Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Google öffnet lauter leere Fenster (https://www.trojaner-board.de/137528-google-oeffnet-lauter-leere-fenster.html)

Indexation 01.07.2013 18:50
Google öffnet lauter leere Fenster
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo zusammen ,
Seit kurzem öffnet sich bei google lauter leer Fenster wenn ich ein Suchbeggriff eingebe.
Bing läuft - Firefox auch
Geb ich ein Adresse ein klappt alles
Goolge search spinnt
Ich melde mich mit meinem Googlekonto an dann gebe ich eine Begriff ins Suchfeld ein .
dann muss das Teil regelrecht "abschiessen" sonst öffnet er 1000 leere Fenster :headbang:

Siehe Anlage


Habe WIN 7
Vermute ein Virus oder Trojaner aber .....
Defender - Spybot -norton und Kaspersky ( Virus removal tool) = (alles aktualisiert) findet nix !? :pfui:

Bestimmt gibt es hier eine thread -> ich finde ihn aber nicht - :lmaa:
Hat wer ein heissen Tip

schrauber 01.07.2013 18:55
Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Indexation 01.07.2013 19:09
Bin schon dabei :daumenhoc

Bin ich blind - wo hänge ich hier die ANlage ran ?????

Indexation 01.07.2013 19:20
Ahhh gefunden :kaffee:

schrauber 01.07.2013 19:35
Hi,

Logs bitte in den Thread posten.

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307



Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Indexation 01.07.2013 19:51
ist doch im Anhang ?????
Aber gern auch so :
Erst addition
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-07-2013 02
Ran by admin at 2013-07-01 20:10:01
Running from C:\Users\admin\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

