () C:\Program Files (x86)\ConduitEngine

2014-08-18 10:24 - 2012-12-08 11:24 - 00000316 _____ () C:\Windows\Tasks\MT66 Software Update.job

2014-08-18 07:40 - 2009-08-04 11:51 - 01760266 _____ () C:\Windows\system32\perfh007.dat

2014-08-18 07:40 - 2009-08-04 11:51 - 00488386 _____ () C:\Windows\system32\perfc007.dat

2014-08-18 07:40 - 2009-07-14 07:13 - 00006492 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-17 13:50 - 2014-08-17 13:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(2).exe

2014-08-16 10:47 - 2014-06-19 14:23 - 00000000 ____D () C:\temp

2014-08-14 08:32 - 2014-08-14 08:32 - 01058200 _____ (Adobe) C:\Users\Norman\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe

2014-08-14 08:24 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-13 20:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-08-13 14:23 - 2011-01-20 11:10 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-08-13 14:13 - 2013-08-13 09:52 - 00000000 ____D () C:\Windows\system32\MRT

2014-08-13 14:09 - 2010-10-13 17:55 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-08-13 14:00 - 2014-05-06 23:27 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-08-13 12:51 - 2014-03-11 10:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\Mobogenie

2014-08-13 12:46 - 2014-08-06 08:02 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-13 12:46 - 2014-03-11 10:15 - 00000000 ____D () C:\Program Files (x86)\Mobogenie

2014-08-13 12:46 - 2011-01-20 11:10 - 00000000 ____D () C:\Users\Norman\AppData\Local\Microsoft Help

2014-08-07 04:06 - 2014-08-13 13:04 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-07 04:01 - 2014-08-13 13:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 13:00 - 2014-08-06 12:59 - 00000000 ____D () C:\Users\Norman\Downloads\FM 2013

2014-08-06 12:59 - 2014-08-06 12:59 - 00921280 _____ () C:\Users\Norman\Downloads\FM 2013.rar

2014-08-06 12:59 - 2014-08-06 12:59 - 00183405 _____ () C:\Users\Norman\Downloads\FM2013 1.jpeg

2014-08-06 12:30 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup

2014-08-06 12:29 - 2014-02-26 10:45 - 00002032 _____ () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lollipop.lnk

2014-08-06 12:26 - 2014-07-18 17:02 - 00000000 ____D () C:\ProgramData\Systweak

2014-08-06 12:26 - 2014-06-19 14:22 - 00000000 ____D () C:\Program Files (x86)\globalUpdate

2014-08-06 12:26 - 2014-04-25 14:05 - 00000000 ____D () C:\Program Files (x86)\MediaBuzzV1

2014-08-06 12:26 - 2014-03-27 07:55 - 00000000 ____D () C:\Program Files (x86)\MediaWatchV1

2014-08-06 12:26 - 2014-03-11 10:04 - 00000000 ____D () C:\Program Files\Conduit

2014-08-06 12:26 - 2013-03-19 20:03 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\BabSolution

2014-08-06 12:26 - 2012-10-25 08:10 - 00000000 ____D () C:\Program Files (x86)\SweetIM

2014-08-06 12:26 - 2012-05-30 08:30 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Systweak

2014-08-06 12:26 - 2011-08-23 08:48 - 00000000 ____D () C:\Users\Norman\AppData\Local\Conduit

2014-08-06 12:26 - 2010-11-12 16:40 - 00000000 ____D () C:\Program Files (x86)\Conduit

2014-08-06 12:25 - 2014-07-29 08:11 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\VOPackage

2014-08-06 12:25 - 2014-06-19 14:24 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\SimplyTech

2014-08-06 12:25 - 2014-03-11 10:15 - 00000000 ____D () C:\Windows\SysWOW64\dfrg

2014-08-06 12:25 - 2014-03-11 09:22 - 00000000 ____D () C:\ProgramData\WPM

2014-08-06 12:01 - 2010-06-08 23:31 - 00001711 _____ () C:\Windows\system32\ServiceFilter.ini

2014-08-06 12:00 - 2014-03-11 10:04 - 00000306 __RSH () C:\ProgramData\ntuser.pol

2014-08-06 08:01 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(1).exe

2014-08-06 08:00 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 07:54 - 2014-08-06 07:54 - 00000687 _____ () C:\awh81A.tmp

2014-08-06 07:50 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2014-08-06 07:26 - 2014-08-06 07:26 - 00000687 _____ () C:\awh4AE4.tmp

2014-08-04 11:22 - 2014-08-04 11:22 - 00000687 _____ () C:\awh2D46.tmp

2014-08-04 07:32 - 2014-08-04 07:32 - 00000687 _____ () C:\awhCDC9.tmp

2014-08-04 07:09 - 2014-08-04 07:09 - 00000687 _____ () C:\awh6C78.tmp

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\SystemSockets

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\ProtectedSearch

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\Browser Updater

2014-08-02 13:26 - 2014-08-02 13:26 - 00000687 _____ () C:\awh4FB5.tmp

2014-08-01 01:41 - 2014-08-13 13:11 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-01 01:16 - 2014-08-13 13:11 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-31 08:44 - 2014-07-31 08:44 - 00000687 _____ () C:\awh5292.tmp

2014-07-30 20:23 - 2014-07-30 20:23 - 00000687 _____ () C:\awhAD4E.tmp

2014-07-30 08:25 - 2014-07-30 08:25 - 00000687 _____ () C:\awh3957.tmp

2014-07-29 09:11 - 2014-07-29 09:11 - 00000687 _____ () C:\awh4587.tmp

2014-07-29 09:07 - 2010-06-08 23:31 - 00003282 _____ () C:\Windows\system32\AutoRunFilter.ini

2014-07-29 08:15 - 2014-07-29 08:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\com

2014-07-29 08:13 - 2014-07-29 08:13 - 00001903 _____ () C:\Users\UpdatusUser\Desktop\NewPlayer.lnk

2014-07-29 08:11 - 2014-07-29 08:11 - 00001021 _____ () C:\Users\UpdatusUser\Desktop\PepperZip.lnk

2014-07-29 08:11 - 2014-07-29 08:11 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PepperZip

2014-07-29 08:11 - 2014-07-29 08:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip

2014-07-29 08:11 - 2014-07-29 08:11 - 00000000 ____D () C:\Program Files (x86)\PepperZip

2014-07-29 08:10 - 2014-07-29 08:10 - 00000687 _____ () C:\awh1812.tmp

2014-07-29 08:10 - 2013-03-19 20:05 - 00000000 _____ () C:\END

2014-07-29 08:09 - 2014-07-29 08:09 - 01505024 _____ () C:\Users\Norman\Downloads\Player Setup.exe

2014-07-28 20:24 - 2014-07-29 08:11 - 04795904 _____ () C:\Windows\score.exe

2014-07-28 07:13 - 2014-07-28 07:13 - 00000687 _____ () C:\awh17F2.tmp

2014-07-27 20:10 - 2014-07-27 20:10 - 00000687 _____ () C:\awh63A2.tmp

2014-07-27 18:56 - 2014-07-27 18:56 - 00000687 _____ () C:\awh5C71.tmp

2014-07-27 11:26 - 2014-07-27 11:26 - 00000687 _____ () C:\awh26C1.tmp

2014-07-26 12:38 - 2014-07-26 12:38 - 00000687 _____ () C:\awh6315.tmp

2014-07-25 17:47 - 2014-07-25 17:47 - 00000687 _____ () C:\awh1525.tmp

2014-07-25 16:52 - 2014-08-13 13:11 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-25 16:02 - 2014-08-13 13:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-25 16:01 - 2014-08-13 13:11 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-25 15:51 - 2014-08-13 13:11 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-25 15:30 - 2014-08-13 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-25 15:28 - 2014-08-13 13:11 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-25 15:28 - 2014-08-13 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-25 15:25 - 2014-08-13 13:11 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-25 15:25 - 2014-08-13 13:11 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-25 15:11 - 2014-08-13 13:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-25 15:10 - 2014-08-13 13:11 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-25 15:04 - 2014-08-13 13:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-25 15:03 - 2014-08-13 13:11 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-25 15:00 - 2014-08-13 13:11 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-25 15:00 - 2014-08-13 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-25 14:59 - 2014-08-13 13:11 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-25 14:47 - 2014-08-13 13:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-25 14:40 - 2014-08-13 13:11 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-25 14:34 - 2014-08-13 13:11 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-25 14:34 - 2014-08-13 13:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-25 14:33 - 2014-08-13 13:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-25 14:30 - 2014-08-13 13:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-25 14:28 - 2014-08-13 13:11 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-25 14:28 - 2014-08-13 13:11 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-25 14:21 - 2014-08-13 13:11 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-25 14:19 - 2014-08-13 13:11 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-25 14:18 - 2014-08-13 13:11 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-25 14:17 - 2014-08-13 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-25 14:17 - 2014-08-13 13:11 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-25 14:12 - 2014-08-13 13:11 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-25 14:10 - 2014-08-13 13:11 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-25 14:10 - 2014-08-13 13:11 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-25 14:08 - 2014-08-13 13:11 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-25 14:06 - 2014-08-13 13:11 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-25 13:52 - 2014-08-13 13:11 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-25 13:47 - 2014-08-13 13:11 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-25 13:43 - 2014-08-13 13:11 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-25 13:42 - 2014-08-13 13:11 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-25 13:39 - 2014-08-13 13:11 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-25 13:39 - 2014-08-13 13:11 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-25 13:36 - 2014-08-13 13:11 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-25 13:34 - 2014-08-13 13:11 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-25 13:29 - 2014-08-13 13:11 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-25 13:23 - 2014-08-13 13:11 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-25 13:13 - 2014-08-13 13:11 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-25 13:07 - 2014-08-13 13:11 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-25 13:07 - 2014-08-13 13:11 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-25 13:03 - 2014-08-13 13:11 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-25 12:52 - 2014-08-13 13:11 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-25 12:26 - 2014-08-13 13:11 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-25 12:17 - 2014-08-13 13:11 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-25 12:09 - 2014-08-13 13:11 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-25 12:05 - 2014-08-13 13:11 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-25 12:00 - 2014-08-13 13:11 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-25 07:50 - 2014-07-25 07:50 - 00000687 _____ () C:\awh20F7.tmp

2014-07-24 18:49 - 2014-07-24 18:49 - 00000687 _____ () C:\awh7FC9.tmp

2014-07-24 08:47 - 2014-07-24 08:47 - 00000687 _____ () C:\awh3C06.tmp

2014-07-24 08:42 - 2013-03-15 08:48 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-07-24 08:42 - 2010-10-13 17:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-07-24 08:29 - 2013-03-16 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-23 15:25 - 2014-05-30 09:59 - 00000000 ____D () C:\Windows\rescache

2014-07-23 08:18 - 2014-07-23 08:18 - 00000687 _____ () C:\awh15E0.tmp

2014-07-21 19:35 - 2014-07-21 19:35 - 00000687 _____ () C:\awh4A3D.tmp
 

Some content of TEMP:

====================

C:\Users\Norman\AppData\Local\Temp\BackupSetup.exe

C:\Users\Norman\AppData\Local\Temp\BuenoSearchTB.exe

C:\Users\Norman\AppData\Local\Temp\dlLogic.exe

C:\Users\Norman\AppData\Local\Temp\drm_dyndata_7370012.dll

C:\Users\Norman\AppData\Local\Temp\drm_dyndata_7400009.dll

C:\Users\Norman\AppData\Local\Temp\EAD10A2.exe

C:\Users\Norman\AppData\Local\Temp\EAD116D.exe

C:\Users\Norman\AppData\Local\Temp\EAD138.exe

C:\Users\Norman\AppData\Local\Temp\EAD138F.exe

C:\Users\Norman\AppData\Local\Temp\EAD13AE.exe

C:\Users\Norman\AppData\Local\Temp\EAD1573.exe

C:\Users\Norman\AppData\Local\Temp\EAD162E.exe

C:\Users\Norman\AppData\Local\Temp\EAD17E3.exe

C:\Users\Norman\AppData\Local\Temp\EAD19B7.exe

C:\Users\Norman\AppData\Local\Temp\EAD19F5.exe

C:\Users\Norman\AppData\Local\Temp\EAD1BE8.exe

C:\Users\Norman\AppData\Local\Temp\EAD1C75.exe

C:\Users\Norman\AppData\Local\Temp\EAD1E1A.exe

C:\Users\Norman\AppData\Local\Temp\EAD209A.exe

C:\Users\Norman\AppData\Local\Temp\EAD222F.exe

C:\Users\Norman\AppData\Local\Temp\EAD22BC.exe

C:\Users\Norman\AppData\Local\Temp\EAD2367.exe

C:\Users\Norman\AppData\Local\Temp\EAD2386.exe

C:\Users\Norman\AppData\Local\Temp\EAD2480.exe

C:\Users\Norman\AppData\Local\Temp\EAD2616.exe

C:\Users\Norman\AppData\Local\Temp\EAD2635.exe

C:\Users\Norman\AppData\Local\Temp\EAD26D2.exe

C:\Users\Norman\AppData\Local\Temp\EAD26E0.exe

C:\Users\Norman\AppData\Local\Temp\EAD297F.exe

C:\Users\Norman\AppData\Local\Temp\EAD2A0C.exe

C:\Users\Norman\AppData\Local\Temp\EAD2A69.exe

C:\Users\Norman\AppData\Local\Temp\EAD2CAA.exe

C:\Users\Norman\AppData\Local\Temp\EAD2CCA.exe

C:\Users\Norman\AppData\Local\Temp\EAD2D46.exe

C:\Users\Norman\AppData\Local\Temp\EAD2D85.exe

C:\Users\Norman\AppData\Local\Temp\EAD2E.exe

C:\Users\Norman\AppData\Local\Temp\EAD2ECC.exe

C:\Users\Norman\AppData\Local\Temp\EAD2F59.exe

C:\Users\Norman\AppData\Local\Temp\EAD3429.exe

C:\Users\Norman\AppData\Local\Temp\EAD3439.exe

C:\Users\Norman\AppData\Local\Temp\EAD34F4.exe

C:\Users\Norman\AppData\Local\Temp\EAD366A.exe

C:\Users\Norman\AppData\Local\Temp\EAD38AC.exe

C:\Users\Norman\AppData\Local\Temp\EAD3DE9.exe

C:\Users\Norman\AppData\Local\Temp\EAD3EC4.exe

C:\Users\Norman\AppData\Local\Temp\EAD482.exe

C:\Users\Norman\AppData\Local\Temp\EAD4864.exe

C:\Users\Norman\AppData\Local\Temp\EAD49DB.exe

C:\Users\Norman\AppData\Local\Temp\EAD4B42.exe

C:\Users\Norman\AppData\Local\Temp\EAD4F86.exe

C:\Users\Norman\AppData\Local\Temp\EAD5485.exe

C:\Users\Norman\AppData\Local\Temp\EAD54D.exe

C:\Users\Norman\AppData\Local\Temp\EAD556F.exe

C:\Users\Norman\AppData\Local\Temp\EAD5724.exe

C:\Users\Norman\AppData\Local\Temp\EAD587B.exe

C:\Users\Norman\AppData\Local\Temp\EAD5BA.exe

C:\Users\Norman\AppData\Local\Temp\EAD5C23.exe

C:\Users\Norman\AppData\Local\Temp\EAD63B1.exe

C:\Users\Norman\AppData\Local\Temp\EAD65F2.exe

C:\Users\Norman\AppData\Local\Temp\EAD6F36.exe

C:\Users\Norman\AppData\Local\Temp\EAD73F7.exe

C:\Users\Norman\AppData\Local\Temp\EAD751F.exe

C:\Users\Norman\AppData\Local\Temp\EAD7731.exe

C:\Users\Norman\AppData\Local\Temp\EAD7732.exe

C:\Users\Norman\AppData\Local\Temp\EAD7905.exe

C:\Users\Norman\AppData\Local\Temp\EAD7A3D.exe

C:\Users\Norman\AppData\Local\Temp\EAD7A7C.exe

C:\Users\Norman\AppData\Local\Temp\EAD7B18.exe

C:\Users\Norman\AppData\Local\Temp\EAD7CBD.exe

C:\Users\Norman\AppData\Local\Temp\EAD819D.exe

C:\Users\Norman\AppData\Local\Temp\EAD820A.exe

C:\Users\Norman\AppData\Local\Temp\EAD8333.exe

C:\Users\Norman\AppData\Local\Temp\EAD8583.exe

C:\Users\Norman\AppData\Local\Temp\EAD8C09.exe

C:\Users\Norman\AppData\Local\Temp\EAD8DCD.exe

C:\Users\Norman\AppData\Local\Temp\EAD8EB8.exe

C:\Users\Norman\AppData\Local\Temp\EAD9165.exe

C:\Users\Norman\AppData\Local\Temp\EAD92FB.exe

C:\Users\Norman\AppData\Local\Temp\EAD933.exe

C:\Users\Norman\AppData\Local\Temp\EAD9645.exe

C:\Users\Norman\AppData\Local\Temp\EAD97BF.exe

C:\Users\Norman\AppData\Local\Temp\EAD9B45.exe

C:\Users\Norman\AppData\Local\Temp\EAD9C0.exe

C:\Users\Norman\AppData\Local\Temp\EAD9CBB.exe

C:\Users\Norman\AppData\Local\Temp\EAD9DF3.exe

C:\Users\Norman\AppData\Local\Temp\EADA053.exe

C:\Users\Norman\AppData\Local\Temp\EADAB.exe

C:\Users\Norman\AppData\Local\Temp\EADAF8F.exe

C:\Users\Norman\AppData\Local\Temp\EADB173.exe

C:\Users\Norman\AppData\Local\Temp\EADB6D0.exe

C:\Users\Norman\AppData\Local\Temp\EADB73D.exe

C:\Users\Norman\AppData\Local\Temp\EADB74D.exe

C:\Users\Norman\AppData\Local\Temp\EADB77C.exe

C:\Users\Norman\AppData\Local\Temp\EADB866.exe

C:\Users\Norman\AppData\Local\Temp\EADBCE.exe

C:\Users\Norman\AppData\Local\Temp\EADBD36.exe

C:\Users\Norman\AppData\Local\Temp\EADC225.exe

C:\Users\Norman\AppData\Local\Temp\EADC2A2.exe

C:\Users\Norman\AppData\Local\Temp\EADC7E.exe

C:\Users\Norman\AppData\Local\Temp\EADCB0E.exe

C:\Users\Norman\AppData\Local\Temp\EADCD3D.exe

C:\Users\Norman\AppData\Local\Temp\EADCD7B.exe

C:\Users\Norman\AppData\Local\Temp\EADCE84.exe

C:\Users\Norman\AppData\Local\Temp\EADD68.exe

C:\Users\Norman\AppData\Local\Temp\EADD7B8.exe

C:\Users\Norman\AppData\Local\Temp\EADD858.exe

C:\Users\Norman\AppData\Local\Temp\EADDA.exe

C:\Users\Norman\AppData\Local\Temp\EADDA95.exe

C:\Users\Norman\AppData\Local\Temp\EADDF37.exe

C:\Users\Norman\AppData\Local\Temp\EADDF46.exe

C:\Users\Norman\AppData\Local\Temp\EADE04.exe

C:\Users\Norman\AppData\Local\Temp\EADE0FB.exe

C:\Users\Norman\AppData\Local\Temp\EADE407.exe

C:\Users\Norman\AppData\Local\Temp\EADE780.exe

C:\Users\Norman\AppData\Local\Temp\EADE906.exe

C:\Users\Norman\AppData\Local\Temp\EADEACE.exe

C:\Users\Norman\AppData\Local\Temp\EADEBA5.exe

C:\Users\Norman\AppData\Local\Temp\EADEBF.exe

C:\Users\Norman\AppData\Local\Temp\EADECBE.exe

C:\Users\Norman\AppData\Local\Temp\EADEFE9.exe

C:\Users\Norman\AppData\Local\Temp\EADF.exe

C:\Users\Norman\AppData\Local\Temp\EADF018.exe

C:\Users\Norman\AppData\Local\Temp\EADF0F2.exe

C:\Users\Norman\AppData\Local\Temp\EADF259.exe

C:\Users\Norman\AppData\Local\Temp\EADF391.exe

C:\Users\Norman\AppData\Local\Temp\EADF392.exe

C:\Users\Norman\AppData\Local\Temp\EADF556.exe

C:\Users\Norman\AppData\Local\Temp\EADF5C3.exe

C:\Users\Norman\AppData\Local\Temp\EADF630.exe

C:\Users\Norman\AppData\Local\Temp\EADF8CF.exe

C:\Users\Norman\AppData\Local\Temp\EADF90D.exe

C:\Users\Norman\AppData\Local\Temp\EADFD70.exe

C:\Users\Norman\AppData\Local\Temp\EnableExtDll.dll

C:\Users\Norman\AppData\Local\Temp\installhelper.dll

C:\Users\Norman\AppData\Local\Temp\LollipopInstaller_notifications.exe

C:\Users\Norman\AppData\Local\Temp\optprosetup.exe

C:\Users\Norman\AppData\Local\Temp\speedupmypc.exe

C:\Users\Norman\AppData\Local\Temp\SpOrder.dll

C:\Users\Norman\AppData\Local\Temp\SRAssetsHelper.dll

C:\Users\Norman\AppData\Local\Temp\System.Data.SQLite.dll

C:\Users\Norman\AppData\Local\Temp\System.Data.SQLite13451.dll

C:\Users\Norman\AppData\Local\Temp\System.Data.SQLite17317.dll

C:\Users\Norman\AppData\Local\Temp\System.Data.SQLite82239.dll

C:\Users\Norman\AppData\Local\Temp\System.Data.SQLite94484.dll

C:\Users\Norman\AppData\Local\Temp\tbuC541.exe

C:\Users\Norman\AppData\Local\Temp\tbuDE7C.exe

C:\Users\Norman\AppData\Local\Temp\tmp2899.dll

C:\Users\Norman\AppData\Local\Temp\vcredist_x64.exe

C:\Users\Norman\AppData\Local\Temp\_is7954.exe

C:\Users\Norman\AppData\Local\Temp\{AA71B31A-48D7-4AD8-A02E-647EDCF2D0B2}-29.0.1547.66_29.0.1547.62_chrome_updater.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-07-23 15:18
 