??? ActiveX ?? Windows Live Mesh ???? ??????? ??????? (x32 Version: 15.4.5722.2)
???? ??? Windows Live (x32 Version: 15.4.3502.0922)
???? ???? ActiveX ????? ?? Windows Live Mesh ????????? ??????? (x32 Version: 15.4.5722.2)
???? Windows Live (x32 Version: 15.4.3502.0922)
?????? ??????? ?? Windows Live (x32 Version: 15.4.3502.0922)
??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ??????????? (x32 Version: 15.4.5722.2)
??????? Windows Live Mesh ActiveX ??? (x32 Version: 15.4.5722.2)
???????? ?????????? Windows Live (x32 Version: 15.4.3502.0922)
????????? ActiveX ?? Windows Live Mesh ????????????????????????? (???) (x32 Version: 15.4.5722.2)
?????????? Windows Live (x32 Version: 15.4.3502.0922)
??????????? ?? Windows Live (x32 Version: 15.4.3502.0922)
7-Zip 9.20 (x32)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.1395.4512)
Acrobat.com (x32 Version: 1.6.65)
ActiveX ???????? ?? Windows Live Mesh ?? ?????????? ?????? (x32 Version: 15.4.5722.2)
ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)
Adobe AIR (x32 Version: 3.6.0.5970)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Download Assistant (x32 Version: 1.2.5)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Photoshop CS6 (x32 Version: 13.0)
Adobe Premiere Elements 9 (x32 Version: 9.0)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Agatha Christie - 4:50 from Paddington (x32 Version: 2.2.0.95)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Applian FLV and Media Player 3.1.1.12 (x32 Version: 3.1.1.12)
ArcSoft TotalMedia 3.5 (x32 Version: 3.5.28.291)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36)
ATI Catalyst Install Manager (Version: 3.0.808.0)
Audacity 2.0.2 (x32 Version: 2.0.2)
Backup Manager V3 (x32 Version: 3.0.0.90)
BearShare (x32 Version: 9.0.0.88083)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Bonjour (Version: 3.0.0.10)
Camera RAW Plug-In for EPSON Creativity Suite (x32 Version: 2.3.0.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center InstallProxy (x32 Version: 2011.0331.249.3126)
Catalyst Control Center Localization All (x32 Version: 2011.0331.249.3126)
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0331.249.3126)
CCC Help Chinese Standard (x32 Version: 2011.0331.0248.3126)
CCC Help Chinese Traditional (x32 Version: 2011.0331.0248.3126)
CCC Help Czech (x32 Version: 2011.0331.0248.3126)
CCC Help Danish (x32 Version: 2011.0331.0248.3126)
CCC Help Dutch (x32 Version: 2011.0331.0248.3126)
CCC Help English (x32 Version: 2011.0331.0248.3126)
CCC Help Finnish (x32 Version: 2011.0331.0248.3126)
CCC Help French (x32 Version: 2011.0331.0248.3126)
CCC Help German (x32 Version: 2011.0331.0248.3126)
CCC Help Greek (x32 Version: 2011.0331.0248.3126)
CCC Help Hungarian (x32 Version: 2011.0331.0248.3126)
CCC Help Italian (x32 Version: 2011.0331.0248.3126)
CCC Help Japanese (x32 Version: 2011.0331.0248.3126)
CCC Help Korean (x32 Version: 2011.0331.0248.3126)
CCC Help Norwegian (x32 Version: 2011.0331.0248.3126)
CCC Help Polish (x32 Version: 2011.0331.0248.3126)
CCC Help Portuguese (x32 Version: 2011.0331.0248.3126)
CCC Help Russian (x32 Version: 2011.0331.0248.3126)
CCC Help Spanish (x32 Version: 2011.0331.0248.3126)
CCC Help Swedish (x32 Version: 2011.0331.0248.3126)
CCC Help Thai (x32 Version: 2011.0331.0248.3126)
CCC Help Turkish (x32 Version: 2011.0331.0248.3126)
ccc-core-static (x32 Version: 2011.0331.249.3126)
ccc-utility64 (Version: 2011.0331.249.3126)
CDex - Open Source Digital Audio CD Extractor (x32 Version: 1.70.4.2009)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Configo (x32 Version: 2.1.7.0)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2)
Control ActiveX del Windows Live Mesh per a connexions remotes (x32 Version: 15.4.5722.2)
Control ActiveX Windows Live Mesh pentru conexiuni la distan?a (x32 Version: 15.4.5722.2)
Controle ActiveX do Windows Live Mesh para Conexões Remotas (x32 Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.95)
CyberLink MediaEspresso (x32 Version: 6.0.1027_32100)
D3DX10 (x32 Version: 15.4.2368.0902)
Desktop Icon für Amazon (Version: 1.0.1 (de))
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
DivX-Setup (x32 Version: 2.6.1.9)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
ElsterFormular (x32 Version: 14.0.0.10960)
EPSON Attach To Email (x32 Version: 1.01.0000)
EPSON Easy Photo Print (x32 Version: 1.5.1.0)
EPSON File Manager (x32 Version: 1.3.1.0)
EPSON Scan (x32)
EPSON Scan Assistant (x32 Version: 1.10.00)
EPSON Stylus SX200 Series Printer Uninstall
EPSON Stylus SX200_SX400_TX200_TX400 Handbuch (x32)