==================== End Of Log ============================

--- --- ---

Code:

GMER 2.1.19357 - hxxp://www.gmer.net

Rootkit scan 2014-08-20 10:50:06

Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB

Running: Gmer-19357.exe; Driver: C:\Users\Norman\AppData\Local\Temp\ugldrpow.sys
 
 

---- Kernel code sections - GMER 2.1 ----
 

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                     fffff800037b2000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                     fffff800037b202f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]
 

---- User code sections - GMER 2.1 ----
 

.text     C:\Windows\system32\services.exe[616] C:\Windows\system32\kernel32.dll!SetFileCompletionNotificationModes                                              0000000077a90880 14 bytes {JMP QWORD [RIP+0x0]}

.text     C:\Windows\system32\svchost.exe[840] C:\Windows\system32\kernel32.dll!SetFileCompletionNotificationModes                                               0000000077a90880 14 bytes {JMP QWORD [RIP+0x0]}

.text     C:\Windows\system32\svchost.exe[856] C:\Windows\system32\kernel32.dll!SetFileCompletionNotificationModes                                               0000000077a90880 14 bytes {JMP QWORD [RIP+0x0]}

.text     C:\Windows\system32\svchost.exe[1752] C:\Windows\system32\kernel32.dll!SetFileCompletionNotificationModes                                              0000000077a90880 14 bytes {JMP QWORD [RIP+0x0]}

.text     C:\Program Files\Bonjour\mDNSResponder.exe[1992] C:\Windows\system32\kernel32.dll!SetFileCompletionNotificationModes                                   0000000077a90880 14 bytes {JMP QWORD [RIP+0x0]}

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000762d1465 2 bytes [2D, 76]

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2788] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000762d14bb 2 bytes [2D, 76]

.text     ...                                                                                                                                                    * 2

.text     C:\Windows\AsScrPro.exe[3244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                  00000000762d1465 2 bytes [2D, 76]

.text     C:\Windows\AsScrPro.exe[3244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                 00000000762d14bb 2 bytes [2D, 76]

.text     ...                                                                                                                                                    * 2

.text     C:\Windows\System32\svchost.exe[2476] C:\Windows\system32\kernel32.dll!SetFileCompletionNotificationModes                                              0000000077a90880 14 bytes {JMP QWORD [RIP+0x0]}
 

---- Threads - GMER 2.1 ----
 

Thread    C:\Windows\system32\services.exe [616:3004]                                                                                                            000000000110f430

Thread    C:\Windows\system32\services.exe [616:3008]                                                                                                            000000000110f430

Thread    C:\Windows\system32\services.exe [616:3012]                                                                                                            000000000110f430

Thread    C:\Windows\system32\services.exe [616:3016]                                                                                                            000000000110f430

Thread    C:\Windows\system32\services.exe [616:3024]                                                                                                            000000000112dc30

Thread    C:\Windows\system32\services.exe [616:2852]                                                                                                            000000000112dc30

Thread    C:\Windows\system32\svchost.exe [840:880]                                                                                                              000000000052f430

Thread    C:\Windows\system32\svchost.exe [840:884]                                                                                                              000000000052f430

Thread    C:\Windows\system32\svchost.exe [840:888]                                                                                                              000000000052f430

Thread    C:\Windows\system32\svchost.exe [840:892]                                                                                                              000000000052f430

Thread    C:\Windows\system32\svchost.exe [840:900]                                                                                                              000000000054dc30

Thread    C:\Windows\system32\svchost.exe [856:1660]                                                                                                             0000000000bdf430

Thread    C:\Windows\system32\svchost.exe [856:1664]                                                                                                             0000000000bdf430

Thread    C:\Windows\system32\svchost.exe [856:1668]                                                                                                             0000000000bdf430

Thread    C:\Windows\system32\svchost.exe [856:1672]                                                                                                             0000000000bdf430

Thread    C:\Windows\system32\svchost.exe [856:1680]                                                                                                             0000000000bfdc30

Thread    C:\Windows\system32\svchost.exe [856:1728]                                                                                                             0000000000bfdc30

Thread    C:\Windows\system32\svchost.exe [1232:5992]                                                                                                            0000000015b43134

Thread    C:\Windows\system32\svchost.exe [1232:6000]                                                                                                            0000000015b42ff8

Thread    C:\Windows\System32\spoolsv.exe [1704:2920]                                                                                                            000000000245f430

Thread    C:\Windows\System32\spoolsv.exe [1704:2924]                                                                                                            000000000245f430

Thread    C:\Windows\System32\spoolsv.exe [1704:2928]                                                                                                            000000000245f430

Thread    C:\Windows\System32\spoolsv.exe [1704:2932]                                                                                                            000000000245f430

Thread    C:\Windows\system32\svchost.exe [1752:2440]                                                                                                            00000000010ff430

Thread    C:\Windows\system32\svchost.exe [1752:2444]                                                                                                            00000000010ff430

Thread    C:\Windows\system32\svchost.exe [1752:2448]                                                                                                            00000000010ff430

Thread    C:\Windows\system32\svchost.exe [1752:2452]                                                                                                            00000000010ff430

Thread    C:\Windows\system32\svchost.exe [1752:2460]                                                                                                            000000000111dc30

Thread    C:\Windows\Explorer.EXE [3176:5952]                                                                                                                    000000000650f430

Thread    C:\Windows\Explorer.EXE [3176:5956]                                                                                                                    000000000650f430

Thread    C:\Windows\Explorer.EXE [3176:5960]                                                                                                                    000000000650f430

Thread    C:\Windows\Explorer.EXE [3176:5964]                                                                                                                    000000000650f430

Thread    C:\Windows\Explorer.EXE [3176:5972]                                                                                                                    000000000652dc30

Thread    C:\Windows\Explorer.EXE [3176:5984]                                                                                                                    000000000652dc30

Thread    C:\Windows\System32\svchost.exe [2476:1476]                                                                                                            00000000001df430

Thread    C:\Windows\System32\svchost.exe [2476:5124]                                                                                                            00000000001df430

Thread    C:\Windows\System32\svchost.exe [2476:5128]                                                                                                            00000000001df430

Thread    C:\Windows\System32\svchost.exe [2476:5132]                                                                                                            00000000001df430

Thread    C:\Windows\System32\svchost.exe [2476:5140]                                                                                                            00000000001fdc30

Thread    C:\Windows\System32\svchost.exe [2476:5164]                                                                                                            00000000001fdc30

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5292:5552]                                                                                         000000000169f430

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5292:5556]                                                                                         000000000169f430

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5292:5560]                                                                                         000000000169f430

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5292:5564]                                                                                         000000000169f430

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5292:5572]                                                                                         00000000016bdc30

Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [5292:5604]                                                                                         00000000016bdc30

---- Processes - GMER 2.1 ----
 

Library   C:\PROGRA~3\WinSpeed\WINSPE~1.DLL (*** suspicious ***) @ C:\Windows\system32\rundll32.exe [2020](2014-08-20 05:57:55)                                  000007fef8a20000

Library   c:\progra~3\winspeed\winspeed.dll (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [1196](2014-08-20 05:57:54)                                  0000000072fd0000

Library   c:\progra~3\winspeed\WinSpeedSvc.dll (*** suspicious ***) @ C:\Windows\SysWOW64\rundll32.exe [1196](2014-08-20 05:57:55)                               0000000072f50000

Library   Ì÷wà]H (*** suspicious ***) @ C:\Windows\Explorer.EXE [3176]                                                                                          000007fee6d40000
 

---- Registry - GMER 2.1 ----
 

Reg       HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                       

Reg       HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                    0x00 0x00 0x00 0x00 ...

Reg       HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                    0

Reg       HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                 0xBD 0x56 0x04 0xC1 ...

Reg       HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                    C:\Program Files (x86)\DAEMON Tools Lite\

Reg       HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                                   

Reg       HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                                                        0x00 0x00 0x00 0x00 ...

Reg       HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                                                        0

Reg       HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                                                     0xBD 0x56 0x04 0xC1 ...

Reg       HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                        C:\Program Files (x86)\DAEMON Tools Lite\
 

---- EOF - GMER 2.1 ----

Adware & Co. deinstallieren

Lade Dir bitte von hier http://deeprybka.trojaner-board.de/b...ninstaller.pngRevo Uninstaller herunter.
Installiere und starte das Programm.
Suche im Uninstallerfeld nach den Programmen, die unter:
http://deeprybka.trojaner-board.de/b.../revo/add1.png
diesen Zusatz haben:
http://deeprybka.trojaner-board.de/b...e/revo/att.PNG
Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
http://deeprybka.trojaner-board.de/b.../uninstall.PNG http://deeprybka.trojaner-board.de/b...o/moderat2.PNG
Reste löschen:
Klicke auf http://deeprybka.trojaner-board.de/b.../selectall.PNG dann auf http://deeprybka.trojaner-board.de/b...evo/delete.PNG und dann auf http://deeprybka.trojaner-board.de/b...evo/weiter.PNG.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Hallo Schrauber,

Schritt 1 habe ich durchgeführt. Allerdings kann ich combofix nicht herunterladen. Woran könnte dies liegen. (Nutze einen anderen Computer zum Download)

mfG

So, jetzt alles erledigt. Keine besonderen Vorkommnisse. Anbei poste ich das Log- File.

Code:

ComboFix 14-08-19.01 - Norman 21.08.2014  10:30:20.1.4 - x64

Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.3885.1989 [GMT 2:00]

ausgeführt von:: c:\users\Norman\Desktop\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

C:\END

c:\esupport\eDriver\Software\ASUS\MultiFrame\XP32_Vista32_Vista64_Win7_32_Win7_64_1.0.0021\Desktop_.ini

C:\prefs.js

c:\program files (x86)\Common Files\ASPG_icon.ico

c:\program files (x86)\MediaBuzzV1

c:\program files (x86)\MediaWatchV1

c:\programdata\374311380

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ekdgbodaoampohmhmecigaomnjppbplb_0

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_ekdgbodaoampohmhmecigaomnjppbplb_0\70

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\background.html

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\chromeCoreFilesIndex.txt

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\crossriderManifest.json

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\manifest.xml

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins.json

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\1.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\102.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\104.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\13.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\14.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\155.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\17.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\177.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\182.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\183.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\184.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\19.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\191.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\193.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\195.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\207.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\21.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\211.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\22.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\220.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\221.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\242.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\244.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\246.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\262.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\263.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\267.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\28.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\4.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\47.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\64.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\7.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\72.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\78.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\80.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\9.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\91.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\93.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\97.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\userCode\background.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\userCode\extension.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\icons\actions\1.png

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\icons\icon128.png

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\icons\icon16.png

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\icons\icon48.png

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\api\chrome.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\api\cookie.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\api\message.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\api\monitor.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\api\pageAction.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\api\pageActionBG.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\background.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\app_api.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\bg_app_api.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\consts.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\cookie_store.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\crossriderAPI.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\delegate.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\events.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\extensionDataStore.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\installer.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\logFile.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\logging.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\onBGDocumentLoad.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\popupResource\newPopup.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\popupResource\popup.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\reports.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\storageWrapper.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\updateManager.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\util.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\lib\xhr.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\main.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\js\platformVersion.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\manifest.json

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\popup.html

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij\183\background.html

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij\183\ckIF.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij\183\content.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij\183\lsdb.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\gkakfimgbmogkpmjokgnbbanmmemcdij\183\manifest.json

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn\189\ApbPXl.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn\189\background.html

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn\189\content.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn\189\lsdb.js

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\omioomoieildjihcajfoobhhiecjkmfn\189\manifest.json

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\000260.ldb

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\000274.ldb

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\000289.ldb

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\000290.log

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\CURRENT

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\LOCK

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\LOG

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\LOG.old

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ekdgbodaoampohmhmecigaomnjppbplb\MANIFEST-000288

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ekdgbodaoampohmhmecigaomnjppbplb_0.localstorage-journal

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ekdgbodaoampohmhmecigaomnjppbplb_0.localstorage

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_omioomoieildjihcajfoobhhiecjkmfn_0.localstorage-journal

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_omioomoieildjihcajfoobhhiecjkmfn_0.localstorage

c:\users\Norman\AppData\Local\Google\Chrome\User Data\Default\Preferences

c:\users\Norman\AppData\Local\Temp\__tmp_0604b699

c:\users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\extensions\vamchw@ovy.co.uk

c:\users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\extensions\vamchw@ovy.co.uk\bootstrap.js

c:\users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\extensions\vamchw@ovy.co.uk\chrome.manifest

c:\users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\extensions\vamchw@ovy.co.uk\content\bg.js

c:\users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\extensions\vamchw@ovy.co.uk\install.rdf

c:\windows\IsUn0407.exe

c:\windows\msvcr71.dll

c:\windows\PFRO.log

.

Infizierte Kopie von c:\windows\SysWow64\kernel32.dll wurde gefunden und desinfiziert 

Kopie von - c:\windows\winsxs\wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22653_none_fc95db0bba8ae4c2\kernel32.dll wurde wiederhergestellt 

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_NETHFDRV

-------\Service_globalUpdate

.

.

(((((((((((((((((((((((   Dateien erstellt von 2014-07-21 bis 2014-08-21  ))))))))))))))))))))))))))))))

.

.

2014-08-21 08:12 . 2014-08-18 04:14        11319200        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{0B15F75D-E5C3-457A-A11C-DCEA76F85816}\mpengine.dll

2014-08-21 07:23 . 2014-08-21 07:23        --------        d-----w-        c:\program files (x86)\CooiLSalEECoUpon

2014-08-21 07:10 . 2014-08-21 07:10        --------        d-----w-        c:\program files (x86)\VS Revo Group

2014-08-20 08:27 . 2014-08-20 08:31        --------        d-----w-        C:\FRST

2014-08-18 10:20 . 2014-08-21 07:23        --------        d-----w-        c:\programdata\8e27c8f07b9e9861

2014-08-13 12:02 . 2014-03-09 21:48        171160        ----a-w-        c:\windows\system32\infocardapi.dll

2014-08-13 12:02 . 2014-03-09 21:48        1389208        ----a-w-        c:\windows\system32\icardagt.exe

2014-08-13 12:02 . 2014-03-09 21:47        99480        ----a-w-        c:\windows\SysWow64\infocardapi.dll

2014-08-13 12:02 . 2014-03-09 21:47        619672        ----a-w-        c:\windows\SysWow64\icardagt.exe

2014-08-13 12:02 . 2014-06-30 22:24        8856        ----a-w-        c:\windows\system32\icardres.dll

2014-08-13 12:02 . 2014-06-30 22:14        8856        ----a-w-        c:\windows\SysWow64\icardres.dll

2014-08-13 12:01 . 2014-06-06 06:16        35480        ----a-w-        c:\windows\SysWow64\TsWpfWrp.exe

2014-08-13 12:01 . 2014-06-06 06:12        35480        ----a-w-        c:\windows\system32\TsWpfWrp.exe

2014-08-13 11:14 . 2014-07-09 02:03        7168        ----a-w-        c:\windows\system32\KBDTAT.DLL

2014-08-13 11:14 . 2014-07-09 02:03        7168        ----a-w-        c:\windows\system32\KBDRU1.DLL

2014-08-13 11:14 . 2014-07-09 02:03        6656        ----a-w-        c:\windows\system32\KBDRU.DLL

2014-08-13 11:14 . 2014-07-09 01:31        7168        ----a-w-        c:\windows\SysWow64\KBDYAK.DLL

2014-08-13 11:14 . 2014-07-09 01:31        6656        ----a-w-        c:\windows\SysWow64\KBDBASH.DLL

2014-08-13 11:14 . 2014-07-09 02:03        7168        ----a-w-        c:\windows\system32\KBDYAK.DLL

2014-08-13 11:14 . 2014-07-09 02:03        7168        ----a-w-        c:\windows\system32\KBDBASH.DLL

2014-08-13 11:14 . 2014-07-16 03:23        2048        ----a-w-        c:\windows\system32\tzres.dll

2014-08-13 11:14 . 2014-07-16 02:46        2048        ----a-w-        c:\windows\SysWow64\tzres.dll

2014-08-13 11:13 . 2014-06-03 10:02        3241984        ----a-w-        c:\windows\system32\msi.dll

2014-08-13 11:13 . 2014-06-03 09:29        2363392        ----a-w-        c:\windows\SysWow64\msi.dll

2014-08-13 11:13 . 2014-06-03 10:02        112064        ----a-w-        c:\windows\system32\consent.exe

2014-08-13 11:13 . 2014-06-03 10:02        1941504        ----a-w-        c:\windows\system32\authui.dll

2014-08-13 11:13 . 2014-06-03 09:29        1805824        ----a-w-        c:\windows\SysWow64\authui.dll

2014-08-13 11:13 . 2014-06-03 10:02        504320        ----a-w-        c:\windows\system32\msihnd.dll

2014-08-13 11:13 . 2014-06-03 09:29        337408        ----a-w-        c:\windows\SysWow64\msihnd.dll

2014-08-13 11:12 . 2014-06-16 02:10        985536        ----a-w-        c:\windows\system32\drivers\dxgkrnl.sys

2014-08-13 11:12 . 2014-07-16 02:12        3163648        ----a-w-        c:\windows\system32\win32k.sys

2014-08-13 11:12 . 2014-07-16 03:25        404480        ----a-w-        c:\windows\system32\gdi32.dll

2014-08-13 11:12 . 2014-07-16 02:46        311808        ----a-w-        c:\windows\SysWow64\gdi32.dll

2014-08-13 11:12 . 2014-06-25 02:05        14175744        ----a-w-        c:\windows\system32\shell32.dll

2014-08-13 11:05 . 2014-05-08 09:32        3178496        ----a-w-        c:\windows\system32\rdpcorets.dll

2014-08-13 11:05 . 2014-05-08 09:32        16384        ----a-w-        c:\windows\system32\RdpGroupPolicyExtension.dll

2014-08-13 11:05 . 2014-07-14 02:02        1216000        ----a-w-        c:\windows\system32\rpcrt4.dll

2014-08-13 11:05 . 2014-07-14 01:40        664064        ----a-w-        c:\windows\SysWow64\rpcrt4.dll

2014-08-13 11:05 . 2014-01-09 02:22        5694464        ----a-w-        c:\windows\SysWow64\mstscax.dll

2014-08-13 11:05 . 2014-01-03 22:44        6574592        ----a-w-        c:\windows\system32\mstscax.dll

2014-08-13 11:04 . 2014-08-07 02:06        529920        ----a-w-        c:\windows\system32\aepdu.dll

2014-08-13 11:04 . 2014-08-07 02:01        424448        ----a-w-        c:\windows\system32\aeinv.dll

2014-08-06 06:02 . 2014-08-20 07:08        --------        d-----w-        c:\program files (x86)\Malwarebytes Anti-Malware

2014-08-06 06:02 . 2014-08-13 10:46        --------        d-----w-        c:\programdata\Malwarebytes

2014-08-06 06:02 . 2014-05-12 05:26        63704        ----a-w-        c:\windows\system32\drivers\mwac.sys

2014-08-06 05:54 . 2014-08-06 05:54        687        ----a-w-        C:\awh81A.tmp

2014-08-06 05:42 . 2012-08-23 14:10        19456        ----a-w-        c:\windows\system32\drivers\rdpvideominiport.sys

2014-08-06 05:42 . 2012-08-23 11:12        192000        ----a-w-        c:\windows\SysWow64\rdpendp_winip.dll

2014-08-06 05:42 . 2012-08-23 14:13        243200        ----a-w-        c:\windows\system32\rdpudd.dll

2014-08-06 05:42 . 2012-08-23 10:51        228864        ----a-w-        c:\windows\system32\rdpendp_winip.dll

2014-08-06 05:41 . 2013-09-25 02:23        1030144        ----a-w-        c:\windows\system32\TSWorkspace.dll

2014-08-06 05:41 . 2013-09-25 01:57        792576        ----a-w-        c:\windows\SysWow64\TSWorkspace.dll

2014-08-06 05:40 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll

2014-08-06 05:40 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll

2014-08-06 05:26 . 2014-08-06 05:26        687        ----a-w-        C:\awh4AE4.tmp

2014-08-04 09:22 . 2014-08-04 09:22        687        ----a-w-        C:\awh2D46.tmp

2014-08-04 05:32 . 2014-08-04 05:32        687        ----a-w-        C:\awhCDC9.tmp

2014-08-04 05:09 . 2014-08-04 05:09        687        ----a-w-        C:\awh6C78.tmp

2014-08-02 11:26 . 2014-08-02 11:26        687        ----a-w-        C:\awh4FB5.tmp

2014-07-31 06:44 . 2014-07-31 06:44        687        ----a-w-        C:\awh5292.tmp

2014-07-30 18:23 . 2014-07-30 18:23        687        ----a-w-        C:\awhAD4E.tmp

2014-07-30 06:25 . 2014-07-30 06:25        687        ----a-w-        C:\awh3957.tmp

2014-07-29 07:11 . 2014-07-29 07:11        687        ----a-w-        C:\awh4587.tmp

2014-07-29 06:15 . 2014-07-29 06:15        --------        d-----w-        c:\users\Norman\AppData\Local\com

2014-07-29 06:12 . 2014-08-20 07:08        --------        d-----w-        c:\program files (x86)\Optimizer Pro

2014-07-29 06:11 . 2014-07-29 06:11        --------        d-----w-        c:\program files (x86)\PepperZip

2014-07-29 06:11 . 2014-07-28 18:24        4795904        ----a-w-        c:\windows\score.exe

2014-07-29 06:11 . 2014-08-06 10:25        --------        d-----w-        c:\users\Norman\AppData\Roaming\VOPackage

2014-07-29 06:10 . 2014-07-29 06:10        687        ----a-w-        C:\awh1812.tmp

2014-07-28 05:13 . 2014-07-28 05:13        687        ----a-w-        C:\awh17F2.tmp

2014-07-27 18:10 . 2014-07-27 18:10        687        ----a-w-        C:\awh63A2.tmp

2014-07-27 16:56 . 2014-07-27 16:56        687        ----a-w-        C:\awh5C71.tmp

2014-07-27 09:26 . 2014-07-27 09:26        687        ----a-w-        C:\awh26C1.tmp

2014-07-26 10:38 . 2014-07-26 10:38        687        ----a-w-        C:\awh6315.tmp

2014-07-25 15:47 . 2014-07-25 15:47        687        ----a-w-        C:\awh1525.tmp

2014-07-25 05:50 . 2014-07-25 05:50        687        ----a-w-        C:\awh20F7.tmp

2014-07-24 16:49 . 2014-07-24 16:49        687        ----a-w-        C:\awh7FC9.tmp

2014-07-24 06:47 . 2014-07-24 06:47        687        ----a-w-        C:\awh3C06.tmp

2014-07-23 06:18 . 2014-07-23 06:18        687        ----a-w-        C:\awh15E0.tmp

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2014-08-21 09:21 . 2011-07-03 17:09        45056        ----a-w-        c:\windows\system32\acovcnt.exe

2014-08-13 12:09 . 2010-10-13 15:55        99218768        ----a-w-        c:\windows\system32\MRT.exe

2014-08-05 07:20 . 2010-12-20 11:35        270496        ------w-        c:\windows\system32\MpSigStub.exe

2014-07-21 17:35 . 2014-07-21 17:35        687        ----a-w-        C:\awh4A3D.tmp

2014-07-19 15:44 . 2014-07-19 15:44        687        ----a-w-        C:\awh3716.tmp

2014-07-18 15:11 . 2014-07-18 15:11        687        ----a-w-        C:\awh750.tmp

2014-07-18 14:37 . 2014-07-18 14:37        687        ----a-w-        C:\awh580E.tmp

2014-07-18 14:28 . 2014-07-18 14:28        687        ----a-w-        C:\awh40C7.tmp

2014-07-18 06:06 . 2014-07-18 06:06        687        ----a-w-        C:\awh1AEF.tmp

2014-07-17 06:59 . 2014-07-17 06:59        687        ----a-w-        C:\awh422D.tmp

2014-07-17 04:17 . 2014-07-17 04:17        687        ----a-w-        C:\awh4327.tmp

2014-07-16 14:43 . 2012-05-30 06:30        20280        ----a-w-        c:\windows\system32\roboot64.exe

2014-07-15 10:26 . 2014-07-15 10:26        687        ----a-w-        C:\awh8729.tmp

2014-07-15 05:27 . 2014-07-15 05:27        687        ----a-w-        C:\awhE7BB.tmp

2014-07-11 15:31 . 2014-07-11 15:31        687        ----a-w-        C:\awhBA2A.tmp

2014-07-11 06:50 . 2014-07-11 06:50        687        ----a-w-        C:\awh79EF.tmp

2014-07-11 05:29 . 2014-07-11 05:29        687        ----a-w-        C:\awhE2B0.tmp

2014-07-10 20:06 . 2014-07-10 20:06        687        ----a-w-        C:\awh6585.tmp

2014-07-10 09:46 . 2014-07-10 09:46        687        ----a-w-        C:\awh1C36.tmp

2014-07-09 12:03 . 2014-07-09 12:03        687        ----a-w-        C:\awhBA49.tmp

2014-07-09 09:46 . 2012-11-17 11:41        699056        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2014-07-09 09:46 . 2012-11-17 11:41        71344        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2014-07-09 09:46 . 2014-05-14 07:47        11204096        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe

2014-07-08 05:34 . 2014-07-08 05:34        687        ----a-w-        C:\awh53D9.tmp

2014-07-07 05:03 . 2014-07-07 05:03        687        ----a-w-        C:\awh474C.tmp

2014-07-06 09:34 . 2014-07-06 09:34        687        ----a-w-        C:\awh9DC4.tmp

2014-07-03 18:57 . 2014-07-03 18:57        687        ----a-w-        C:\awh4F67.tmp

2014-07-03 07:21 . 2014-07-03 07:21        687        ----a-w-        C:\awhCAAE.tmp

2014-06-30 18:35 . 2014-06-30 18:35        687        ----a-w-        C:\awhA0FF.tmp

2014-06-29 12:21 . 2014-06-29 12:21        687        ----a-w-        C:\awhDF56.tmp

2014-06-28 07:16 . 2014-06-28 07:16        687        ----a-w-        C:\awhC681.tmp

2014-06-25 20:34 . 2014-06-25 20:34        0        ----a-w-        c:\windows\SysWow64\shoF32B.tmp

2014-06-25 14:36 . 2014-06-25 14:36        687        ----a-w-        C:\awh843C.tmp

2014-06-25 05:27 . 2014-06-25 05:27        687        ----a-w-        C:\awh53F9.tmp

2014-06-24 20:32 . 2014-06-24 20:32        687        ----a-w-        C:\awh6891.tmp

2014-06-22 09:11 . 2014-06-22 09:11        687        ----a-w-        C:\awh58E8.tmp

2014-06-21 08:12 . 2014-06-21 08:12        687        ----a-w-        C:\awhF48B.tmp

2014-06-20 12:29 . 2014-06-20 12:29        687        ----a-w-        C:\awh8D6F.tmp

2014-06-18 09:44 . 2014-06-19 12:55        608179        ----a-w-        c:\users\Norman\AppData\Local\AnyProtectScannerSetup.exe

2014-06-18 02:18 . 2014-07-09 13:17        692736        ----a-w-        c:\windows\system32\osk.exe

2014-06-18 01:51 . 2014-07-09 13:17        646144        ----a-w-        c:\windows\SysWow64\osk.exe

2014-06-16 14:59 . 2014-06-16 14:59        108544        ----a-w-        c:\windows\SysWow64\hfnapi.dll

2014-06-16 14:59 . 2014-06-16 14:59        246784        ----a-w-        c:\windows\SysWow64\hfpapi.dll

2014-06-06 10:10 . 2014-07-09 13:17        624128        ----a-w-        c:\windows\system32\qedit.dll

2014-06-06 09:44 . 2014-07-09 13:17        509440        ----a-w-        c:\windows\SysWow64\qedit.dll

2014-06-05 14:45 . 2014-07-09 13:16        1460736        ----a-w-        c:\windows\system32\lsasrv.dll

2014-06-05 14:26 . 2014-07-09 13:16        22016        ----a-w-        c:\windows\SysWow64\secur32.dll

2014-06-05 14:25 . 2014-07-09 13:16        96768        ----a-w-        c:\windows\SysWow64\sspicli.dll

2014-05-30 08:08 . 2014-07-09 13:17        210944        ----a-w-        c:\windows\system32\wdigest.dll

2014-05-30 08:08 . 2014-07-09 13:17        86528        ----a-w-        c:\windows\system32\TSpkg.dll

2014-05-30 08:08 . 2014-07-09 13:17        340992        ----a-w-        c:\windows\system32\schannel.dll

2014-05-30 08:08 . 2014-07-09 13:17        314880        ----a-w-        c:\windows\system32\msv1_0.dll

2014-05-30 08:08 . 2014-07-09 13:17        307200        ----a-w-        c:\windows\system32\ncrypt.dll

2014-05-30 08:08 . 2014-07-09 13:17        728064        ----a-w-        c:\windows\system32\kerberos.dll

2014-05-30 08:08 . 2014-07-09 13:17        22016        ----a-w-        c:\windows\system32\credssp.dll

2014-05-30 07:52 . 2014-07-09 13:17        172032        ----a-w-        c:\windows\SysWow64\wdigest.dll

2014-05-30 07:52 . 2014-07-09 13:17        65536        ----a-w-        c:\windows\SysWow64\TSpkg.dll

2014-05-30 07:52 . 2014-07-09 13:17        247808        ----a-w-        c:\windows\SysWow64\schannel.dll

2014-05-30 07:52 . 2014-07-09 13:17        220160        ----a-w-        c:\windows\SysWow64\ncrypt.dll

2014-05-30 07:52 . 2014-07-09 13:17        259584        ----a-w-        c:\windows\SysWow64\msv1_0.dll

2014-05-30 07:52 . 2014-07-09 13:17        550912        ----a-w-        c:\windows\SysWow64\kerberos.dll

2014-05-30 07:52 . 2014-07-09 13:17        17408        ----a-w-        c:\windows\SysWow64\credssp.dll

2014-05-30 06:45 . 2014-07-09 13:17        497152        ----a-w-        c:\windows\system32\drivers\afd.sys

2014-05-28 07:03 . 2014-05-28 07:03        0        ----a-w-        c:\windows\SysWow64\shoB2FA.tmp

2009-04-08 17:31 . 2009-04-08 17:31        106496        ----a-w-        c:\program files (x86)\Common Files\CPInstallAction.dll

2008-08-12 04:45 . 2008-08-12 04:45        155648        ----a-w-        c:\program files (x86)\Common Files\MSIactionall.dll

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

2011-01-17 14:54        175912        ----a-w-        c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]

"{872b5b88-9db5-4310-bdd0-ac189557e5f5}"= "c:\program files (x86)\DVDVideoSoftTB\prxtbDVDV.dll" [2011-01-17 175912]

.

[HKEY_CLASSES_ROOT\clsid\{872b5b88-9db5-4310-bdd0-ac189557e5f5}]

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"GoogleChromeAutoLaunch_29B69EEE740A47DF7549CA7579BEBBEF"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-08-07 860488]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

FancyStart daemon.lnk - c:\windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe -d [2010-6-8 12862]

Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

"aux"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]

"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe"

.

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]

R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbnet.sys [x]

R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys;c:\windows\SYSNATIVE\DRIVERS\ggflt.sys [x]

R3 globalUpdatem;globalUpdate Update Service (globalUpdatem);c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe;c:\program files (x86)\globalUpdate\Update\GoogleUpdate.exe [x]

R3 hwusbfake;Huawei DataCard USB Fake;c:\windows\system32\DRIVERS\ewusbfake.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbfake.sys [x]

R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]

R3 massfilter;Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]

R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]

R3 Sony Ericsson PCCompanion;Sony Ericsson PCCompanion;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe;c:\program files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [x]

R3 Sony PC Companion;Sony PC Companion;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe;c:\program files (x86)\Sony\Sony PC Companion\PCCService.exe [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]

R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]

R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]

R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]

R4 PuranDefrag;PuranDefrag;c:\windows\system32\PuranDefragS.exe;c:\windows\SYSNATIVE\PuranDefragS.exe [x]

R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]

S0 lullaby;lullaby;c:\windows\system32\DRIVERS\lullaby.sys;c:\windows\SYSNATIVE\DRIVERS\lullaby.sys [x]

S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]

S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]

S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]

S2 scores;scores;c:\windows\score.exe;c:\windows\score.exe [x]

S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]

S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]

S2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\1&1 Surf-Stick\AssistantServices.exe;c:\program files (x86)\1&1 Surf-Stick\AssistantServices.exe [x]

S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]

S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]

S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys;c:\windows\SYSNATIVE\DRIVERS\HECIx64.sys [x]

S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys;c:\windows\SYSNATIVE\DRIVERS\Impcd.sys [x]

S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]

S3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]

S3 JME;JMicron Ethernet Adapter NDIS6.20 Driver (Amd64 Bits);c:\windows\system32\DRIVERS\JME.sys;c:\windows\SYSNATIVE\DRIVERS\JME.sys [x]

S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]

S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]

S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]

S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]

S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]

2014-08-13 11:36        1104200        ----a-w-        c:\program files (x86)\Google\Chrome\Application\36.0.1985.143\Installer\chrmstp.exe

.

Inhalt des "geplante Tasks" Ordners

.

2014-08-21 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-17 09:46]

.

2014-06-18 c:\windows\Tasks\ASUS SmartLogon Console Sensor.job

- c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe [2009-07-31 17:38]

.

2014-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-08 21:07]

.

2014-08-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-06-08 21:07]

.

2014-08-21 c:\windows\Tasks\MT66 Software Update.job

- c:\program files (x86)\Common Files\MT66 Software Update\UpdateClient.exe [2012-12-08 17:44]

.

2014-04-02 c:\windows\Tasks\User_Feed_Synchronization-{F29BB976-EE78-451D-926D-D0607B097FA2}.job

- c:\windows\system32\msfeedssync.exe [2013-12-04 08:55]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]

@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"

[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]

2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]

@="{64174815-8D98-4CE6-8646-4C039977D808}"

[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]

2009-11-26 05:49        70656        ----a-w-        c:\program files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSShellExt64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-10 167704]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-10 392984]

"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-10 417560]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLs"=c:\windows\System32\nvinitx.dll

.

------- Zusätzlicher Suchlauf -------

.

uStart Page = about:newtab

uLocal Page = c:\windows\system32\blank.htm

uDefault_Search_URL = hxxp://www.google.com

mDefault_Search_URL = hxxp://www.google.com

mDefault_Page_URL = www.google.com

mStart Page = about:newtab

mLocal Page = c:\windows\SysWOW64\blank.htm

mSearch Page = hxxp://www.google.com

mSearch Bar = hxxp://www.google.com

uSearchAssistant = www.google.com

uSearchURL,(Default) = www.google.com/

IE: &Citavi Picker... - file://c:\programdata\Swiss Academic Software\Citavi Picker\Internet Explorer\ShowContextMenu.html

IE: An OneNote s&enden - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: Free YouTube to Mp3 Converter - c:\users\Norman\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm

IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~1\Office10\EXCEL.EXE/3000

IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

Wow6432Node-HKLM-Run-<NO NAME> - (no file)

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

Toolbar-Locked - (no file)

Toolbar-10 - (no file)

WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)

AddRemove-K_Series_ScreenSaver_EN - c:\windows\system32\K_Series_ScreenSaver_EN.scr

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\S-1-5-21-420645628-1813877703-113317616-1001\Software\SecuROM\License information*]

"datasecu"=hex:ad,83,d5,3f,8a,72,7d,7b,60,89,b5,c0,a8,df,05,70,ae,3a,e5,16,c9,

   b0,0b,82,14,95,d0,a0,ee,cb,78,4d,19,34,84,71,65,30,21,1d,56,ee,6d,a6,69,04,\

"rkeysecu"=hex:51,83,8d,fb,bf,3d,92,99,22,9a,2a,04,84,cc,cf,a3

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_14_0_0_145_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_14_0_0_145_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.14"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_14_0_0_145.ocx, 1"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]

@Denied: (A) (Everyone)

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

c:\program files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\windows\SysWOW64\IoctlSvc.exe

c:\program files (x86)\ASUS\ControlDeck\ControlDeck.exe

c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe

c:\windows\AsScrPro.exe

c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2014-08-21  11:24:05 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2014-08-21 09:24

.

Vor Suchlauf: 3.615.866.880 Bytes frei

Nach Suchlauf: 9.619.111.936 Bytes frei

.