FATE (x32 Version: 2.2.0.95)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsluge polaczen zdalnych (x32 Version: 15.4.5722.2)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Foxit Reader (x32 Version: 5.4.5.124)
Free FLV Converter V 7.5.0 (x32 Version: 7.5.0.0)
Free YouTube Download version 3.2.1.320 (x32 Version: 3.2.1.320)
Freecom Hard Drive Formatter 1.41 (x32)
Freecom Product Update 1.06 (x32)
FreePDF (Remove only) (x32)
Freeware.de Toolbar (x32 Version: 6.8.2.0)
Freez FLV to MP3 Converter (x32 Version: 1.5)
FreeZip (x32)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Google Chrome (x32 Version: 27.0.1453.116)
Google Earth (x32 Version: 7.0.3.8542)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)
Google Update Helper (x32 Version: 1.3.21.145)
GPL Ghostscript 8.64 (x32)
HomeMedia (x32 Version: 2.0.8520)
iCloud (Version: 2.1.1.3)
Identity Card (x32 Version: 1.00.3006)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
iTunes (Version: 11.0.4.4)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 38 (x32 Version: 6.0.380)
JDownloader 0.9 (x32 Version: 0.9)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
John Deere Drive Green (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kontrola Windows Live Mesh ActiveX za daljinske veze (x32 Version: 15.4.5722.2)
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2)
Launch Manager (x32 Version: 5.1.4)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2000 Premium (x32 Version: 9.00.2816)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 10.0.2 (x86 de) (x32 Version: 10.0.2)
MSI to redistribute MS VS2005 CRT libraries (x32 Version: 8.0.50727.42)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95)
Nero Backup Drivers (Version: 1.0.11100.8.0)
Nero Control Center 10 (x32 Version: 10.2.11100.1.1)
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Core Components 10 (x32 Version: 2.0.18100.8.8)
Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Express 10 (x32 Version: 10.2.12000.21.100)
Nero Express 10 Help (CHM) (x32 Version: 10.5.10200)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300)
Nero StartSmart 10 (x32 Version: 10.2.11600.14.100)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Update (x32 Version: 1.0.0018)
Norton Internet Security (x32 Version: 18.7.2.3)
Norton Online Backup (x32 Version: 2.1.17869)
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
Orbit Downloader (x32)
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená pripojení (x32 Version: 15.4.5722.2)
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2)
Packard Bell Games (x32 Version: 1.0.2.4)
Packard Bell MyBackup (x32 Version: 3.0.0.90)
Packard Bell Power Management (x32 Version: 6.00.3006)
Packard Bell Recovery Management (x32 Version: 5.00.3002)
Packard Bell Registration (x32 Version: 1.03.3004)
Packard Bell ScreenSaver (x32 Version: 1.1.1025.2010)
Packard Bell Social Networks (x32 Version: 2.0.2211)
Packard Bell Updater (x32 Version: 1.02.3005)
PDF Settings CS6 (x32 Version: 11.0)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Polar Bowler (x32 Version: 2.2.0.95)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Profi cash (x32)
PX Profile Update (x32 Version: 1.00.1.)
QuickTime (x32 Version: 7.73.80.64)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
REALTEK DTV USB DEVICE (x32 Version: 1.00.0000)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30123)
RedMon - Redirection Port Monitor
RewardsArcadeSuite (HKCU)
S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922)
Secure Eraser v4.0 (x32)
Skype™ 5.10 (x32 Version: 5.10.116)
Slingo Deluxe (x32 Version: 2.2.0.95)
Softonic toolbar  on IE and Chrome (x32)
Spybot - Search & Destroy (x32 Version: 1.6.2)
StarMoney (x32 Version: 2.0)
StarMoney (x32 Version: 3.0.5.8)
StarMoney 8.0  (x32 Version: 8.0)
Synaptics Pointing Device Driver (Version: 15.1.6.0)
Torchlight (x32 Version: 2.2.0.95)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
Urruneko konexioetarako Windows Live Mesh ActiveX kontrola (x32 Version: 15.4.5722.2)
Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
Video Web Camera (x32 Version: 1.0.1523)
VideoConverter (x32)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
VLC media player 1.1.11 (x32 Version: 1.1.11)
Wedding Dash (x32 Version: 2.2.0.95)
Welcome Center (x32 Version: 1.02.3102)
WildTangent Games App (Packard Bell Games) (x32 Version: 4.0.3.57)
Windows Live ??? (x32 Version: 15.4.3502.0922)
Windows Live ???? (x32 Version: 15.4.3502.0922)
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WinX Free FLV to MP4 Converter 4.1.7 (x32)
WinZip 15.0 (x32 Version: 15.0.9411)
WiseConvert 1.3 Toolbar (x32 Version: 6.9.0.16)
Zuma Deluxe (x32 Version: 2.2.0.95)