- - End Of File - - FB1D0E53C0FEB0A3B65EFAD1D429ED15

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Hallo Schrauber,

ich habe alle Arbeiten durchgeführt. Hier die Ergebnisse:

Code:

Malwarebytes Anti-Malware

www.malwarebytes.org
 

Suchlauf Datum: 22.08.2014

Suchlauf-Zeit: 09:01:15

Logdatei: mbam.txt

Administrator: Ja
 

Version: 2.00.2.1012

Malware Datenbank: v2014.08.22.03

Rootkit Datenbank: v2014.08.21.01

Lizenz: Premium

Malware Schutz: Aktiviert

Bösartiger Webseiten Schutz: Aktiviert

Self-protection: Deaktiviert
 

Betriebssystem: Windows 7 Service Pack 1

CPU: x64

Dateisystem: NTFS

Benutzer: Norman
 

Suchlauf-Art: Bedrohungs-Suchlauf

Ergebnis: Abgeschlossen

Durchsuchte Objekte: 376933

Verstrichene Zeit: 11 Min, 7 Sek
 

Speicher: Aktiviert

Autostart: Aktiviert

Dateisystem: Aktiviert

Archive: Aktiviert

Rootkits: Deaktiviert

Heuristics: Aktiviert

PUP: Aktiviert

PUM: Aktiviert
 

Prozesse: 0

(No malicious items detected)
 

Module: 0

(No malicious items detected)
 

Registrierungsschlüssel: 0

(No malicious items detected)
 

Registrierungswerte: 0

(No malicious items detected)
 

Registrierungsdaten: 0

(No malicious items detected)
 

Ordner: 0

(No malicious items detected)
 

Dateien: 0

(No malicious items detected)
 

Physische Sektoren: 0

(No malicious items detected)
 
 

(end)

Code:

# AdwCleaner v3.308 - Bericht erstellt am 22/08/2014 um 09:20:59

# Aktualisiert 20/08/2014 von Xplode

# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)

# Benutzername : Norman - ROBERT

# Gestartet von : C:\Users\Norman\Desktop\adwcleaner_3.308.exe

# Option : Löschen
 

***** [ Dienste ] *****
 

[#] Dienst Gelöscht : globalUpdatem
 

***** [ Dateien / Ordner ] *****
 

Ordner Gelöscht : C:\ProgramData\Babylon

Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar

Ordner Gelöscht : C:\ProgramData\Partner

Ordner Gelöscht : C:\ProgramData\SweetIM

Ordner Gelöscht : C:\ProgramData\Systweak

Ordner Gelöscht : C:\ProgramData\WPM

Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PepperZip

Ordner Gelöscht : C:\Program Files (x86)\Conduit

Ordner Gelöscht : C:\Program Files (x86)\Delta

Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB

Ordner Gelöscht : C:\Program Files (x86)\globalUpdate

Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar

Ordner Gelöscht : C:\Program Files (x86)\Optimizer Pro

Ordner Gelöscht : C:\Program Files (x86)\PepperZip

Ordner Gelöscht : C:\Program Files (x86)\predm

Ordner Gelöscht : C:\Program Files (x86)\SweetIM

Ordner Gelöscht : C:\Program Files (x86)\vShare.tv plugin

Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB

Ordner Gelöscht : C:\Program Files\003

Ordner Gelöscht : C:\Program Files\Conduit

Ordner Gelöscht : C:\Users\Norman\AppData\Local\Conduit

Ordner Gelöscht : C:\Users\Norman\AppData\Local\globalUpdate

Ordner Gelöscht : C:\Users\Norman\AppData\Local\Mobogenie

Ordner Gelöscht : C:\Users\Norman\AppData\LocalLow\Conduit

Ordner Gelöscht : C:\Users\Norman\AppData\LocalLow\ConduitEngine

Ordner Gelöscht : C:\Users\Norman\AppData\LocalLow\Delta

Ordner Gelöscht : C:\Users\Norman\AppData\LocalLow\DVDVideoSoftTB

Ordner Gelöscht : C:\Users\Norman\AppData\LocalLow\SimplyTech

Ordner Gelöscht : C:\Users\Norman\AppData\LocalLow\Smartbar

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\awesomehp

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\BabSolution

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\Babylon

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\dvdvideosoftiehelpers

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\SimplyTech

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\Systweak

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\ValueApps

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\VOPackage

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AnyProtect PC Backup

Ordner Gelöscht : C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PepperZip

Ordner Gelöscht : C:\Users\Norman\Documents\Mobogenie

Ordner Gelöscht : C:\Users\Norman\Documents\Optimizer Pro

Ordner Gelöscht : C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj

Ordner Gelöscht : C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

Ordner Gelöscht : C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp

Datei Gelöscht : C:\Windows\SysWOW64\hfpapi.dll

Datei Gelöscht : C:\Windows\SysWOW64\SecureAssist.ini

Datei Gelöscht : C:\Windows\SysWOW64\SecureAssistOff.ini

Datei Gelöscht : C:\Windows\System32\roboot64.exe

Datei Gelöscht : C:\Windows\System32\SecureAssist.ini

Datei Gelöscht : C:\Windows\System32\SecureAssist64.dll

Datei Gelöscht : C:\Windows\System32\SecureAssistOff.ini

Datei Gelöscht : C:\Users\Norman\daemonprocess.txt

Datei Gelöscht : C:\Users\Norman\AppData\Local\AnyProtectScannerSetup.exe

Datei Gelöscht : C:\Users\Norman\AppData\Roaming\aps.scan.quick.results

Datei Gelöscht : C:\Users\Norman\AppData\Roaming\aps.scan.results

Datei Gelöscht : C:\Users\Norman\AppData\Roaming\aps.uninstall.scan.results

Datei Gelöscht : C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\lollipop.lnk

Datei Gelöscht : C:\Users\UpdatusUser\Desktop\NewPlayer.lnk
 

***** [ Tasks ] *****
 

Task Gelöscht : ASP

Task Gelöscht : BrowserProtect

Task Gelöscht : EPUpdater
 

***** [ Verknüpfungen ] *****
 
 

***** [ Registrierungsdatenbank ] *****
 

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{550bb1da-ebf2-411a-bf29-902df8b1066c}]

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj

Schlüssel Gelöscht : HKCU\Software\Google\Chrome\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\wajam.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\www.superfish.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\superfish.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\www.superfish.com

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BrowserConnection.dll

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\DNSBHO.dll

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\HomeTab.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\secman.DLL

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.escrtSrvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\esrv.escrtSrvc.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickCtrl.10

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.OneClickProcessLauncherMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdate.Update3WebControl.4

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoCreateAsync.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CoreMachineClass.1

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.CredentialDialogMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.OnDemandCOMClassSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.ProcessLauncher.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3COMClassService.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachine.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebMachineFallback.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\globalUpdateUpdate.Update3WebSvc.1.0

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.bandobjectattribute

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.dockingpanel

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbar

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.iesmartbarbandobject

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbardisplaystate

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\iesmartbar.smartbarmenuform

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoods_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\facemoodssrv_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\NewPlayer_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\speedupmypc_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\sweetpacksupdatemanager_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WajamInternetEnhancer_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd

Schlüssel Gelöscht : HKCU\Software\5955888bbc35e913

Schlüssel Gelöscht : HKLM\SOFTWARE\5955888bbc35e913

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{5F189DF5-2D05-472B-9091-84D9848AE48B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_klebezettel-ng_RASAPI32

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_klebezettel-ng_RASMANCS

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{37EB75F2-7392-4DBE-B5AD-147EC6D7BF5F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{3FC27B34-0C19-49DA-875E-1875DDD4A6B2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{67FCE87F-F3EF-4A3C-87C2-8BD46E68807B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{AC662AF2-4601-4A68-84DF-A3FE83F1A5F9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{AD25754E-D76C-42B3-A335-2F81478B722F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D97A8234-F2A2-4AD4-91D5-FECDB2C553AF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02A96331-0CA6-40E2-A87D-C224601985EB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{20E1481B-E285-4ABC-ADC7-AE24842B81CD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3278F5CF-48F3-4253-A6BB-004CE84AF492}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3B5702BA-7F4C-4D1A-B026-1E9A01D43978}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{577975B8-C40E-43E6-B0DE-4C6B44088B52}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5B6E533F-F78F-4525-B316-312BAF1295D1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{69F256DF-BA98-45E9-86EA-FC3CFECF9D30}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E87FC94-9866-49B9-8E93-5736D6DE3DD7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7E49F793-B3CD-4BF7-8419-B34B8BD30E61}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{834469E3-CA2B-4F21-A5CA-4F6F4DBCDE87}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8529FAA3-5BFD-43C1-AB35-B53C4B96C6E5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADBC39BE-3D20-4333-8D99-E91EB1B62474}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E06CA7F5-BA34-4FF6-8D24-B1BDC594D91F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E95EAD3F-18C6-4304-9DC6-BD6FD8E11D37}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F6421EE5-A5BE-4D31-81D5-C16B7BF48E4C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FD8E81D0-F5FE-4CB1-9AEA-1E163D2BAB78}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2152D9E-15DD-4D98-B3F1-B7388A15A3F9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0BDDE35F-64F7-49C3-99B2-404E899C49F7}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{24236608-609C-42C5-B13C-A8A3EC921850}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{28B1A706-4B97-4EB1-8B32-125042685AD9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{33575A26-D9CF-40C6-8A3E-116F17201C7F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4BDFD19F-93D7-49CE-B554-5C215FDC0136}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7307CF0F-7173-4FBF-8649-B149916DD322}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{80A5E38C-5F6B-485F-BD97-0B5BE991FAD5}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9544D727-A26F-4D57-AF38-4496088640EA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC4C30BF-7D5F-4EAB-9C2A-454178F079AA}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC6F9C26-93EA-4C6D-A4A7-C1FA333B4BBE}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E975527B-ABE7-40B3-B5C1-385016913E3B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA4B5B1-6C76-4B20-BCDB-D41A93E79053}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{12A5F606-B1EC-474C-83ED-95E99FD8058E}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{79D60450-56C5-4A8C-9321-6D5BC2A81E5A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9863E762-BACC-46E4-8CAA-2A6ADA06B65B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99C22A61-21BA-4F81-85FF-CDC9EB5DB10B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E6772887-C1E1-405E-94BB-D8760A1CF8DF}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D2152D9E-15DD-4D98-B3F1-B7388A15A3F9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D2152D9E-15DD-4D98-B3F1-B7388A15A3F9}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8F97BFF8-488B-4107-BCEE-B161AB4E4183}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{A1B48071-416D-474E-A13B-BE5456E7FC31}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D2152D9E-15DD-4D98-B3F1-B7388A15A3F9}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5645E0E7-FC12-43BF-A6E4-F9751942B298}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5E89ACE9-E16B-499A-87B4-0DBF742404C1}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C7BF8F4B-7BC7-4F42-B944-3D28A3A86D8A}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FFDF9EF3-3C3A-4F05-9A6E-5D3B778EC567}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E5FBBA35-5A9E-483C-AA21-C2AA90F2BB8C}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D52747D4-62E5-488D-8926-929B96600725}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}

Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]

Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{03EF41A4-BA24-4E49-A2C0-E1D047299287}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{130CCD34-0382-48E5-B307-0E7E72166828}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{26D25DD5-F17A-4D93-9A94-997E2124EEB4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{30279F40-D76B-443C-A34D-F43B35B35CE1}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{533403E2-6E21-4615-9E28-43F4E97E977B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{796D0AA0-DC0E-44C9-A398-C874F04D55A4}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{CE2102F0-DF63-452E-9CA7-0F75FF4DDD4B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{DADFCC6F-66D2-4E1D-A01B-7064CAD2F583}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EBE666C3-F26C-4CF6-8ABA-3D5F5D2625E1}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0194532A-A99C-4337-937E-2A452C8957BE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0BDDE35F-64F7-49C3-99B2-404E899C49F7}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0FCE4F01-64EC-42F1-83E1-1E08D38605D2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1A2A195A-A0F9-4006-AF02-3F05EEFDE792}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{24236608-609C-42C5-B13C-A8A3EC921850}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{28B1A706-4B97-4EB1-8B32-125042685AD9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2D9DB233-DC4B-4677-946C-5FA5ABCF506B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{33575A26-D9CF-40C6-8A3E-116F17201C7F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3AE76A17-C344-4A83-81CE-65EFEE41E42D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4BDFD19F-93D7-49CE-B554-5C215FDC0136}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4C0A69B0-CE97-42B7-86FC-08280C99C74D}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E9EB4D5-C929-4005-AC62-1856B1DA5A24}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{542FA950-C57A-4E17-B3E1-D935DFE15DEE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5B035F86-41B5-40F1-AAAD-3D219F30244E}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6365AC7B-9920-4D8B-AF5D-3BDFEAC340A8}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{6A934270-717F-4BC3-BA59-BC9BED47A8D2}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7307CF0F-7173-4FBF-8649-B149916DD322}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{79B13431-CCAC-4097-8889-D0289E5E924F}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{80A5E38C-5F6B-485F-BD97-0B5BE991FAD5}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8B8558F6-DC26-4F39-8417-34B8934AA459}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C8D5C57-3CAD-4CF9-BCAD-F873678DA883}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8FAF962C-3EDE-405E-B1D0-62B8235C6044}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9544D727-A26F-4D57-AF38-4496088640EA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{981334CB-7B8B-431F-B86D-67B7426B125B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E393F82-2644-4AB6-B994-1AD39D6C59EE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A3A2A5C0-1306-4D1A-A093-9CECA4230002}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{AC4C30BF-7D5F-4EAB-9C2A-454178F079AA}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BC6F9C26-93EA-4C6D-A4A7-C1FA333B4BBE}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1C2FC43-F042-4F17-AEDB-C5ABF3B42E4B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C1F5E799-B218-4C32-B189-3C389BA140BB}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C8D424EF-CB21-49A0-8659-476FBAB0F8E8}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E975527B-ABE7-40B3-B5C1-385016913E3B}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA4B5B1-6C76-4B20-BCDB-D41A93E79053}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F60C9408-3110-4C98-A139-ABE1EE1111DD}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F7EC6286-297C-4981-9DCC-FD7F57BC24C9}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}

Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2410}

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}

Schlüssel Gelöscht : HKCU\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\Delta

Schlüssel Gelöscht : HKCU\Software\GlobalUpdate

Schlüssel Gelöscht : HKCU\Software\InstalledBrowserExtensions

Schlüssel Gelöscht : HKCU\Software\lollipop

Schlüssel Gelöscht : HKCU\Software\OCS

Schlüssel Gelöscht : HKCU\Software\Optimizer Pro

Schlüssel Gelöscht : HKCU\Software\PepperZip

Schlüssel Gelöscht : HKCU\Software\simplytech

Schlüssel Gelöscht : HKCU\Software\Softonic

Schlüssel Gelöscht : HKCU\Software\systweak

Schlüssel Gelöscht : HKCU\Software\Tutorials

Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\conduitEngine

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Re_Markit

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\simplytech

Schlüssel Gelöscht : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}

Schlüssel Gelöscht : HKLM\SOFTWARE\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}

Schlüssel Gelöscht : HKLM\SOFTWARE\{5F189DF5-2D05-472B-9091-84D9848AE48B}

Schlüssel Gelöscht : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}

Schlüssel Gelöscht : HKLM\SOFTWARE\{77D46E27-0E41-4478-87A6-AABE6FBCF252}

Schlüssel Gelöscht : HKLM\SOFTWARE\Babylon

Schlüssel Gelöscht : HKLM\SOFTWARE\Conduit

Schlüssel Gelöscht : HKLM\SOFTWARE\Delta

Schlüssel Gelöscht : HKLM\SOFTWARE\dt soft\daemon tools toolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\DVDVideoSoftTB

Schlüssel Gelöscht : HKLM\SOFTWARE\GlobalUpdate

Schlüssel Gelöscht : HKLM\SOFTWARE\ICQ\ICQToolbar

Schlüssel Gelöscht : HKLM\SOFTWARE\IePlugin

Schlüssel Gelöscht : HKLM\SOFTWARE\InstalledBrowserExtensions

Schlüssel Gelöscht : HKLM\SOFTWARE\MediaWatchV1

Schlüssel Gelöscht : HKLM\SOFTWARE\SearchquMediabarTb

Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

Schlüssel Gelöscht : HKLM\SOFTWARE\Tutorials

Schlüssel Gelöscht : HKLM\SOFTWARE\Uniblue

Schlüssel Gelöscht : HKLM\SOFTWARE\Wpm

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PepperZip

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledBrowserExtensions

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\02F47BF73B948514FAACADD8CBBDF37D

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\080D9F5E1E95FEE4794CE438E635239E

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12BF94BD06C95F343A77631402B9556A

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C19AC53289098045B06B0DD1D37CBAB

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1E264E0A5959A1C46BA9175A878B12EA

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2124D8A8CF720FD44866190AF560228E

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\23D9E9D21B4E77E41B9F50DD22F24E20

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\23EEA1F105A7F45449974D9B95E7AC89

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\26982796A8AFD1246B95E00265A95BF9

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\27A325ACED8CA4743A30127638591ADB

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2E6768B6932D112438F047C54D180635

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\32DA746012E6D4F488AAD113D6FA4A44

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\350D17402BD84234EAF7D32F08172D7C

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\351716A953E21214898904032EAE2E81

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\397C771A7BCAC904697C3EC629ED33ED

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3EE8C5F419057E1478A654868CEE60B5

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3FB1AAC4382437047A03618BF727B859

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42D92D0D75AFEF74297E03876C8D9D33

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4735D908D66E1BA46B6C2D7185A12B2B

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50FFE845C555A6E4BADB7CB7A145BFEB

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\69D6A6B2ED56AF24EA6335EAD6E91CA4

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\715A3348920B6534690067594BB69F60

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\76D8378E2DDAED3428720A631F6E3BF0

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7B7B13B037A7C2A42AC3E3EAF14D7107

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7D05B2942E9CC80499F397F6114DFB35

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFA128C2B0FF414D805FC5627883401

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8591B8948E1C4A04F90505B3CDEE8555

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86EDC790504E1834DBC20C9A04328FD2

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8D841C5FEC311624CB88D49DB3884FA7

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\97C3D0F82E712E241A2F969F45E3351C

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98CC8BF5A4A6E6C4ABF7051DDAB8B058

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9A001B259DB7D694E818BE29B973992C

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9E7F556BF224D804D96A96F0F6344789

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A189D17A469616C4688D23E192996267

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AD746BF3B3B3FD8409B86604BA85982A

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BAE2EC163C6A68A48921573E0E7E199D

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BF4F885EDEE45644EB1E0C99E0162399

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C06C6662FA5B04646829E4A460857770

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE21F3FD57B244142880EF15A165A156

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CEEB3E14ABE8270419B0FD762E18F7C6

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D15DAF33C220F91468A1D7D57C31ACD7

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BA76A44C779424889063D5098ED2D6

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D6D0EB9FDBD90C04D92A7E729058F10D

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E4748F9A4181FCE46A23C13B517B9420

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ED1B5E9A3BDB51349BF96E842C062D98

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F355F0DB7A2E3A14B8E7A568FBA25937

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FECBC2BC14DA6CD459BD59A041709836

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\237AA359BFA99C94484AF769ACA080AD

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9EE58E3C298524145B73CBBED3CAC4D3

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\EB6AF8AEEB922FA4392548F13812E50B

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\5E8031606EB60A64C882918F8FF38DD4

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\A97CEC23332751B47BA4B95BAA50C9D0
 

***** [ Browser ] *****
 

-\\ Internet Explorer v11.0.9600.17239
 

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [Default]

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [Default]
 

-\\ Mozilla Firefox v
 

[ Datei : C:\Users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\prefs.js ]
 

Zeile gelöscht : user_pref("browser.search.defaultengine", "Web Search");

Zeile gelöscht : user_pref("browser.search.defaultenginename", "Web Search");

Zeile gelöscht : user_pref("browser.search.order.1", "Web Search");

Zeile gelöscht : user_pref("browser.search.selectedEngine", "Web Search");

Zeile gelöscht : user_pref("extensions.acaseyvelezaolcom61788.61788.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssfiles.com%22%5D%7D%2C%22dealply_p%22%3A%7B%22urls%22[...]

Zeile gelöscht : user_pref("extensions.aff8065806db34c09ba06d6caf0e991728453cb257fef4ed58934b08be5605617com59599.59599.internaldb.monetization_plugin_bundledUrls.value", "%7B%22dealply_s%22%3A%7B%22urls%22%3A%5B%22ssf[...]
 

-\\ Google Chrome v36.0.1985.143
 

[ Datei : C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\preferences ]
 

Gelöscht [Search Provider] : hxxp://www.awesomehp.com/web/?type=ds&ts=1394522550&from=adks&uid=ST9500325AS_6VE7HBS1XXXX6VE7HBS1&q={searchTerms}

Gelöscht [Search Provider] : hxxp://search.certified-toolbar.com?si=82443&st=bs&tid=24086&ver=6.7&ts=1.000008&tguid=0&q={searchTerms}

Gelöscht [Search Provider] : hxxp://search.certified-toolbar.com?si=82443&st=bs&tid=24086&ver=6.4&ts=1403128800000.000008&tguid=82443-24086-1403180553023-A2CB6C8DBEA53F83093D8CA04D4D2B61&q={searchTerms}

Gelöscht [Extension] : kpionmjnkbpcdpcflammlgllecmejgjj

Gelöscht [Extension] : nikpibnbobmbdbheedjfogjlikpgpnhp
 

*************************
 

AdwCleaner[R0].txt - [45359 octets] - [22/08/2014 09:17:53]

AdwCleaner[S0].txt - [42355 octets] - [22/08/2014 09:20:59]
 

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [42416 octets] ##########

Code:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Norman on 22.08.2014 at  9:27:01,29

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 

~~~ Services
 
 
 

~~~ Registry Values
 
 
 

~~~ Registry Keys
 

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-420645628-1813877703-113317616-1001\Software\sweetim

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211821134}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211821134}
 
 
 

~~~ Files
 

Successfully deleted: [File] C:\Windows\syswow64\shoB2FA.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoDFD.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoF32B.tmp
 
 
 

~~~ Folders
 

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"

Successfully deleted: [Folder] "C:\Users\Norman\AppData\Roaming\getrighttogo"

Successfully deleted: [Folder] "C:\Users\Norman\AppData\Roaming\thinstall"
 
 
 

~~~ Event Viewer Logs were cleared
 
 
 
 
 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 22.08.2014 at  9:32:50,34

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-08-2014 01

Ran by Norman (administrator) on ROBERT on 22-08-2014 09:35:42

Running from C:\Users\Norman\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\smartlogon.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\ASPG.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe

() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

(ASUS) C:\Windows\AsScrPro.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe

(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe

() C:\Windows\score.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

() C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

() C:\Program Files (x86)\mbot_de_34\mbot_de_34.exe

() C:\Users\Norman\AppData\Local\mbot_de_34\upmbot_de_34.exe

() C:\Users\Norman\AppData\Roaming\InetStat\inetstat.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [mbot_de_34] => C:\Program Files (x86)\mbot_de_34\mbot_de_34.exe [3979208 2014-08-21] ()

HKLM-x32\...\RunOnce: [upmbot_de_34.exe] => C:\Users\Norman\AppData\Local\mbot_de_34\upmbot_de_34.exe [3336696 2014-08-21] ()

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\Run: [GoogleChromeAutoLaunch_29B69EEE740A47DF7549CA7579BEBBEF] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-08-07] (Google Inc.)

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\Run: [InetStat] => C:\Users\Norman\AppData\Roaming\InetStat\inetstat.exe [706544 2014-08-22] ()

AppInit_DLLs: c:\Windows\System32\nvinitx.dll => c:\Windows\System32\nvinitx.dll [95848 2010-03-27] (NVIDIA Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk

ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.)

ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.)

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSSE

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab

URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

SearchScopes: HKLM - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

SearchScopes: HKLM-x32 - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default

FF NewTab: about:home

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Extension: Widget context - C:\Users\Norman\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-03-05]

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Optimization Client\addon
 

Chrome: 

=======

CHR HomePage: hxxp://start.androidnewtab.com/?1=1__PARAM__

CHR DefaultSearchKeyword: Web Search

CHR DefaultSearchURL: hxxp://search.androidnewtab.com/?1=1__PARAM__&q={searchTerms}

CHR Extension: (Google Docs) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-05]

CHR Extension: (Google Drive) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-05]

CHR Extension: (YouTube) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-05]

CHR Extension: (Web Search) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\canneacfbhohinchadcbleedjidnpejc [2014-08-04]

CHR Extension: (Super Tab Homepage) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\cchedanbhebbgjmnhcpmpcniijnfbdha [2014-08-04]

CHR Extension: (Google Search) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-05]

CHR Extension: (Web Search) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlceijfdfeghdhmmbhbcffanmcggoojf [2014-06-19]

CHR Extension: (No Name) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpionmjnkbpcdpcflammlgllecmejgjj [2013-06-05]

CHR Extension: (Super Tab) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmmdbehjiieocihhncnaggngbccgdcpo [2014-08-04]

CHR Extension: (No Name) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2013-06-05]

CHR Extension: (Google Wallet) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]

CHR Extension: (No Name) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ombmmloebnfnpehgjnmkcgoegfachobp [2014-03-05]

CHR Extension: (Gmail) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-05]

CHR HKLM-x32\...\Chrome\Extension: [bciilgdpfoijonnahfpinfnhpckkokna] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home9526\ch\MediaWatchV1home9526.crx [2013-06-05]

CHR HKLM-x32\...\Chrome\Extension: [ejdbaenpnnpklfljeihebmljibepmimo] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode7295\ch\MediaBuzzV1mode7295.crx [2013-06-05]

CHR HKLM-x32\...\Chrome\Extension: [ldjojcbkmecbbllcopnbbkanahggohkj] - C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6977\ch\TrustMediaViewerV1alpha6977.crx [2013-06-05]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)

R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]

S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [292736 2012-08-13] (Puran Software) [File not signed]

R2 scores; C:\Windows\score.exe [4795904 2014-07-28] () [File not signed]

S3 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [155344 2011-06-29] (Avanquest Software) [File not signed]

S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed]

R2 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [270672 2012-01-17] ()

R2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [133632 2009-11-04] (Huawei Technologies Co., Ltd.)

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-22] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-04-30] (Duplex Secure Ltd.)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 nmwcdc; system32\drivers\ccdcmbox64.sys [X]

U3 tmlwf; 

U3 tmwfp; 

S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-22 09:35 - 2014-08-22 09:35 - 00018717 _____ () C:\Users\Norman\Desktop\FRST.txt

2014-08-22 09:32 - 2014-08-22 09:32 - 00003398 _____ () C:\Windows\System32\Tasks\AmiUpdXp

2014-08-22 09:32 - 2014-08-22 09:32 - 00001540 _____ () C:\Users\Norman\Desktop\JRT.txt

2014-08-22 09:32 - 2014-08-22 09:32 - 00000362 _____ () C:\Windows\Tasks\AmiUpdXp.job

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\F12FF6D4209A4538A4D404E99346737D

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\E65A5EE0490A42C5824668D5555831B4

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Local\mbot_de_34

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Local\29436

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Program Files (x86)\mbot_de_34

2014-08-22 09:26 - 2014-08-22 09:26 - 00042941 _____ () C:\Users\Norman\Desktop\AdwCleaner[S0].txt

2014-08-22 09:26 - 2014-08-22 09:26 - 00000000 ____D () C:\Windows\ERUNT

2014-08-22 09:22 - 2014-08-22 09:22 - 00000310 _____ () C:\Windows\PFRO.log

2014-08-22 09:18 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-08-22 09:17 - 2014-08-22 09:21 - 00000000 ____D () C:\AdwCleaner

2014-08-22 09:17 - 2014-08-22 09:17 - 00001153 _____ () C:\Users\Norman\Desktop\mbam.txt

2014-08-22 09:00 - 2014-08-22 09:34 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-22 09:00 - 2014-08-22 09:00 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-22 09:00 - 2014-08-22 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-22 09:00 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-22 09:00 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-22 08:54 - 2014-08-22 08:54 - 01016261 _____ (Thisisu) C:\Users\Norman\Desktop\JRT.exe

2014-08-22 08:52 - 2014-08-22 08:53 - 01364531 _____ () C:\Users\Norman\Desktop\adwcleaner_3.308.exe

2014-08-22 08:50 - 2014-08-22 08:51 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\Users\Norman\Desktop\Combofix.txt

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\ComboFix.txt

2014-08-21 10:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-08-21 10:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-08-21 10:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-08-21 10:28 - 2014-08-21 11:24 - 00000000 ____D () C:\Qoobox

2014-08-21 10:28 - 2014-08-21 11:22 - 00000000 ____D () C:\Windows\erdnt

2014-08-21 10:27 - 2014-08-21 10:22 - 05572251 ____R (Swearware) C:\Users\Norman\Desktop\ComboFix.exe

2014-08-21 09:23 - 2014-08-21 09:23 - 00000000 ____D () C:\Program Files (x86)\CooiLSalEECoUpon

2014-08-21 09:10 - 2014-08-21 09:10 - 00001266 _____ () C:\Users\Norman\Desktop\Revo Uninstaller.lnk

2014-08-21 09:10 - 2014-08-21 09:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-08-21 09:03 - 2014-08-21 09:04 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Norman\Desktop\revosetup95.exe

2014-08-20 12:03 - 2014-08-20 12:03 - 00500552 _____ () C:\Windows\Minidump\082014-323405-01.dmp

2014-08-20 10:50 - 2014-08-20 10:50 - 00014075 _____ () C:\Users\Norman\Desktop\Gmer.log

2014-08-20 10:31 - 2014-08-20 10:31 - 00044706 _____ () C:\Users\Norman\Desktop\Addition.txt

2014-08-20 10:27 - 2014-08-22 09:35 - 00000000 ____D () C:\FRST

2014-08-20 10:21 - 2014-08-20 10:21 - 00000584 _____ () C:\Users\Norman\Desktop\defogger_disable.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000020 _____ () C:\Users\Norman\defogger_reenable

2014-08-20 10:19 - 2014-08-20 10:19 - 00380416 _____ () C:\Users\Norman\Desktop\Gmer-19357.exe

2014-08-20 10:18 - 2014-08-20 10:18 - 02101760 _____ (Farbar) C:\Users\Norman\Desktop\FRST64.exe

2014-08-20 10:16 - 2014-08-20 10:16 - 00050477 _____ () C:\Users\Norman\Desktop\Defogger.exe

2014-08-20 10:02 - 2014-08-20 10:02 - 00096430 _____ () C:\Users\Norman\Desktop\Extras.Txt

2014-08-20 09:59 - 2014-08-20 09:59 - 00142852 _____ () C:\Users\Norman\Desktop\OTL.Txt

2014-08-20 09:38 - 2014-08-20 09:38 - 00602112 _____ (OldTimer Tools) C:\Users\Norman\Desktop\otl.exe

2014-08-18 12:20 - 2014-08-21 09:23 - 00000000 ____D () C:\ProgramData\8e27c8f07b9e9861

2014-08-17 13:50 - 2014-08-17 13:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(2).exe

2014-08-14 08:32 - 2014-08-14 08:32 - 01058200 _____ (Adobe) C:\Users\Norman\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe

2014-08-13 14:02 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll

2014-08-13 14:02 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll

2014-08-13 14:02 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe

2014-08-13 14:02 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll

2014-08-13 14:02 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe

2014-08-13 14:02 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

2014-08-13 14:01 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe

2014-08-13 14:01 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe

2014-08-13 13:15 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-08-13 13:15 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls

2014-08-13 13:14 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-08-13 13:14 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-08-13 13:13 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2014-08-13 13:13 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-08-13 13:13 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-08-13 13:13 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2014-08-13 13:12 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-13 13:12 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-13 13:12 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-13 13:12 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-08-13 13:12 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-08-13 13:12 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-08-13 13:11 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-13 13:11 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-13 13:11 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-13 13:11 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-13 13:11 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 13:11 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-13 13:11 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-13 13:11 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-13 13:11 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-13 13:11 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-13 13:11 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-13 13:11 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-13 13:11 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-13 13:11 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-13 13:11 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-13 13:11 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-13 13:11 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-13 13:11 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-13 13:11 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 13:11 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-13 13:11 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-13 13:11 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-13 13:11 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-13 13:11 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-13 13:11 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-13 13:11 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 13:11 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-13 13:11 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-13 13:11 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-13 13:11 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-13 13:11 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-13 13:11 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-13 13:11 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-13 13:11 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-13 13:11 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-13 13:11 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-13 13:11 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-13 13:11 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-13 13:11 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-13 13:11 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-13 13:11 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-13 13:11 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-13 13:11 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-13 13:11 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-13 13:11 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-13 13:11 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-13 13:11 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-13 13:11 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-13 13:11 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-13 13:11 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-13 13:11 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-13 13:11 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-13 13:11 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-13 13:11 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-13 13:11 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-13 13:11 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-13 13:05 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2014-08-13 13:05 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2014-08-13 13:05 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-08-13 13:05 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll

2014-08-13 13:05 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-08-13 13:05 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-08-13 13:04 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-13 13:04 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 12:59 - 2014-08-06 13:00 - 00000000 ____D () C:\Users\Norman\Downloads\FM 2013

2014-08-06 12:59 - 2014-08-06 12:59 - 00921280 _____ () C:\Users\Norman\Downloads\FM 2013.rar

2014-08-06 12:59 - 2014-08-06 12:59 - 00183405 _____ () C:\Users\Norman\Downloads\FM2013 1.jpeg

2014-08-06 08:02 - 2014-08-22 09:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-06 08:02 - 2014-08-13 12:46 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-06 08:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-06 08:00 - 2014-08-06 08:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(1).exe

2014-08-06 08:00 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 07:54 - 2014-08-06 07:54 - 00000687 _____ () C:\awh81A.tmp

2014-08-06 07:44 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-08-06 07:44 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-08-06 07:44 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-08-06 07:44 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-08-06 07:44 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-08-06 07:44 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-08-06 07:44 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-08-06 07:44 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-08-06 07:44 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-08-06 07:44 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-08-06 07:44 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-08-06 07:44 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-08-06 07:44 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-08-06 07:44 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-08-06 07:44 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-08-06 07:44 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-08-06 07:42 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2014-08-06 07:42 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2014-08-06 07:42 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll

2014-08-06 07:42 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll

2014-08-06 07:41 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-08-06 07:41 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-08-06 07:40 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-08-06 07:40 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

2014-08-06 07:26 - 2014-08-06 07:26 - 00000687 _____ () C:\awh4AE4.tmp

2014-08-04 11:22 - 2014-08-04 11:22 - 00000687 _____ () C:\awh2D46.tmp

2014-08-04 07:32 - 2014-08-04 07:32 - 00000687 _____ () C:\awhCDC9.tmp

2014-08-04 07:09 - 2014-08-04 07:09 - 00000687 _____ () C:\awh6C78.tmp

2014-08-02 13:29 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-02 13:29 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-02 13:29 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-02 13:29 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-02 13:29 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-02 13:29 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-02 13:29 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-02 13:29 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-02 13:29 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-02 13:26 - 2014-08-02 13:26 - 00000687 _____ () C:\awh4FB5.tmp

2014-07-31 08:56 - 2014-08-20 09:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-31 08:44 - 2014-07-31 08:44 - 00000687 _____ () C:\awh5292.tmp

2014-07-30 20:23 - 2014-07-30 20:23 - 00000687 _____ () C:\awhAD4E.tmp

2014-07-30 08:25 - 2014-07-30 08:25 - 00000687 _____ () C:\awh3957.tmp

2014-07-29 09:11 - 2014-07-29 09:11 - 00000687 _____ () C:\awh4587.tmp

2014-07-29 08:15 - 2014-07-29 08:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\com

2014-07-29 08:11 - 2014-07-29 08:11 - 00001021 _____ () C:\Users\UpdatusUser\Desktop\PepperZip.lnk

2014-07-29 08:11 - 2014-07-28 20:24 - 04795904 _____ () C:\Windows\score.exe

2014-07-29 08:10 - 2014-07-29 08:10 - 00000687 _____ () C:\awh1812.tmp

2014-07-29 08:09 - 2014-07-29 08:09 - 01505024 _____ () C:\Users\Norman\Downloads\Player Setup.exe

2014-07-28 07:13 - 2014-07-28 07:13 - 00000687 _____ () C:\awh17F2.tmp

2014-07-27 20:10 - 2014-07-27 20:10 - 00000687 _____ () C:\awh63A2.tmp

2014-07-27 18:56 - 2014-07-27 18:56 - 00000687 _____ () C:\awh5C71.tmp

2014-07-27 11:26 - 2014-07-27 11:26 - 00000687 _____ () C:\awh26C1.tmp

2014-07-26 12:38 - 2014-07-26 12:38 - 00000687 _____ () C:\awh6315.tmp

2014-07-25 17:47 - 2014-07-25 17:47 - 00000687 _____ () C:\awh1525.tmp

2014-07-25 07:50 - 2014-07-25 07:50 - 00000687 _____ () C:\awh20F7.tmp

2014-07-24 18:49 - 2014-07-24 18:49 - 00000687 _____ () C:\awh7FC9.tmp

2014-07-24 08:47 - 2014-07-24 08:47 - 00000687 _____ () C:\awh3C06.tmp

2014-07-23 08:18 - 2014-07-23 08:18 - 00000687 _____ () C:\awh15E0.tmp
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-22 09:36 - 2014-08-22 09:35 - 00018717 _____ () C:\Users\Norman\Desktop\FRST.txt

2014-08-22 09:35 - 2014-08-20 10:27 - 00000000 ____D () C:\FRST

2014-08-22 09:35 - 2010-06-08 23:07 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-22 09:34 - 2014-08-22 09:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-22 09:32 - 2014-08-22 09:32 - 00003398 _____ () C:\Windows\System32\Tasks\AmiUpdXp

2014-08-22 09:32 - 2014-08-22 09:32 - 00001540 _____ () C:\Users\Norman\Desktop\JRT.txt

2014-08-22 09:32 - 2014-08-22 09:32 - 00000362 _____ () C:\Windows\Tasks\AmiUpdXp.job

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\F12FF6D4209A4538A4D404E99346737D

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\E65A5EE0490A42C5824668D5555831B4

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Local\mbot_de_34

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Local\29436

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Program Files (x86)\mbot_de_34

2014-08-22 09:32 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-22 09:32 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-22 09:26 - 2014-08-22 09:26 - 00042941 _____ () C:\Users\Norman\Desktop\AdwCleaner[S0].txt

2014-08-22 09:26 - 2014-08-22 09:26 - 00000000 ____D () C:\Windows\ERUNT

2014-08-22 09:25 - 2010-06-08 23:07 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-22 09:24 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-22 09:24 - 2009-07-14 06:51 - 00419643 _____ () C:\Windows\setupact.log

2014-08-22 09:24 - 2009-07-14 06:45 - 00435744 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-22 09:22 - 2014-08-22 09:22 - 00000310 _____ () C:\Windows\PFRO.log

2014-08-22 09:21 - 2014-08-22 09:17 - 00000000 ____D () C:\AdwCleaner

2014-08-22 09:21 - 2010-10-13 16:57 - 00000000 ____D () C:\Users\Norman

2014-08-22 09:21 - 2010-06-08 22:48 - 01711402 _____ () C:\Windows\WindowsUpdate.log

2014-08-22 09:17 - 2014-08-22 09:17 - 00001153 _____ () C:\Users\Norman\Desktop\mbam.txt

2014-08-22 09:00 - 2014-08-22 09:00 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-22 09:00 - 2014-08-22 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-22 09:00 - 2014-08-06 08:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-22 08:54 - 2014-08-22 08:54 - 01016261 _____ (Thisisu) C:\Users\Norman\Desktop\JRT.exe

2014-08-22 08:53 - 2014-08-22 08:52 - 01364531 _____ () C:\Users\Norman\Desktop\adwcleaner_3.308.exe

2014-08-22 08:51 - 2014-08-22 08:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-22 08:46 - 2012-11-17 13:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\Users\Norman\Desktop\Combofix.txt

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\ComboFix.txt

2014-08-21 11:24 - 2014-08-21 10:28 - 00000000 ____D () C:\Qoobox

2014-08-21 11:24 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-08-21 11:22 - 2014-08-21 10:28 - 00000000 ____D () C:\Windows\erdnt

2014-08-21 11:21 - 2011-07-03 19:09 - 00045056 _____ () C:\Windows\system32\acovcnt.exe

2014-08-21 11:21 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-08-21 10:41 - 2009-07-14 04:34 - 97255424 _____ () C:\Windows\system32\config\software.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 25952256 _____ () C:\Windows\system32\config\system.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 01048576 _____ () C:\Windows\system32\config\default.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 00061440 _____ () C:\Windows\system32\config\sam.bak

2014-08-21 10:24 - 2012-12-08 11:24 - 00000316 _____ () C:\Windows\Tasks\MT66 Software Update.job

2014-08-21 10:22 - 2014-08-21 10:27 - 05572251 ____R (Swearware) C:\Users\Norman\Desktop\ComboFix.exe

2014-08-21 09:23 - 2014-08-21 09:23 - 00000000 ____D () C:\Program Files (x86)\CooiLSalEECoUpon

2014-08-21 09:23 - 2014-08-18 12:20 - 00000000 ____D () C:\ProgramData\8e27c8f07b9e9861

2014-08-21 09:10 - 2014-08-21 09:10 - 00001266 _____ () C:\Users\Norman\Desktop\Revo Uninstaller.lnk

2014-08-21 09:10 - 2014-08-21 09:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-08-21 09:04 - 2014-08-21 09:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Norman\Desktop\revosetup95.exe

2014-08-20 12:03 - 2014-08-20 12:03 - 00500552 _____ () C:\Windows\Minidump\082014-323405-01.dmp

2014-08-20 12:03 - 2011-01-24 13:33 - 00000000 ____D () C:\Windows\Minidump

2014-08-20 10:50 - 2014-08-20 10:50 - 00014075 _____ () C:\Users\Norman\Desktop\Gmer.log

2014-08-20 10:37 - 2012-10-31 13:04 - 00001912 _____ () C:\Windows\epplauncher.mif

2014-08-20 10:31 - 2014-08-20 10:31 - 00044706 _____ () C:\Users\Norman\Desktop\Addition.txt

2014-08-20 10:21 - 2014-08-20 10:21 - 00000584 _____ () C:\Users\Norman\Desktop\defogger_disable.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000020 _____ () C:\Users\Norman\defogger_reenable

2014-08-20 10:19 - 2014-08-20 10:19 - 00380416 _____ () C:\Users\Norman\Desktop\Gmer-19357.exe

2014-08-20 10:18 - 2014-08-20 10:18 - 02101760 _____ (Farbar) C:\Users\Norman\Desktop\FRST64.exe

2014-08-20 10:16 - 2014-08-20 10:16 - 00050477 _____ () C:\Users\Norman\Desktop\Defogger.exe

2014-08-20 10:02 - 2014-08-20 10:02 - 00096430 _____ () C:\Users\Norman\Desktop\Extras.Txt

2014-08-20 09:59 - 2014-08-20 09:59 - 00142852 _____ () C:\Users\Norman\Desktop\OTL.Txt

2014-08-20 09:38 - 2014-08-20 09:38 - 00602112 _____ (OldTimer Tools) C:\Users\Norman\Desktop\otl.exe