==================== Restore Points  =========================

23-06-2013 11:51:43 Windows Update
28-06-2013 11:48:17 Windows Update
30-06-2013 15:04:02 Installed Sophos Virus Removal Tool.
30-06-2013 17:29:00 Removed Sophos Virus Removal Tool.

==================== Hosts content: ==========================
127.0.0.1        www.007guard.com
127.0.0.1        007guard.com
127.0.0.1        008i.com
127.0.0.1        www.008k.com
127.0.0.1        008k.com
127.0.0.1        www.00hq.com
127.0.0.1        00hq.com
127.0.0.1        010402.com
127.0.0.1        www.032439.com
127.0.0.1        032439.com
127.0.0.1        www.0scan.com
127.0.0.1        0scan.com
127.0.0.1        1000gratisproben.com
127.0.0.1        www.1000gratisproben.com
127.0.0.1        1001namen.com
127.0.0.1        www.1001namen.com
127.0.0.1        100888290cs.com
127.0.0.1        www.100888290cs.com
127.0.0.1        www.100sexlinks.com
127.0.0.1        100sexlinks.com
127.0.0.1        10sek.com
127.0.0.1        www.10sek.com
127.0.0.1        www.1-2005-search.com
127.0.0.1        1-2005-search.com
127.0.0.1        123fporn.info
127.0.0.1        www.123fporn.info
127.0.0.1        123haustiereundmehr.com
127.0.0.1        www.123haustiereundmehr.com
127.0.0.1        123moviedownload.com

There are more than 1000 lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {16730B1D-FF19-4019-B458-583B0F10930C} - System32\Tasks\AdobeAAMUpdater-1.0-home-jörg => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {201A9F1F-21A7-4640-B369-912633B026B6} - System32\Tasks\Symantec\Norton Error Processor 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {277F5A78-E82A-4029-B7E1-F6F469598154} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2010-10-28] (CyberLink)
Task: {2B67024A-00BB-4A12-B31D-75CEAEF38327} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {597CCC43-0860-4880-8F24-B5B2B6B2D937} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {59A7CAB6-C4D9-4180-8952-DE97E258317C} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => C:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {60193A6D-E0B7-480F-8AC6-289BFE6BBD06} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2799057012-1557965162-470920329-1004 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {72D588D8-BE7B-49E6-B5D6-2B21DA28DC4C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-14] (Adobe Systems Incorporated)
Task: {74723509-D50E-40F4-A4E8-2B6F9D66BF61} - System32\Tasks\User_Feed_Synchronization-{5C497AA6-8DA4-4F51-9231-255D2BE41896} => C:\Windows\system32\msfeedssync.exe [2011-07-28] (Microsoft Corporation)
Task: {8D90092A-3603-4DF4-B0FF-3B36A7B01AA7} - System32\Tasks\Symantec\Norton Error Analyzer 18.7.2.3 => C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\SymErr.exe [2012-06-08] (Symantec Corporation)
Task: {98EAF0E2-62FF-41B5-BC9B-09C1BC06AD3C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-29] (Google Inc.)
Task: {C7D2F019-EE9B-4EC0-84FE-9ADFE36BCD69} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {D0FD4A03-5F63-460A-A834-6F37086B10DC} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {DE75400B-3886-447C-9DF1-EB96F1A9124D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-29] (Google Inc.)
Task: {E00BA8FA-2C19-46D6-B7D6-0E768914F1FE} - System32\Tasks\AdobeAAMUpdater-1.0-home-Manu => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {E55DB095-337A-4A84-89A3-9E4AFF305883} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2799057012-1557965162-470920329-1007 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {FE27252D-67E3-4AE5-9D07-465D2160F3B8} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2799057012-1557965162-470920329-1003 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\BearShareNAG.job => C:\Users\JRG~1\AppData\Local\Temp\BearShare_setup.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/01/2013 07:03:01 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16490 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1e58

Startzeit: 01ce767c802d61d3

Endzeit: 25

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (07/01/2013 06:51:20 PM) (Source: Application Hang) (User: )
Description: Programm firefox.exe, Version 17.0.1.4715 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 11d4

Startzeit: 01ce767b018835eb

Endzeit: 81

Anwendungspfad: D:\firefox\firefox.exe

Berichts-ID: 71ef633e-e26e-11e2-b053-b870f4817a81

Error: (07/01/2013 05:13:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/01/2013 03:42:12 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/30/2013 06:58:10 PM) (Source: Application Hang) (User: )
Description: Programm SpybotSD.exe, Version 1.6.2.46 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 538

Startzeit: 01ce75b26eb7ba35

Endzeit: 12

Anwendungspfad: D:\spybot\Spybot - Search & Destroy\SpybotSD.exe

Berichts-ID:

Error: (06/30/2013 06:54:09 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/30/2013 04:07:35 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/30/2013 01:46:28 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/29/2013 05:18:35 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/29/2013 03:27:05 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16490, Zeitstempel: 0x51955cca
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725, Zeitstempel: 0x4ec49b8f
Ausnahmecode: 0xc0000374
Fehleroffset: 0x000ce6c3
ID des fehlerhaften Prozesses: 0x16a8
Startzeit der fehlerhaften Anwendung: 0xiexplore.exe0
Pfad der fehlerhaften Anwendung: iexplore.exe1
Pfad des fehlerhaften Moduls: iexplore.exe2
Berichtskennung: iexplore.exe3


System errors:
=============
Error: (07/01/2013 07:42:54 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:52 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:51 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:46 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:45 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:43 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:42 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:41 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:36 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)

Error: (07/01/2013 07:42:35 PM) (Source: DCOM) (User: home)
Description: ComputerstandardLokalAktivierung{9BA05972-F6A8-11CF-A442-00A0C90A8F39}{9BA05972-F6A8-11CF-A442-00A0C90A8F39}homeadminS-1-5-21-2799057012-1557965162-470920329-1001LocalHost (unter Verwendung von LRPC)


Microsoft Office Sessions:
=========================
Error: (07/01/2013 07:03:01 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.164901e5801ce767c802d61d325C:\Program Files (x86)\Internet Explorer\iexplore.exe

Error: (07/01/2013 06:51:20 PM) (Source: Application Hang)(User: )
Description: firefox.exe17.0.1.471511d401ce767b018835eb81D:\firefox\firefox.exe71ef633e-e26e-11e2-b053-b870f4817a81

Error: (07/01/2013 05:13:54 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/01/2013 03:42:12 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/30/2013 06:58:10 PM) (Source: Application Hang)(User: )
Description: SpybotSD.exe1.6.2.4653801ce75b26eb7ba3512D:\spybot\Spybot - Search & Destroy\SpybotSD.exe

Error: (06/30/2013 06:54:09 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/30/2013 04:07:35 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/30/2013 01:46:28 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/29/2013 05:18:35 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (06/29/2013 03:27:05 PM) (Source: Application Error)(User: )
Description: iexplore.exe9.0.8112.1649051955ccantdll.dll6.1.7601.177254ec49b8fc0000374000ce6c316a801ce74cc03105549C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Windows\SysWOW64\ntdll.dll96b8a9c0-e0bf-11e2-a306-b870f4817a81


==================== Memory info ===========================

Percentage of memory in use: 66%
Total physical RAM: 3947.86 MB
Available physical RAM: 1316.89 MB
Total Pagefile: 7893.9 MB
Available Pagefile: 5091.34 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:103.86 GB) (Free:13.53 GB) NTFS (Disk=0 Partition=3)
Drive d: (Software) (Fixed) (Total:97.66 GB) (Free:79.71 GB) NTFS (Disk=0 Partition=4)
Drive e: (Data) (Fixed) (Total:244.14 GB) (Free:54.25 GB) NTFS
Drive g: (TOSHIBA) (Removable) (Total:7.21 GB) (Free:3.63 GB) FAT32 (Disk=1 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5EBAD0F3)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=104 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=342 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 6B1B7998)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