2014-08-20 09:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-08-20 09:19 - 2014-07-31 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-20 09:07 - 2012-04-18 10:29 - 00000000 ____D () C:\Program Files (x86)\1&1 Surf-Stick

2014-08-20 09:07 - 2011-01-09 18:46 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\vlc

2014-08-20 09:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration

2014-08-19 08:09 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Offline Web Pages

2014-08-18 07:40 - 2009-08-04 11:51 - 01760266 _____ () C:\Windows\system32\perfh007.dat

2014-08-18 07:40 - 2009-08-04 11:51 - 00488386 _____ () C:\Windows\system32\perfc007.dat

2014-08-18 07:40 - 2009-07-14 07:13 - 00006492 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-17 13:50 - 2014-08-17 13:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(2).exe

2014-08-16 10:47 - 2014-06-19 14:23 - 00000000 ____D () C:\temp

2014-08-14 08:32 - 2014-08-14 08:32 - 01058200 _____ (Adobe) C:\Users\Norman\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe

2014-08-14 08:24 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-13 20:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-08-13 14:23 - 2011-01-20 11:10 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-08-13 14:13 - 2013-08-13 09:52 - 00000000 ____D () C:\Windows\system32\MRT

2014-08-13 14:09 - 2010-10-13 17:55 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-08-13 14:00 - 2014-05-06 23:27 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-08-13 12:46 - 2014-08-06 08:02 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-13 12:46 - 2011-01-20 11:10 - 00000000 ____D () C:\Users\Norman\AppData\Local\Microsoft Help

2014-08-07 04:06 - 2014-08-13 13:04 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-07 04:01 - 2014-08-13 13:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 13:00 - 2014-08-06 12:59 - 00000000 ____D () C:\Users\Norman\Downloads\FM 2013

2014-08-06 12:59 - 2014-08-06 12:59 - 00921280 _____ () C:\Users\Norman\Downloads\FM 2013.rar

2014-08-06 12:59 - 2014-08-06 12:59 - 00183405 _____ () C:\Users\Norman\Downloads\FM2013 1.jpeg

2014-08-06 12:30 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup

2014-08-06 12:25 - 2014-03-11 10:15 - 00000000 ____D () C:\Windows\SysWOW64\dfrg

2014-08-06 12:01 - 2010-06-08 23:31 - 00001711 _____ () C:\Windows\system32\ServiceFilter.ini

2014-08-06 12:00 - 2014-03-11 10:04 - 00000306 __RSH () C:\ProgramData\ntuser.pol

2014-08-06 08:01 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(1).exe

2014-08-06 08:00 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 07:54 - 2014-08-06 07:54 - 00000687 _____ () C:\awh81A.tmp

2014-08-06 07:50 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2014-08-06 07:26 - 2014-08-06 07:26 - 00000687 _____ () C:\awh4AE4.tmp

2014-08-05 09:20 - 2010-12-20 13:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-08-04 11:22 - 2014-08-04 11:22 - 00000687 _____ () C:\awh2D46.tmp

2014-08-04 07:32 - 2014-08-04 07:32 - 00000687 _____ () C:\awhCDC9.tmp

2014-08-04 07:09 - 2014-08-04 07:09 - 00000687 _____ () C:\awh6C78.tmp

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\SystemSockets

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\ProtectedSearch

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\Browser Updater

2014-08-02 13:26 - 2014-08-02 13:26 - 00000687 _____ () C:\awh4FB5.tmp

2014-08-01 01:41 - 2014-08-13 13:11 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-01 01:16 - 2014-08-13 13:11 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-31 08:44 - 2014-07-31 08:44 - 00000687 _____ () C:\awh5292.tmp

2014-07-30 20:23 - 2014-07-30 20:23 - 00000687 _____ () C:\awhAD4E.tmp

2014-07-30 08:25 - 2014-07-30 08:25 - 00000687 _____ () C:\awh3957.tmp

2014-07-29 09:11 - 2014-07-29 09:11 - 00000687 _____ () C:\awh4587.tmp

2014-07-29 09:07 - 2010-06-08 23:31 - 00003282 _____ () C:\Windows\system32\AutoRunFilter.ini

2014-07-29 08:15 - 2014-07-29 08:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\com

2014-07-29 08:11 - 2014-07-29 08:11 - 00001021 _____ () C:\Users\UpdatusUser\Desktop\PepperZip.lnk

2014-07-29 08:10 - 2014-07-29 08:10 - 00000687 _____ () C:\awh1812.tmp

2014-07-29 08:09 - 2014-07-29 08:09 - 01505024 _____ () C:\Users\Norman\Downloads\Player Setup.exe

2014-07-28 20:24 - 2014-07-29 08:11 - 04795904 _____ () C:\Windows\score.exe

2014-07-28 07:13 - 2014-07-28 07:13 - 00000687 _____ () C:\awh17F2.tmp

2014-07-27 20:10 - 2014-07-27 20:10 - 00000687 _____ () C:\awh63A2.tmp

2014-07-27 18:56 - 2014-07-27 18:56 - 00000687 _____ () C:\awh5C71.tmp

2014-07-27 11:26 - 2014-07-27 11:26 - 00000687 _____ () C:\awh26C1.tmp

2014-07-26 12:38 - 2014-07-26 12:38 - 00000687 _____ () C:\awh6315.tmp

2014-07-25 17:47 - 2014-07-25 17:47 - 00000687 _____ () C:\awh1525.tmp

2014-07-25 16:52 - 2014-08-13 13:11 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-25 16:02 - 2014-08-13 13:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-25 16:01 - 2014-08-13 13:11 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-25 15:51 - 2014-08-13 13:11 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-25 15:30 - 2014-08-13 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-25 15:28 - 2014-08-13 13:11 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-25 15:28 - 2014-08-13 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-25 15:25 - 2014-08-13 13:11 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-25 15:25 - 2014-08-13 13:11 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-25 15:11 - 2014-08-13 13:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-25 15:10 - 2014-08-13 13:11 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-25 15:04 - 2014-08-13 13:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-25 15:03 - 2014-08-13 13:11 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-25 15:00 - 2014-08-13 13:11 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-25 15:00 - 2014-08-13 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-25 14:59 - 2014-08-13 13:11 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-25 14:47 - 2014-08-13 13:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-25 14:40 - 2014-08-13 13:11 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-25 14:34 - 2014-08-13 13:11 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-25 14:34 - 2014-08-13 13:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-25 14:33 - 2014-08-13 13:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-25 14:30 - 2014-08-13 13:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-25 14:28 - 2014-08-13 13:11 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-25 14:28 - 2014-08-13 13:11 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-25 14:21 - 2014-08-13 13:11 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-25 14:19 - 2014-08-13 13:11 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-25 14:18 - 2014-08-13 13:11 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-25 14:17 - 2014-08-13 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-25 14:17 - 2014-08-13 13:11 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-25 14:12 - 2014-08-13 13:11 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-25 14:10 - 2014-08-13 13:11 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-25 14:10 - 2014-08-13 13:11 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-25 14:08 - 2014-08-13 13:11 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-25 14:06 - 2014-08-13 13:11 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-25 13:52 - 2014-08-13 13:11 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-25 13:47 - 2014-08-13 13:11 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-25 13:43 - 2014-08-13 13:11 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-25 13:42 - 2014-08-13 13:11 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-25 13:39 - 2014-08-13 13:11 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-25 13:39 - 2014-08-13 13:11 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-25 13:36 - 2014-08-13 13:11 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-25 13:34 - 2014-08-13 13:11 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-25 13:29 - 2014-08-13 13:11 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-25 13:23 - 2014-08-13 13:11 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-25 13:13 - 2014-08-13 13:11 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-25 13:07 - 2014-08-13 13:11 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-25 13:07 - 2014-08-13 13:11 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-25 13:03 - 2014-08-13 13:11 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-25 12:52 - 2014-08-13 13:11 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-25 12:26 - 2014-08-13 13:11 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-25 12:17 - 2014-08-13 13:11 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-25 12:09 - 2014-08-13 13:11 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-25 12:05 - 2014-08-13 13:11 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-25 12:00 - 2014-08-13 13:11 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-25 07:50 - 2014-07-25 07:50 - 00000687 _____ () C:\awh20F7.tmp

2014-07-24 18:49 - 2014-07-24 18:49 - 00000687 _____ () C:\awh7FC9.tmp

2014-07-24 08:47 - 2014-07-24 08:47 - 00000687 _____ () C:\awh3C06.tmp

2014-07-24 08:42 - 2013-03-15 08:48 - 00000000 ____D () C:\Program Files\Microsoft Silverlight

2014-07-24 08:42 - 2010-10-13 17:02 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight

2014-07-24 08:29 - 2013-03-16 16:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

2014-07-23 15:25 - 2014-05-30 09:59 - 00000000 ____D () C:\Windows\rescache

2014-07-23 08:18 - 2014-07-23 08:18 - 00000687 _____ () C:\awh15E0.tmp
 

Some content of TEMP:

====================

C:\Users\Norman\AppData\Local\Temp\Quarantine.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-07-23 15:18
 

==================== End Of Log ============================

--- --- ---

--- --- ---

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Hallo Schrauber,

anbei die Ergebnisse der Arbeiten. Chrome lässt sich öffnen. Internet geht also.

Code:

ESETSmartInstaller@High as downloader log:

all ok

# product=EOS

# version=8

# OnlineScannerApp.exe=1.0.0.1

# OnlineScanner.ocx=1.0.0.7623

# api_version=3.0.2

# EOSSerial=ae1d292f3dfd574e87df0753b1fd3aca

# engine=19793

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2014-08-23 10:54:40

# local_time=2014-08-23 12:54:40 (+0100, Mitteleuropäische Sommerzeit)

# country="Germany"

# lang=1031

# osver=6.1.7601 NT Service Pack 1

# compatibility_mode_1=''

# compatibility_mode=5893 16776573 100 94 101460 160421130 0 0

# scanned=334612

# found=58

# cleaned=52

# scan_time=11810

sh=4CDA0AD56BE52C0AE43D740DA43FAC7BF0A1B8A7 ft=1 fh=c71c001166655e77 vn="Variante von Win32/AdWare.MultiPlug.AG Anwendung" ac=I fn="C:\Users\All Users\cosstminn\OYLzBg7.exe"

sh=FF2F9741F38C6294FE7EB6C4B23AF5DBC5F46BBC ft=1 fh=d421524a365e435c vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\AppPatch\spbin\cltmng.exe"

sh=9BA475AA65F25682779E0066864C49C37BC178FA ft=1 fh=ccaa2464deb92942 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\AppPatch\spbin\SPTool64.exe"

sh=0A895D6ECBE189AE338869C76CA5FC59D6C9323F ft=1 fh=66a85591cccc8785 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\AppPatch\spbin\SPVC32.dll"

sh=19E4A14C324EC5706BDD7C0BA3D1A8C9503AEEF4 ft=1 fh=b222439f7f1d3364 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\AppPatch\spbin\SPVC64.dll"

sh=7BF198E10E88B4EE54D25DD8EA1C82BCDDEEF927 ft=1 fh=b12b371d4b4f5f42 vn="Variante von Win32/RiskWare.NetFilter.B Anwendung" ac=I fn="C:\Windows\SysWOW64\hfnapi.dll"

sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"

sh=664270A860DDB3D6F23F617D0615070330A71A30 ft=1 fh=192f7aaecaa32147 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"

sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\DVDVideoSoftTB\tbDVDV.dll.vir"

sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Norman\AppData\LocalLow\ConduitEngine\ConduitEngine.dll.vir"

sh=57CD8DEAF43DF3A2F4703E5219A69935B119D0DB ft=1 fh=311781f1ea21501f vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Norman\AppData\LocalLow\DVDVideoSoftTB\tbDVDV.dll.vir"

sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Norman\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll.vir"

sh=B9ADAE26DB5DC026EEDBEDEE486EE374210395EB ft=1 fh=c2b4ea1ffd4d1511 vn="Win32/VOPackage.S evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Users\Norman\AppData\Roaming\VOPackage\Uninstall.exe.vir"

sh=430C5C8EA0AA40ECD96968812C6664A4312CFAF5 ft=1 fh=6e5ef8d9fe0720b4 vn="Variante von Win32/RiskWare.NetFilter.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\AdwCleaner\Quarantine\C\Windows\SysWOW64\hfpapi.dll.vir"

sh=A6A72999AC2306CF58ECDF7A69C270B8CAE1F5A9 ft=1 fh=c71c0011202c046b vn="Variante von Win32/AdWare.MultiPlug.BN Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\cosstminn\aNRyUr.dll"

sh=3D18FAADFB6E63B1C4F010BF0B76744A50BFDE65 ft=1 fh=734f1bc344a1a9e8 vn="Variante von Win64/Adware.MultiPlug.D Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\cosstminn\aNRyUr.x64.dll"

sh=2D17D10760F697BCD872653FEC45DF465B50DCF2 ft=1 fh=04754d41ddfc3cea vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\mbot_de_34\mbot_de_34.exe"

sh=1231AFEC38805849FBDBF7D2B4B34DEEB387B821 ft=1 fh=2ceb3ce0de00c6dd vn="Variante von Win32/AdWare.EoRezo.AU Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\mbot_de_34\mybestofferstoday_widget.exe"

sh=74E0177FF3F81C427969AD57186E709F86B40D87 ft=1 fh=cdf4822aa79706e4 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe"

sh=A8F3D7C5BBC8347AA7D5B1AD10CBCEB6104C23D1 ft=1 fh=295e6caf528a890e vn="möglicherweise Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\Main\bin\SPTool.dll"

sh=3240E81C8D289E0153E62892A1A780C78E1D795E ft=1 fh=60c431af054e4a68 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\Main\bin\uninstall.exe"

sh=FF2F9741F38C6294FE7EB6C4B23AF5DBC5F46BBC ft=1 fh=d421524a365e435c vn="Variante von Win32/Conduit.SearchProtect.I evtl. unerwünschte Anwendung (gelöscht (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\cltmng.exe"

sh=9BA475AA65F25682779E0066864C49C37BC178FA ft=1 fh=ccaa2464deb92942 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPTool64.exe"

sh=0A895D6ECBE189AE338869C76CA5FC59D6C9323F ft=1 fh=66a85591cccc8785 vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC32.dll"

sh=19E4A14C324EC5706BDD7C0BA3D1A8C9503AEEF4 ft=1 fh=b222439f7f1d3364 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64.dll"

sh=B5C2DB37AB6979DB8D1FC7C935075E8AC8ACE9A3 ft=1 fh=f24232d3d25a19ff vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\SearchProtect\UI\bin\cltmngui.exe"

sh=18BB72942239E9453B1F1DD614626D875BCF3C04 ft=1 fh=c71c0011eb43edb3 vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung (gelöscht (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\Supporter\Supporter.dll"

sh=6007434E9D98E0FFA81201819382E47D42D5DD1B ft=1 fh=c4e548e56c5d9a58 vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung (gelöscht (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\Supporter\SupporterSvc.dll"

sh=135E3569852A727DC9BF87488605DB9ADBDE0A03 ft=1 fh=c71c0011f39dd73d vn="Variante von Win64/SProtector.A evtl. unerwünschte Anwendung (gelöscht (nach dem nächsten Neustart) - in Quarantäne kopiert)" ac=C fn="C:\Program Files (x86)\Supporter\Supporter_x64.dll"

sh=4CDA0AD56BE52C0AE43D740DA43FAC7BF0A1B8A7 ft=1 fh=c71c001166655e77 vn="Variante von Win32/AdWare.MultiPlug.AG Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\ProgramData\cosstminn\OYLzBg7.exe"

sh=1B935276B14854E7E698D195CE39DCEF2E7F69A0 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\ekdgbodaoampohmhmecigaomnjppbplb\13785.340.6094_0\extensionData\plugins\91.js.vir"

sh=58194D24471CA7888FCD01035E5845794FE6AC97 ft=1 fh=c71c00116b12b075 vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Qoobox\Quarantine\C\Users\Norman\AppData\Local\Temp\__tmp_0604b699.vir"

sh=7A5B168BB2B8C06B2A9134B656BBF195830D21C2 ft=1 fh=55d4f387d8566cf4 vn="Variante von Win32/PriceGong.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\AppData\LocalLow\DVDVideoSoftTB\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.1.1\bin\PriceGongIE.dll"

sh=D75F1677490CBAA8321818621868D64C5DF84CAB ft=1 fh=c71c001129078e71 vn="Variante von Win32/Amonetize.BE evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\29436\a22952.exe"

sh=D6D99E7CDFC04B72FB3CC1004DC5B67221AFC3F4 ft=1 fh=d951409f51703342 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\mbot_de_34\upmbot_de_34.exe"

sh=08AFC3F18F4156F15F5380628C9C916188292088 ft=1 fh=ceff2f44e707aaab vn="Win32/AdWare.EoRezo.AW Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\mbot_de_34\Download\majmbot_gentlemg.exe"

sh=7D835A29714923E4FA0828D9533FDB58529461D5 ft=1 fh=588f501a5d66e9e7 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9T3ZMMF2\spstub[1].exe"

sh=119E149747A552877117A6D91EFD3BE4B26418AE ft=1 fh=d60c8402287380a1 vn="Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AKB80TZ2\sp-downloader[1].exe"

sh=AD3249181345541EE9239CC9F656D6E2674E78AC ft=1 fh=84ef7f780c418ce1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AKB80TZ2\SPSetup[1].exe"

sh=28491F4EF4A236129522D2DCD582D9B1ECC0211C ft=1 fh=c71c00118fafe4a2 vn="Variante von Win32/SProtector.D evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\18be6784_.exe"

sh=D53EEB214E6D2585A104AA4B72CCF7785BEFEA86 ft=1 fh=b74a1aef38916952 vn="Variante von Win32/AdWare.MultiPlug.BU Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\294823_.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\nsnACF6.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\nsnD7A1.exe"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\nsnDC34.exe"

sh=AD3249181345541EE9239CC9F656D6E2674E78AC ft=1 fh=84ef7f780c418ce1 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\nsx6E20.tmp"

sh=FA61F495558B294EB796B8D6C44F75631FA57E7D ft=1 fh=b733a64984fbe467 vn="Win32/Conduit.SearchProtect.R evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\nsxA93D.exe"

sh=6A620487A3C1A1690FC66F92BC01035E35656A1E ft=1 fh=85cd99bda5e2e404 vn="Win32/AdWare.EoRezo.AW Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\is-7N42R.tmp\package_costmin_installer_multilang.exe"

sh=D0CE12FEE273B009B0CD877528931AC5C0CFEBD7 ft=1 fh=938299dfc3edeb90 vn="Win32/AdWare.EoRezo.AW Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\is-7N42R.tmp\package_secprotwhite_installer_multilang.exe"

sh=788AD4AEEC33772C786C7C45F261D5995CBDCFE9 ft=1 fh=119800afb59d04f7 vn="Win32/AdWare.EoRezo.AW Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Local\Temp\is-BPKRD.tmp\gentlemjmbot_img.exe"

sh=502D74A96065A471FAA12E30E85E8DCBAFA3A447 ft=1 fh=aa0497a2b71c6df7 vn="Variante von Win32/RiskWare.Astori.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Roaming\InetStat\inetstat.exe"

sh=1B935276B14854E7E698D195CE39DCEF2E7F69A0 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Roaming\Opera Software\Opera Stable\Extensions\dnaojefanpmakfgcaliphepgoiiafmpf\1.26.20_0\extensionData\plugins\91.js"

sh=3642D1CD926F8106F134B15EF8229ECC1CFF1E36 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\AppData\Roaming\Opera Software\Opera Stable\Extensions\pdjjjmnacfjnmgckbhldbekckfldeolk\1.26.34_0\extensionData\plugins\91.js"

sh=1D814EA403A946B40CC0A6A261B2387880D6B547 ft=1 fh=ff0bc5a908f5ad94 vn="Variante von Win32/Toolbar.Conduit.B evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\Documents\Downloads\Integrated_BrotherSoft_TB.exe"

sh=1163FE41FB337B75058F0445B67EF5B5D003A91D ft=1 fh=d3015bd6e6977bc3 vn="Variante von Win32/SoftPulse.H evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\Downloads\Player Setup.exe"

sh=2C963B150FD292E88DCE4A002E2D2DC05652D7E3 ft=1 fh=6e9637a1767a7939 vn="Variante von Win32/SoftPulse.E evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Norman\Downloads\Setup(1).exe"

sh=7D6E1A8BEDCE8A1C9289391431A19ADF2F8CDF65 ft=1 fh=70a5be052544decd vn="Variante von Win32/Amonetize.BM evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Users\Public\F12FF6D4209A4538A4D404E99346737D\setup.exe"

sh=CCAFEDA054837453469D588C04CEE33530777F2C ft=1 fh=2a4276702961c0a4 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung (gelöscht - in Quarantäne kopiert)" ac=C fn="C:\Windows\AppPatch\AppPatch64\SPVCLdr64.dll"

sh=7BF198E10E88B4EE54D25DD8EA1C82BCDDEEF927 ft=1 fh=b12b371d4b4f5f42 vn="Variante von Win32/RiskWare.NetFilter.B Anwendung (Gesäubert durch Löschen - in Quarantäne kopiert)" ac=C fn="C:\Windows\System32\hfnapi.dll"

Code:

 Results of screen317's Security Check version 0.99.87  

 Windows 7 Service Pack 1 x64 (UAC is enabled)  

 Internet Explorer 11  
 ``````````````Antivirus/Firewall Check:`````````````` 

 WMI entry may not exist for antivirus; attempting automatic update. 
 `````````Anti-malware/Other Utilities Check:````````` 

 Java 7 Update 9  

 Java version out of Date! 