==================== End Of Log ============================
Dann die FRST

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2013 02
Ran by admin (administrator) on 01-07-2013 20:07:19
Running from C:\Users\admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Ask.com) C:\ProgramData\Ask\APN-Stub\FXTV5\Local\ApnStub.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Orbitdownloader.com) C:\Program Files (x86)\Orbitdownloader\orbitdm.exe
(Orbitdownloader.com) C:\Program Files (x86)\Orbitdownloader\orbitnet.exe
() D:\Downloads\setup_11.0.0.1245.x01_2013_07_01_18_13.exe
() C:\Users\admin\AppData\Local\Temp\RarSFX2\7666287.exe
(Kaspersky Lab) C:\Users\admin\AppData\Local\Temp\3067917\7666287.exe
(Mozilla Corporation) D:\firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dinotify.exe
(Mozilla Corporation) D:\firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKLM-x32\...\RunOnce: [ApnStub] "C:\ProgramData\Ask\APN-Stub\FXTV5\Local\ApnStub.exe" /debug /hpr toolbar=FXTV5 dtid= /tbr /sa toolbar=FXTV5 dtid= [356520 2013-05-08] (Ask.com)
HKLM-x32\...\Runonce: [GrpConv] grpconv -o [x]
HKCU\...\Run: [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Users\admin\AppData\Local\Temp\E_SE1A8.tmp" /EF "HKCU" [x] <===== ATTENTION
HKCU\...\Run: [AdobeBridge]  [x]
HKCR\...0c966feabec1\InprocServer32: [Default-shell32] %SystemRoot%\system32\shell32.dll ATTENTION! ====> ZeroAccess?
HKCR\...409d6c4515e9\InprocServer32: [Default-shell32] %SystemRoot%\system32\shell32.dll ATTENTION! ====> ZeroAccess?
MountPoints2: {8cc8f981-b8ba-11e0-a0ec-806e6f6e6963} - F:\Autorun.exe
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [IR_SERVER] D:\tv\IR_SERVER.exe [x]
HKLM-x32\...\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] "D:\I tunes\iTunesHelper.exe" [x]
HKU\jörg\...\Run: [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Windows\TEMP\E_S5BF5.tmp" /EF "HKCU" [x] <===== ATTENTION
HKU\jörg\...\Run: [Copernic Desktop Search - Home] "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
HKU\jörg\...\Run: [Norton Download Manager{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}] C:\Users\Public\Downloads\Norton\{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}\NBRT-Retail-Downloader.exe /m [x]
HKU\jörg\...\Winlogon: [Shell] cmd.exe [345088 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\jörg\...\Command Processor:  <===== ATTENTION!
AppInit_DLLs:      [0 ] ()
AppInit_DLLs-x32:      [0 ] ()
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_07623136.lnk
ShortcutTarget: _uninst_07623136.lnk -> C:\Users\admin\AppData\Local\Temp\_uninst_07623136.bat (No File)
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_62611638.lnk
ShortcutTarget: _uninst_62611638.lnk -> C:\Users\admin\AppData\Local\Temp\_uninst_62611638.bat ()
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\_uninst_99245666.lnk
ShortcutTarget: _uninst_99245666.lnk -> C:\Users\admin\AppData\Local\Temp\_uninst_99245666.bat (No File)
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)
Startup: C:\Users\jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zahlungserinnerung.lnk
ShortcutTarget: Zahlungserinnerung.lnk -> D:\Profi cash\wzed.exe ()
Startup: C:\Users\Manu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> D:\open office\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/#output=search&sclient=psy-ab&q=test&oq=test&gs_l=hp.12..0l4.9000.9329.0.11166.4.4.0.0.0.0.88.276.4.4.0...0.0...1c.1.18.psy-ab.H4SAn_fWiPk&pbx=1&bav=on.2,or.r_qf.&bvm=bv.48572450,d.Yms&fp=ca1c41bc59b1d6d5&biw=1230&bih=534
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
URLSearchHook: (No Name) - {213c8ed6-1d78-4d8f-8729-25006aa86a76} -  No File
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=8712433843584564&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=8712433843584564&q={searchTerms}
HKCU SearchScopes: DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=8712433843584564&q={searchTerms}
SearchScopes: HKCU - {0388404D-6072-4CEB-B521-8F090FEAEE57} URL = hxxp://klit.startnow.com/s/?q={searchTerms}&src=defsearch&provider=&provider_name=yahoo&provider_code=&partner_id=693&product_id=741&affiliate_id=&channel=&toolbar_id=200&toolbar_version=2.4.0&install_country=DE&install_date=20120108&user_guid=AA59C97E440F40A1920182F9F55FF4FB&machine_id=49bd5e136d2b2f631ebe4891a8a6fb02&browser=IE&os=win&os_version=6.1-x64-SP1&iesrc={referrer:source}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2413} URL = hxxp://dts.search-results.com/sr?src=ieb&gct=ds&appid=0&systemid=413&apn_dtid=BND413&apn_ptnrs=AGA&o=APN10649&apn_uid=8712433843584564&q={searchTerms}
SearchScopes: HKCU - {B49ED955-277E-438A-9199-D02FF81A91EA} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3242337
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO-x32: WiseConvert 1.3 Toolbar - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWis0.dll (Conduit Ltd.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Freeware.de Toolbar - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: RewardsArcadeSuite - {B6EF6C45-5E8D-4c3b-B580-A5073261A381} - C:\Program Files (x86)\RewardsArcadeSuite\RewardsArcadeSuite.dll (215 Apps)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Softonic Helper Object - {E87806B5-E908-45FD-AF5E-957D83E58E68} - C:\Program Files (x86)\Softonic\softonic\1.5.11.5\bh\softonic.dll (Softonic.com)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Freeware.de Toolbar - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Softonic Toolbar - {5018CFD2-804D-4C99-9F81-25EAEA2769DE} - C:\Program Files (x86)\Softonic\softonic\1.5.11.5\softonicTlbr.dll (Softonic.com)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKLM-x32 - WiseConvert 1.3 Toolbar - {213c8ed6-1d78-4d8f-8729-25006aa86a76} - C:\Program Files (x86)\WiseConvert_1.3\prxtbWis0.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} -  No File
Toolbar: HKCU - No Name - {213C8ED6-1D78-4D8F-8729-25006AA86A76} -  No File
Handler: ipp - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler-x32: ipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\user.js
FF SearchEngine: Search Results
FF Homepage: hxxp://www.bing.com/?cc=de
FF Keyword.URL: hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=bcde545000000000000018f46ad5266c&tlver=1.5.29.1&instlRef=sst&babTrack&q=
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: Babylon - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\Extensions\ffxtlbr@babylon.com
FF Extension: SpecialSavings - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\Extensions\specialsavings@superfish.com
FF Extension: No Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\Extensions\{35379F86-8CCB-4724-AE33-4278DE266C70}
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\
FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF Extension: No Name - C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKCU\...\Firefox\Extensions: [specialsavings@superfish.com] C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/4b8kq9k8.default\extensions\specialsavings@superfish.com
FF Extension: SpecialSavings - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/4b8kq9k8.default\extensions\specialsavings@superfish.com