 Adobe Flash Player 14.0.0.145  

 Adobe Reader 9 Adobe Reader out of Date! 

 Google Chrome 36.0.1985.125  

 Google Chrome 36.0.1985.143  
 ````````Process Check: objlist.exe by Laurent````````  

 Malwarebytes Anti-Malware mbamscheduler.exe   
 `````````````````System Health check````````````````` 

 Total Fragmentation on Drive C:  
 ````````````````````End of Log``````````````````````

FRST Logfile:

FRST Logfile:

Code:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-08-2014

Ran by Norman (administrator) on ROBERT on 24-08-2014 10:17:14

Running from C:\Users\Norman\Desktop

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)

Internet Explorer Version 11

Boot Mode: Normal
 
 
 

==================== Processes (Whitelisted) =================
 

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(ASUS) C:\Program Files (x86)\ASUS\ASUS CopyProtect\ASPG.exe

(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe

(ATK) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe

() C:\Program Files (x86)\ASUS\ASUS Live Update\ALU.exe

() C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

(asus) C:\Program Files (x86)\ASUS\ControlDeck\ControlDeck.exe

(ATK) C:\Program Files\P4G\BatteryLife.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe

(ASUS) C:\Windows\AsScrPro.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7Debug\mdm.exe

(Prolific Technology Inc.) C:\Windows\SysWOW64\IoctlSvc.exe

() C:\Windows\score.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

() C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(ASUSTeK) C:\Windows\SysWOW64\ACEngSvr.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
 
 

==================== Registry (Whitelisted) ==================
 

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 

HKLM-x32\...\Run: [] => [X]

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-420645628-1813877703-113317616-1001\...\Run: [GoogleChromeAutoLaunch_29B69EEE740A47DF7549CA7579BEBBEF] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-08-07] (Google Inc.)

AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found

AppInit_DLLs:  c:\Windows\System32\nvinitx.dll => c:\Windows\System32\nvinitx.dll [95848 2010-03-27] (NVIDIA Corporation)

AppInit_DLLs:  C:\PROGRA~2\SUPPOR~1\SUPPOR~2.DLL => C:\PROGRA~2\SUPPOR~1\SUPPOR~2.DLL File Not Found

AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => "c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll" File Not Found

AppInit_DLLs-x32:  c:\progra~2\suppor~1\suppor~1.dll => "c:\progra~2\suppor~1\suppor~1.dll" File Not Found

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnk

ShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.)

ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\service\AsusWSShellExt64.dll (eCareme Technologies, Inc.)

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
 

==================== Internet (Whitelisted) ====================
 

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.trovi.com/?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=MB9C1525F-C014-482C-A126-A8B46F86BD95&SearchSource=55&CUI=&UM=2&UP=SP01AC27F3-44D7-464B-8637-A910656DD34E&SSPV=

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.msn.com/?pc=MSSE

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:newtab

URLSearchHook: HKLM-x32 - Default Value = {855F3B16-6D32-4fe6-8A56-BBB695989046}

SearchScopes: HKLM - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUT

SearchScopes: HKLM-x32 - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = 

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 

SearchScopes: HKCU - {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = hxxp://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSE

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)

BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: SwissAcademic.Citavi.Picker.IEPicker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)

BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File

DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\OLE DB\msdaipp.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
 

FireFox:

========

FF ProfilePath: C:\Users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default

FF NewTab: about:home

FF Homepage: about:home

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()

FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin-x32: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File

FF Plugin-x32: @tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf -> C:\Program Files\Tracker Software\PDF Viewer\Win32\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)

FF Extension: Widget context - C:\Users\Norman\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\{140A2D0E-85CC-4ed3-9BA5-8FA35DA7FABA}.xpi [2014-03-05]

FF Extension: No Name - C:\Users\Norman\AppData\Roaming\Mozilla\Firefox\Profiles\riiyz2xl.default\Extensions\staged [2014-08-23]

FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files (x86)\Vodafone\Vodafone Mobile Connect\Optimization Client\addon
 

Chrome: 

=======

CHR HomePage: hxxp://start.androidnewtab.com/?1=1__PARAM__

CHR StartupUrls: "hxxp://www.trovi.com/?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=MB9C1525F-C014-482C-A126-A8B46F86BD95&SearchSource=55&CUI=&UM=2&UP=SP01AC27F3-44D7-464B-8637-A910656DD34E&SSPV="

CHR DefaultSearchKeyword: trovi.search

CHR DefaultSearchProvider: Trovi search

CHR DefaultSearchURL: hxxp://www.trovi.com/Results.aspx?gd=&ctid=CT3325582&octid=EB_ORIGINAL_CTID&ISID=MB9C1525F-C014-482C-A126-A8B46F86BD95&SearchSource=58&CUI=&UM=2&UP=SP01AC27F3-44D7-464B-8637-A910656DD34E&q={searchTerms}&SSPV=

CHR DefaultSuggestURL: hxxp://suggest.seccint.com/CSuggestJson.ashx?prefix={searchTerms}

CHR Extension: (Web Search) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\canneacfbhohinchadcbleedjidnpejc [2014-08-04]

CHR Extension: (Super Tab Homepage) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\cchedanbhebbgjmnhcpmpcniijnfbdha [2014-08-04]

CHR Extension: (Super Tab) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmmdbehjiieocihhncnaggngbccgdcpo [2014-08-04]

CHR Extension: (cosstminn) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjlkggcpobdmjbfoamcgdbbgiefbnifg [2014-08-23]

CHR Extension: (Extutil) - C:\Users\Norman\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-08-23]

CHR Extension: (Managera) - C:\Users\Norman\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-08-23]

CHR Extension: (cosstminn) - C:\Users\Norman\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjlkggcpobdmjbfoamcgdbbgiefbnifg\2.0 [2014-08-23]

CHR HKLM-x32\...\Chrome\Extension: [bciilgdpfoijonnahfpinfnhpckkokna] - C:\Program Files (x86)\MediaWatchV1\MediaWatchV1home9526\ch\MediaWatchV1home9526.crx []

CHR HKLM-x32\...\Chrome\Extension: [ejdbaenpnnpklfljeihebmljibepmimo] - C:\Program Files (x86)\MediaBuzzV1\MediaBuzzV1mode7295\ch\MediaBuzzV1mode7295.crx []

CHR HKLM-x32\...\Chrome\Extension: [ldjojcbkmecbbllcopnbbkanahggohkj] - C:\Program Files (x86)\TrustMediaViewerV1\TrustMediaViewerV1alpha6977\ch\TrustMediaViewerV1alpha6977.crx []

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
 

==================== Services (Whitelisted) =================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]

R2 LMS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [262144 2009-10-01] (Intel Corporation) [File not signed]

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S3 NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [275752 2008-01-22] (Nero AG)

R2 PLFlash DeviceIoControl Service; C:\Windows\SysWOW64\IoctlSvc.exe [81920 2006-12-19] (Prolific Technology Inc.) [File not signed]

S4 PuranDefrag; C:\Windows\system32\PuranDefragS.exe [292736 2012-08-13] (Puran Software) [File not signed]

R2 scores; C:\Windows\score.exe [4795904 2014-07-28] () [File not signed]

S3 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [155344 2011-06-29] (Avanquest Software) [File not signed]

S3 Sony PC Companion; C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe [155320 2012-01-18] (Avanquest Software) [File not signed]

R2 UI Assistant Service; C:\Program Files (x86)\1&1 Surf-Stick\AssistantServices.exe [270672 2012-01-17] ()

R2 UNS; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2314240 2009-10-01] (Intel Corporation) [File not signed]

S2 be0fb33b; "C:\Windows\system32\rundll32.exe" "c:\progra~2\suppor~1\SupporterSvc.dll",service

S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X]

S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]

S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]
 

==================== Drivers (Whitelisted) ====================
 

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)

S3 ewusbnet; C:\Windows\System32\DRIVERS\ewusbnet.sys [133632 2009-11-04] (Huawei Technologies Co., Ltd.)

R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-24] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()

S4 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-04-30] (Duplex Secure Ltd.)

R2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 nmwcdc; system32\drivers\ccdcmbox64.sys [X]

S3 SPPD; \??\C:\Windows\system32\drivers\SPPD.sys [X]

U3 tmlwf; No ImagePath

U3 tmwfp; No ImagePath

S3 upperdev; system32\DRIVERS\usbser_lowerfltx64.sys [X]
 

==================== NetSvcs (Whitelisted) ===================
 

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 

==================== One Month Created Files and Folders ========
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-24 10:16 - 2014-08-24 10:16 - 00000000 ____D () C:\Users\Norman\Desktop\FRST-OlderVersion

2014-08-23 21:29 - 2014-08-23 21:29 - 00000897 _____ () C:\Users\Norman\Desktop\checkup.txt

2014-08-23 13:01 - 2014-08-23 13:02 - 00854417 _____ () C:\Users\Norman\Desktop\SecurityCheck.exe

2014-08-23 09:27 - 2014-08-23 09:27 - 02347384 _____ (ESET) C:\Users\Norman\Desktop\esetsmartinstaller_deu.exe

2014-08-23 08:41 - 2014-08-23 21:04 - 00000000 ____D () C:\Program Files (x86)\Supporter

2014-08-23 08:41 - 2014-08-23 12:51 - 00000000 ____D () C:\ProgramData\cosstminn

2014-08-23 08:41 - 2014-08-23 12:50 - 00000000 ____D () C:\Program Files (x86)\cosstminn

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\SearchProtect

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Packages

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Program Files (x86)\SearchProtect

2014-08-22 09:35 - 2014-08-24 10:17 - 00019700 _____ () C:\Users\Norman\Desktop\FRST.txt

2014-08-22 09:32 - 2014-08-23 12:54 - 00000000 ____D () C:\Users\Public\F12FF6D4209A4538A4D404E99346737D

2014-08-22 09:32 - 2014-08-23 12:51 - 00000000 ____D () C:\Users\Norman\AppData\Local\mbot_de_34

2014-08-22 09:32 - 2014-08-23 12:51 - 00000000 ____D () C:\Users\Norman\AppData\Local\29436

2014-08-22 09:32 - 2014-08-23 12:50 - 00000000 ____D () C:\Program Files (x86)\mbot_de_34

2014-08-22 09:32 - 2014-08-22 09:32 - 00001540 _____ () C:\Users\Norman\Desktop\JRT.txt

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\E65A5EE0490A42C5824668D5555831B4

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:26 - 2014-08-22 09:26 - 00042941 _____ () C:\Users\Norman\Desktop\AdwCleaner[S0].txt

2014-08-22 09:26 - 2014-08-22 09:26 - 00000000 ____D () C:\Windows\ERUNT

2014-08-22 09:22 - 2014-08-23 21:04 - 00001396 _____ () C:\Windows\PFRO.log

2014-08-22 09:18 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll

2014-08-22 09:17 - 2014-08-22 09:21 - 00000000 ____D () C:\AdwCleaner

2014-08-22 09:17 - 2014-08-22 09:17 - 00001153 _____ () C:\Users\Norman\Desktop\mbam.txt

2014-08-22 09:00 - 2014-08-24 10:14 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-22 09:00 - 2014-08-22 09:00 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-22 09:00 - 2014-08-22 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-22 09:00 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-08-22 09:00 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-08-22 08:54 - 2014-08-22 08:54 - 01016261 _____ (Thisisu) C:\Users\Norman\Desktop\JRT.exe

2014-08-22 08:52 - 2014-08-22 08:53 - 01364531 _____ () C:\Users\Norman\Desktop\adwcleaner_3.308.exe

2014-08-22 08:50 - 2014-08-22 08:51 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\Users\Norman\Desktop\Combofix.txt

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\ComboFix.txt

2014-08-21 10:29 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-08-21 10:29 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-08-21 10:29 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe

2014-08-21 10:29 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe

2014-08-21 10:28 - 2014-08-21 11:24 - 00000000 ____D () C:\Qoobox

2014-08-21 10:28 - 2014-08-21 11:22 - 00000000 ____D () C:\Windows\erdnt

2014-08-21 10:27 - 2014-08-21 10:22 - 05572251 ____R (Swearware) C:\Users\Norman\Desktop\ComboFix.exe

2014-08-21 09:23 - 2014-08-21 09:23 - 00000000 ____D () C:\Program Files (x86)\CooiLSalEECoUpon

2014-08-21 09:10 - 2014-08-21 09:10 - 00001266 _____ () C:\Users\Norman\Desktop\Revo Uninstaller.lnk

2014-08-21 09:10 - 2014-08-21 09:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-08-21 09:03 - 2014-08-21 09:04 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Norman\Desktop\revosetup95.exe

2014-08-20 12:03 - 2014-08-20 12:03 - 00500552 _____ () C:\Windows\Minidump\082014-323405-01.dmp

2014-08-20 10:50 - 2014-08-20 10:50 - 00014075 _____ () C:\Users\Norman\Desktop\Gmer.log

2014-08-20 10:31 - 2014-08-20 10:31 - 00044706 _____ () C:\Users\Norman\Desktop\Addition.txt

2014-08-20 10:27 - 2014-08-24 10:17 - 00000000 ____D () C:\FRST

2014-08-20 10:21 - 2014-08-20 10:21 - 00000584 _____ () C:\Users\Norman\Desktop\defogger_disable.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000020 _____ () C:\Users\Norman\defogger_reenable

2014-08-20 10:19 - 2014-08-20 10:19 - 00380416 _____ () C:\Users\Norman\Desktop\Gmer-19357.exe

2014-08-20 10:18 - 2014-08-24 10:16 - 02103296 _____ (Farbar) C:\Users\Norman\Desktop\FRST64.exe

2014-08-20 10:16 - 2014-08-20 10:16 - 00050477 _____ () C:\Users\Norman\Desktop\Defogger.exe

2014-08-20 10:02 - 2014-08-20 10:02 - 00096430 _____ () C:\Users\Norman\Desktop\Extras.Txt

2014-08-20 09:59 - 2014-08-20 09:59 - 00142852 _____ () C:\Users\Norman\Desktop\OTL.Txt

2014-08-20 09:38 - 2014-08-20 09:38 - 00602112 _____ (OldTimer Tools) C:\Users\Norman\Desktop\otl.exe

2014-08-18 12:20 - 2014-08-23 08:41 - 00000000 ____D () C:\ProgramData\8e27c8f07b9e9861

2014-08-17 13:50 - 2014-08-17 13:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(2).exe

2014-08-14 08:32 - 2014-08-14 08:32 - 01058200 _____ (Adobe) C:\Users\Norman\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe

2014-08-13 14:02 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll

2014-08-13 14:02 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll

2014-08-13 14:02 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe

2014-08-13 14:02 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll

2014-08-13 14:02 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe

2014-08-13 14:02 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll

2014-08-13 14:01 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe

2014-08-13 14:01 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe

2014-08-13 13:15 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls

2014-08-13 13:15 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls

2014-08-13 13:14 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll

2014-08-13 13:14 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL

2014-08-13 13:14 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL

2014-08-13 13:14 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL

2014-08-13 13:13 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll

2014-08-13 13:13 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe

2014-08-13 13:13 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll

2014-08-13 13:13 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2014-08-13 13:13 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll

2014-08-13 13:12 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll

2014-08-13 13:12 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll

2014-08-13 13:12 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-08-13 13:12 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-08-13 13:12 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-08-13 13:12 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys

2014-08-13 13:11 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-13 13:11 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-08-13 13:11 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-08-13 13:11 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-08-13 13:11 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-08-13 13:11 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-08-13 13:11 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-08-13 13:11 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-08-13 13:11 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-08-13 13:11 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-08-13 13:11 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-08-13 13:11 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-08-13 13:11 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-08-13 13:11 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-08-13 13:11 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-08-13 13:11 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-08-13 13:11 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-08-13 13:11 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-08-13 13:11 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-08-13 13:11 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-08-13 13:11 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-08-13 13:11 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-08-13 13:11 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-08-13 13:11 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-08-13 13:11 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-08-13 13:11 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-08-13 13:11 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-08-13 13:11 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-08-13 13:11 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-08-13 13:11 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-08-13 13:11 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-08-13 13:11 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-08-13 13:11 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-08-13 13:11 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-08-13 13:11 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-08-13 13:11 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-08-13 13:11 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-08-13 13:11 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-08-13 13:11 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-08-13 13:11 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-08-13 13:11 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-08-13 13:11 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-08-13 13:11 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-08-13 13:11 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-08-13 13:11 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-08-13 13:11 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-08-13 13:11 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-08-13 13:11 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-08-13 13:11 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-08-13 13:11 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-08-13 13:11 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-08-13 13:11 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-08-13 13:11 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-08-13 13:11 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-08-13 13:11 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-08-13 13:11 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-08-13 13:05 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll

2014-08-13 13:05 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll

2014-08-13 13:05 - 2014-05-08 11:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll

2014-08-13 13:05 - 2014-05-08 11:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll

2014-08-13 13:05 - 2014-01-09 04:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll

2014-08-13 13:05 - 2014-01-04 00:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll

2014-08-13 13:04 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-13 13:04 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 12:59 - 2014-08-06 13:00 - 00000000 ____D () C:\Users\Norman\Downloads\FM 2013

2014-08-06 12:59 - 2014-08-06 12:59 - 00921280 _____ () C:\Users\Norman\Downloads\FM 2013.rar

2014-08-06 12:59 - 2014-08-06 12:59 - 00183405 _____ () C:\Users\Norman\Downloads\FM2013 1.jpeg

2014-08-06 08:02 - 2014-08-22 09:00 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-06 08:02 - 2014-08-13 12:46 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-06 08:02 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-08-06 08:00 - 2014-08-06 08:01 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(1).exe

2014-08-06 08:00 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 07:54 - 2014-08-06 07:54 - 00000687 _____ () C:\awh81A.tmp

2014-08-06 07:44 - 2013-10-02 04:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys

2014-08-06 07:44 - 2013-10-02 04:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe

2014-08-06 07:44 - 2013-10-02 04:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll

2014-08-06 07:44 - 2013-10-02 03:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll

2014-08-06 07:44 - 2013-10-02 03:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll

2014-08-06 07:44 - 2013-10-02 03:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll

2014-08-06 07:44 - 2013-10-02 03:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll

2014-08-06 07:44 - 2013-10-02 02:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll

2014-08-06 07:44 - 2013-10-02 02:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll

2014-08-06 07:44 - 2013-10-02 02:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll

2014-08-06 07:44 - 2013-10-02 02:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2014-08-06 07:44 - 2013-10-02 02:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe

2014-08-06 07:44 - 2013-10-02 01:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll

2014-08-06 07:44 - 2013-10-02 01:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe

2014-08-06 07:44 - 2013-10-02 01:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll

2014-08-06 07:44 - 2013-10-02 00:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe

2014-08-06 07:42 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll

2014-08-06 07:42 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys

2014-08-06 07:42 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll

2014-08-06 07:42 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll

2014-08-06 07:41 - 2013-09-25 04:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll

2014-08-06 07:41 - 2013-09-25 03:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll

2014-08-06 07:40 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll

2014-08-06 07:40 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

2014-08-06 07:26 - 2014-08-06 07:26 - 00000687 _____ () C:\awh4AE4.tmp

2014-08-04 11:22 - 2014-08-04 11:22 - 00000687 _____ () C:\awh2D46.tmp

2014-08-04 07:32 - 2014-08-04 07:32 - 00000687 _____ () C:\awhCDC9.tmp

2014-08-04 07:09 - 2014-08-04 07:09 - 00000687 _____ () C:\awh6C78.tmp

2014-08-02 13:29 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe

2014-08-02 13:29 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll

2014-08-02 13:29 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll

2014-08-02 13:29 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll

2014-08-02 13:29 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll

2014-08-02 13:29 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll

2014-08-02 13:29 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll

2014-08-02 13:29 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll

2014-08-02 13:29 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe

2014-08-02 13:29 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

2014-08-02 13:26 - 2014-08-02 13:26 - 00000687 _____ () C:\awh4FB5.tmp

2014-07-31 08:56 - 2014-08-20 09:19 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-07-31 08:44 - 2014-07-31 08:44 - 00000687 _____ () C:\awh5292.tmp

2014-07-30 20:23 - 2014-07-30 20:23 - 00000687 _____ () C:\awhAD4E.tmp

2014-07-30 08:25 - 2014-07-30 08:25 - 00000687 _____ () C:\awh3957.tmp

2014-07-29 09:11 - 2014-07-29 09:11 - 00000687 _____ () C:\awh4587.tmp

2014-07-29 08:15 - 2014-07-29 08:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\com

2014-07-29 08:11 - 2014-07-29 08:11 - 00001021 _____ () C:\Users\UpdatusUser\Desktop\PepperZip.lnk

2014-07-29 08:11 - 2014-07-28 20:24 - 04795904 _____ () C:\Windows\score.exe

2014-07-29 08:10 - 2014-07-29 08:10 - 00000687 _____ () C:\awh1812.tmp

2014-07-28 07:13 - 2014-07-28 07:13 - 00000687 _____ () C:\awh17F2.tmp

2014-07-27 20:10 - 2014-07-27 20:10 - 00000687 _____ () C:\awh63A2.tmp

2014-07-27 18:56 - 2014-07-27 18:56 - 00000687 _____ () C:\awh5C71.tmp

2014-07-27 11:26 - 2014-07-27 11:26 - 00000687 _____ () C:\awh26C1.tmp

2014-07-26 12:38 - 2014-07-26 12:38 - 00000687 _____ () C:\awh6315.tmp

2014-07-25 17:47 - 2014-07-25 17:47 - 00000687 _____ () C:\awh1525.tmp

2014-07-25 07:50 - 2014-07-25 07:50 - 00000687 _____ () C:\awh20F7.tmp
 

==================== One Month Modified Files and Folders =======
 

(If an entry is included in the fixlist, the file\folder will be moved.)
 

2014-08-24 10:19 - 2014-08-22 09:35 - 00019700 _____ () C:\Users\Norman\Desktop\FRST.txt

2014-08-24 10:17 - 2014-08-20 10:27 - 00000000 ____D () C:\FRST

2014-08-24 10:16 - 2014-08-24 10:16 - 00000000 ____D () C:\Users\Norman\Desktop\FRST-OlderVersion

2014-08-24 10:16 - 2014-08-20 10:18 - 02103296 _____ (Farbar) C:\Users\Norman\Desktop\FRST64.exe

2014-08-24 10:14 - 2014-08-22 09:00 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-08-24 10:12 - 2010-06-08 23:07 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-24 10:12 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-08-24 10:12 - 2009-07-14 06:51 - 00420091 _____ () C:\Windows\setupact.log

2014-08-23 21:53 - 2010-06-08 22:48 - 01762783 _____ () C:\Windows\WindowsUpdate.log

2014-08-23 21:51 - 2011-07-03 19:09 - 00045056 _____ () C:\Windows\system32\acovcnt.exe

2014-08-23 21:46 - 2012-11-17 13:41 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-08-23 21:35 - 2010-06-08 23:07 - 00001124 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-23 21:29 - 2014-08-23 21:29 - 00000897 _____ () C:\Users\Norman\Desktop\checkup.txt

2014-08-23 21:14 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-08-23 21:14 - 2009-07-14 06:45 - 00010240 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-08-23 21:06 - 2009-07-14 06:45 - 00435744 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-08-23 21:04 - 2014-08-23 08:41 - 00000000 ____D () C:\Program Files (x86)\Supporter

2014-08-23 21:04 - 2014-08-22 09:22 - 00001396 _____ () C:\Windows\PFRO.log

2014-08-23 13:02 - 2014-08-23 13:01 - 00854417 _____ () C:\Users\Norman\Desktop\SecurityCheck.exe

2014-08-23 12:54 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\F12FF6D4209A4538A4D404E99346737D

2014-08-23 12:53 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\InetStat

2014-08-23 12:51 - 2014-08-23 08:41 - 00000000 ____D () C:\ProgramData\cosstminn

2014-08-23 12:51 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Local\mbot_de_34

2014-08-23 12:51 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Local\29436

2014-08-23 12:50 - 2014-08-23 08:41 - 00000000 ____D () C:\Program Files (x86)\cosstminn

2014-08-23 12:50 - 2014-08-22 09:32 - 00000000 ____D () C:\Program Files (x86)\mbot_de_34

2014-08-23 10:24 - 2012-12-08 11:24 - 00000316 _____ () C:\Windows\Tasks\MT66 Software Update.job

2014-08-23 09:27 - 2014-08-23 09:27 - 02347384 _____ (ESET) C:\Users\Norman\Desktop\esetsmartinstaller_deu.exe

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\UpdatusUser\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\SearchProtect

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Packages

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Norman\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\HomeGroupUser$

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Gast

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Torch

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Google

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Comodo

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator\AppData\Local\Chromatic Browser

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Users\Administrator

2014-08-23 08:41 - 2014-08-23 08:41 - 00000000 ____D () C:\Program Files (x86)\SearchProtect

2014-08-23 08:41 - 2014-08-18 12:20 - 00000000 ____D () C:\ProgramData\8e27c8f07b9e9861

2014-08-23 08:41 - 2014-03-11 10:04 - 00000306 __RSH () C:\ProgramData\ntuser.pol

2014-08-23 08:41 - 2010-10-13 19:14 - 00000000 ____D () C:\Users\Norman\AppData\Local\Google

2014-08-23 08:41 - 2010-06-08 23:07 - 00000000 ____D () C:\Program Files (x86)\Google

2014-08-23 08:36 - 2010-06-08 23:31 - 00003322 _____ () C:\Windows\system32\AutoRunFilter.ini

2014-08-22 09:32 - 2014-08-22 09:32 - 00001540 _____ () C:\Users\Norman\Desktop\JRT.txt

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Public\E65A5EE0490A42C5824668D5555831B4

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MYBESTOFFERSTODAY

2014-08-22 09:32 - 2014-08-22 09:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\InetStat

2014-08-22 09:26 - 2014-08-22 09:26 - 00042941 _____ () C:\Users\Norman\Desktop\AdwCleaner[S0].txt

2014-08-22 09:26 - 2014-08-22 09:26 - 00000000 ____D () C:\Windows\ERUNT

2014-08-22 09:21 - 2014-08-22 09:17 - 00000000 ____D () C:\AdwCleaner

2014-08-22 09:21 - 2010-10-14 20:32 - 00000000 ____D () C:\ProgramData\ICQ

2014-08-22 09:21 - 2010-10-13 16:57 - 00000000 ____D () C:\Users\Norman

2014-08-22 09:17 - 2014-08-22 09:17 - 00001153 _____ () C:\Users\Norman\Desktop\mbam.txt

2014-08-22 09:00 - 2014-08-22 09:00 - 00001104 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-08-22 09:00 - 2014-08-22 09:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-08-22 09:00 - 2014-08-06 08:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-08-22 08:54 - 2014-08-22 08:54 - 01016261 _____ (Thisisu) C:\Users\Norman\Desktop\JRT.exe

2014-08-22 08:53 - 2014-08-22 08:52 - 01364531 _____ () C:\Users\Norman\Desktop\adwcleaner_3.308.exe

2014-08-22 08:51 - 2014-08-22 08:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Desktop\mbam-setup-2.0.2.1012.exe

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\Users\Norman\Desktop\Combofix.txt

2014-08-21 11:24 - 2014-08-21 11:24 - 00047594 _____ () C:\ComboFix.txt

2014-08-21 11:24 - 2014-08-21 10:28 - 00000000 ____D () C:\Qoobox

2014-08-21 11:24 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default

2014-08-21 11:22 - 2014-08-21 10:28 - 00000000 ____D () C:\Windows\erdnt

2014-08-21 11:21 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini

2014-08-21 10:41 - 2009-07-14 04:34 - 97255424 _____ () C:\Windows\system32\config\software.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 25952256 _____ () C:\Windows\system32\config\system.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 01048576 _____ () C:\Windows\system32\config\default.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\security.bak

2014-08-21 10:41 - 2009-07-14 04:34 - 00061440 _____ () C:\Windows\system32\config\sam.bak

2014-08-21 10:22 - 2014-08-21 10:27 - 05572251 ____R (Swearware) C:\Users\Norman\Desktop\ComboFix.exe

2014-08-21 09:23 - 2014-08-21 09:23 - 00000000 ____D () C:\Program Files (x86)\CooiLSalEECoUpon

2014-08-21 09:10 - 2014-08-21 09:10 - 00001266 _____ () C:\Users\Norman\Desktop\Revo Uninstaller.lnk

2014-08-21 09:10 - 2014-08-21 09:10 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group

2014-08-21 09:04 - 2014-08-21 09:03 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Norman\Desktop\revosetup95.exe

2014-08-20 12:03 - 2014-08-20 12:03 - 00500552 _____ () C:\Windows\Minidump\082014-323405-01.dmp

2014-08-20 12:03 - 2011-01-24 13:33 - 00000000 ____D () C:\Windows\Minidump

2014-08-20 10:50 - 2014-08-20 10:50 - 00014075 _____ () C:\Users\Norman\Desktop\Gmer.log

2014-08-20 10:37 - 2012-10-31 13:04 - 00001912 _____ () C:\Windows\epplauncher.mif

2014-08-20 10:31 - 2014-08-20 10:31 - 00044706 _____ () C:\Users\Norman\Desktop\Addition.txt

2014-08-20 10:21 - 2014-08-20 10:21 - 00000584 _____ () C:\Users\Norman\Desktop\defogger_disable.log

2014-08-20 10:21 - 2014-08-20 10:21 - 00000020 _____ () C:\Users\Norman\defogger_reenable

2014-08-20 10:19 - 2014-08-20 10:19 - 00380416 _____ () C:\Users\Norman\Desktop\Gmer-19357.exe

2014-08-20 10:16 - 2014-08-20 10:16 - 00050477 _____ () C:\Users\Norman\Desktop\Defogger.exe

2014-08-20 10:02 - 2014-08-20 10:02 - 00096430 _____ () C:\Users\Norman\Desktop\Extras.Txt

2014-08-20 09:59 - 2014-08-20 09:59 - 00142852 _____ () C:\Users\Norman\Desktop\OTL.Txt

2014-08-20 09:38 - 2014-08-20 09:38 - 00602112 _____ (OldTimer Tools) C:\Users\Norman\Desktop\otl.exe

2014-08-20 09:29 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-08-20 09:19 - 2014-07-31 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-08-20 09:07 - 2012-04-18 10:29 - 00000000 ____D () C:\Program Files (x86)\1&1 Surf-Stick

2014-08-20 09:07 - 2011-01-09 18:46 - 00000000 ____D () C:\Users\Norman\AppData\Roaming\vlc

2014-08-20 09:07 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\registration

2014-08-19 08:09 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\Offline Web Pages

2014-08-18 07:40 - 2009-08-04 11:51 - 01760266 _____ () C:\Windows\system32\perfh007.dat

2014-08-18 07:40 - 2009-08-04 11:51 - 00488386 _____ () C:\Windows\system32\perfc007.dat

2014-08-18 07:40 - 2009-07-14 07:13 - 00006492 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-08-17 13:50 - 2014-08-17 13:50 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(2).exe

2014-08-16 10:47 - 2014-06-19 14:23 - 00000000 ____D () C:\temp

2014-08-14 08:32 - 2014-08-14 08:32 - 01058200 _____ (Adobe) C:\Users\Norman\Downloads\install_flashplayer14x32au_mssa_aaa_aih.exe

2014-08-14 08:24 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-08-13 20:25 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions

2014-08-13 14:23 - 2011-01-20 11:10 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-08-13 14:13 - 2013-08-13 09:52 - 00000000 ____D () C:\Windows\system32\MRT

2014-08-13 14:09 - 2010-10-13 17:55 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-08-13 14:00 - 2014-05-06 23:27 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-08-13 12:46 - 2014-08-06 08:02 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-08-13 12:46 - 2011-01-20 11:10 - 00000000 ____D () C:\Users\Norman\AppData\Local\Microsoft Help

2014-08-07 04:06 - 2014-08-13 13:04 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-08-07 04:01 - 2014-08-13 13:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-08-06 13:00 - 2014-08-06 12:59 - 00000000 ____D () C:\Users\Norman\Downloads\FM 2013

2014-08-06 12:59 - 2014-08-06 12:59 - 00921280 _____ () C:\Users\Norman\Downloads\FM 2013.rar

2014-08-06 12:59 - 2014-08-06 12:59 - 00183405 _____ () C:\Users\Norman\Downloads\FM2013 1.jpeg

2014-08-06 12:30 - 2009-07-14 06:45 - 00000000 ____D () C:\Windows\Setup

2014-08-06 12:25 - 2014-03-11 10:15 - 00000000 ____D () C:\Windows\SysWOW64\dfrg

2014-08-06 12:01 - 2010-06-08 23:31 - 00001711 _____ () C:\Windows\system32\ServiceFilter.ini

2014-08-06 08:01 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012(1).exe

2014-08-06 08:00 - 2014-08-06 08:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Norman\Downloads\mbam-setup-2.0.2.1012.exe

2014-08-06 07:54 - 2014-08-06 07:54 - 00000687 _____ () C:\awh81A.tmp

2014-08-06 07:50 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories

2014-08-06 07:26 - 2014-08-06 07:26 - 00000687 _____ () C:\awh4AE4.tmp

2014-08-05 09:20 - 2010-12-20 13:35 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

2014-08-04 11:22 - 2014-08-04 11:22 - 00000687 _____ () C:\awh2D46.tmp

2014-08-04 07:32 - 2014-08-04 07:32 - 00000687 _____ () C:\awhCDC9.tmp

2014-08-04 07:09 - 2014-08-04 07:09 - 00000687 _____ () C:\awh6C78.tmp

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\SystemSockets

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\ProtectedSearch

2014-08-02 13:30 - 2014-06-19 14:24 - 00000000 ____D () C:\Windows\System32\Tasks\Browser Updater

2014-08-02 13:26 - 2014-08-02 13:26 - 00000687 _____ () C:\awh4FB5.tmp

2014-08-01 01:41 - 2014-08-13 13:11 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-08-01 01:16 - 2014-08-13 13:11 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-31 08:44 - 2014-07-31 08:44 - 00000687 _____ () C:\awh5292.tmp

2014-07-30 20:23 - 2014-07-30 20:23 - 00000687 _____ () C:\awhAD4E.tmp

2014-07-30 08:25 - 2014-07-30 08:25 - 00000687 _____ () C:\awh3957.tmp

2014-07-29 09:11 - 2014-07-29 09:11 - 00000687 _____ () C:\awh4587.tmp

2014-07-29 08:15 - 2014-07-29 08:15 - 00000000 ____D () C:\Users\Norman\AppData\Local\com

2014-07-29 08:11 - 2014-07-29 08:11 - 00001021 _____ () C:\Users\UpdatusUser\Desktop\PepperZip.lnk

2014-07-29 08:10 - 2014-07-29 08:10 - 00000687 _____ () C:\awh1812.tmp

2014-07-28 20:24 - 2014-07-29 08:11 - 04795904 _____ () C:\Windows\score.exe

2014-07-28 07:13 - 2014-07-28 07:13 - 00000687 _____ () C:\awh17F2.tmp

2014-07-27 20:10 - 2014-07-27 20:10 - 00000687 _____ () C:\awh63A2.tmp

2014-07-27 18:56 - 2014-07-27 18:56 - 00000687 _____ () C:\awh5C71.tmp

2014-07-27 11:26 - 2014-07-27 11:26 - 00000687 _____ () C:\awh26C1.tmp

2014-07-26 12:38 - 2014-07-26 12:38 - 00000687 _____ () C:\awh6315.tmp

2014-07-25 17:47 - 2014-07-25 17:47 - 00000687 _____ () C:\awh1525.tmp

2014-07-25 16:52 - 2014-08-13 13:11 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-25 16:02 - 2014-08-13 13:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-25 16:01 - 2014-08-13 13:11 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-25 15:51 - 2014-08-13 13:11 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-25 15:30 - 2014-08-13 13:11 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-25 15:28 - 2014-08-13 13:11 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-25 15:28 - 2014-08-13 13:11 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-25 15:25 - 2014-08-13 13:11 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-25 15:25 - 2014-08-13 13:11 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-25 15:11 - 2014-08-13 13:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-25 15:10 - 2014-08-13 13:11 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-25 15:04 - 2014-08-13 13:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-25 15:03 - 2014-08-13 13:11 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-25 15:00 - 2014-08-13 13:11 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-25 15:00 - 2014-08-13 13:11 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-25 14:59 - 2014-08-13 13:11 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-25 14:47 - 2014-08-13 13:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-25 14:40 - 2014-08-13 13:11 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-25 14:34 - 2014-08-13 13:11 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-25 14:34 - 2014-08-13 13:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-25 14:33 - 2014-08-13 13:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-25 14:30 - 2014-08-13 13:11 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-25 14:28 - 2014-08-13 13:11 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-25 14:28 - 2014-08-13 13:11 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-25 14:21 - 2014-08-13 13:11 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-25 14:19 - 2014-08-13 13:11 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-25 14:18 - 2014-08-13 13:11 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-25 14:17 - 2014-08-13 13:11 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-25 14:17 - 2014-08-13 13:11 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-25 14:12 - 2014-08-13 13:11 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-25 14:10 - 2014-08-13 13:11 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-25 14:10 - 2014-08-13 13:11 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-25 14:08 - 2014-08-13 13:11 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-25 14:06 - 2014-08-13 13:11 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-25 13:52 - 2014-08-13 13:11 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-25 13:47 - 2014-08-13 13:11 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-25 13:43 - 2014-08-13 13:11 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-25 13:42 - 2014-08-13 13:11 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-25 13:39 - 2014-08-13 13:11 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-25 13:39 - 2014-08-13 13:11 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-25 13:36 - 2014-08-13 13:11 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-25 13:34 - 2014-08-13 13:11 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-25 13:29 - 2014-08-13 13:11 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-25 13:23 - 2014-08-13 13:11 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-25 13:13 - 2014-08-13 13:11 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-25 13:07 - 2014-08-13 13:11 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-25 13:07 - 2014-08-13 13:11 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-25 13:03 - 2014-08-13 13:11 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-25 12:52 - 2014-08-13 13:11 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-25 12:26 - 2014-08-13 13:11 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-25 12:17 - 2014-08-13 13:11 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-25 12:09 - 2014-08-13 13:11 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-25 12:05 - 2014-08-13 13:11 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-25 12:00 - 2014-08-13 13:11 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-25 07:50 - 2014-07-25 07:50 - 00000687 _____ () C:\awh20F7.tmp
 

Some content of TEMP:

====================

C:\Users\Norman\AppData\Local\Temp\dlLogic.exe

C:\Users\Norman\AppData\Local\Temp\dltr.exe

C:\Users\Norman\AppData\Local\Temp\GCVerifier.dll

C:\Users\Norman\AppData\Local\Temp\Quarantine.exe

C:\Users\Norman\AppData\Local\Temp\verifier.exe
 
 

==================== Bamital & volsnap Check =================
 

(There is no automatic fix for files that do not pass verification.)
 

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 

LastRegBack: 2014-07-23 15:18
 

==================== End Of Log ============================

--- --- ---

--- --- ---

Wenn ich Chrome öffne, dann habe ich trotzdem gleich Werbung. Sonst scheint aber alles okay zu sein.

MfG, Robert

Java und ADobe updaten.

Revo Uninstaller - Download - Filepony
damit Chrome deinstallieren, keine Daten behalten, Reste entfernen lassen, neu installieren.

Dann:
https://support.google.com/chrome/answer/3296214?hl=de

Frisches FRST log bitte.

Hallo Schrauber,

wie ist nun weiter zu verfahren?

MfG, Robert

meinen letzten Post gesehen?