Chrome:
=======
CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (Babylon Toolbar) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb\1.7_0
CHR Extension: (RewardsArcade Suite) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ielefkgbofdpglioecfjcbikholflklb\1.18.35_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

R0 07623136; C:\Windows\System32\DRIVERS\07623136.sys [460888 2013-05-13] (Kaspersky Lab ZAO)
R0 62611638; C:\Windows\System32\DRIVERS\62611638.sys [460888 2013-07-01] (Kaspersky Lab ZAO)
R0 99245666; C:\Windows\System32\DRIVERS\99245666.sys [460888 2013-06-22] (Kaspersky Lab ZAO)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130620.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130620.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-12-12] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-12-12] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-06-04] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130628.001\IDSvia64.sys [513184 2013-06-01] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130628.001\IDSvia64.sys [513184 2013-06-01] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130630.003\ENG64.SYS [126040 2013-06-04] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130630.003\ENG64.SYS [126040 2013-06-04] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130630.003\EX64.SYS [2098776 2013-06-04] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130630.003\EX64.SYS [2098776 2013-06-04] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-07-28] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [43640 2011-03-31] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-01 20:07 - 2013-07-01 20:07 - 00000000 ____D C:\FRST
2013-07-01 20:06 - 2013-07-01 20:05 - 01933776 ____A (Farbar) C:\Users\admin\Desktop\FRST64.exe
2013-07-01 20:04 - 2013-07-01 20:05 - 01933776 ____A (Farbar) C:\Users\admin\Downloads\FRST64.exe
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:49 - 2013-07-01 18:49 - 00008764 ____A C:\Users\Manu\Desktop\favoriten.htm
2013-07-01 18:48 - 2013-07-01 18:48 - 00000000 ____A C:\Users\Manu\Desktop\lesezeichen.html
2013-07-01 18:47 - 2013-07-01 18:47 - 00008764 ____A C:\Users\Manu\Desktop\bookmark.htm
2013-07-01 18:06 - 2013-07-01 18:13 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\62611638.sys
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:31 - 2013-06-22 16:02 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\99245666.sys
2013-06-30 19:13 - 2013-06-30 19:14 - 00000000 ____D C:\Users\JD\Desktop\Tai Chi
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:40 - 2013-06-30 16:47 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-06-30 18:47 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:03 - 2013-06-29 16:03 - 00156028 ____A C:\Users\JD\Desktop\libmp3lame-win-3.97.zip
2013-06-29 16:02 - 2013-06-29 17:16 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 15:57 - 2013-06-30 18:40 - 00019086 ____A C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil.aup
2013-06-29 15:57 - 2013-06-29 15:57 - 00000000 ____D C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil_data
2013-06-29 15:57 - 2013-06-04 20:36 - 00001609 ____A C:\Users\JD\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-29 15:57 - 2013-03-24 21:33 - 35210877 ____A C:\Users\JD\Desktop\0004.mp4
2013-06-29 15:57 - 2013-03-24 17:51 - 71403622 ____A C:\Users\JD\Desktop\0001.mp4
2013-06-29 15:57 - 2013-03-10 13:26 - 00001333 ____A C:\Users\JD\Desktop\IMG_3288.JPG - Verknüpfung.lnk
2013-06-29 15:57 - 2013-03-03 23:43 - 00001494 ____A C:\Users\JD\Desktop\Photoshop.lnk
2013-06-29 15:57 - 2012-09-05 20:27 - 00001109 ____A C:\Users\JD\Desktop\audacity..lnk
2013-06-29 15:57 - 2012-07-29 19:19 - 00001154 ____A C:\Users\JD\Desktop\FreeVideoPerformer.lnk
2013-06-29 15:57 - 2012-03-22 22:05 - 00000855 ____A C:\Users\JD\Desktop\TotalMedia.lnk
2013-06-29 15:57 - 2012-01-04 17:46 - 00001010 ____A C:\Users\JD\Desktop\Teamviewer.lnk
2013-06-29 15:57 - 2011-11-08 20:32 - 00000541 ____A C:\Users\JD\Desktop\Profi cash.lnk
2013-06-29 15:57 - 2011-07-30 22:45 - 00000967 ____A C:\Users\JD\Desktop\WORD.lnk
2013-06-29 15:57 - 2011-07-30 22:41 - 00000975 ____A C:\Users\JD\Desktop\EXCEL -.lnk
2013-06-29 15:57 - 2011-07-30 21:08 - 00000355 ____A C:\Users\JD\Desktop\home.lnk
2013-06-29 15:57 - 2011-04-19 13:21 - 00001272 ____A C:\Users\JD\Desktop\Snipping Tool.lnk
2013-06-29 15:57 - 2010-10-26 13:22 - 05661184 ____A (Digiarty Software, Inc.) C:\Users\JD\Desktop\WinX_Free_FLV_to_MP4_Converter.exe
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 19:16 - 2013-06-26 19:16 - 00013304 ____A C:\Users\JD\Desktop\SnippingTool - Verknüpfung.lnk
2013-06-26 19:11 - 2013-06-26 19:12 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 ____A C:\Users\JD\Sti_Trace.log
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 ____A C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:47 - 2013-06-29 15:27 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:19 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-23 13:19 - 2013-06-30 16:21 - 00000000 ____D C:\users\JD
2013-06-23 13:19 - 2013-06-28 18:25 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-23 13:19 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 13:19 - 2013-06-23 13:26 - 00002267 ____A C:\Users\JD\Desktop\Google Chrome.lnk
2013-06-23 13:19 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00073384 ____A C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-23 13:19 - 2011-04-19 14:30 - 00000000 ____D C:\Users\JD\AppData\Local\Cyberlink
2013-06-23 13:19 - 2011-04-19 14:25 - 00000000 ____D C:\Users\JD\AppData\Roaming\Macromedia
2013-06-23 13:19 - 2011-04-19 13:33 - 00000000 ____D C:\Users\JD\AppData\Roaming\Intel Corporation
2013-06-23 13:19 - 2011-04-19 13:31 - 00000000 ____D C:\Users\JD\AppData\Roaming\InstallShield
2013-06-23 13:19 - 2010-11-21 04:50 - 00000020 ___SH C:\Users\JD\ntuser.ini
2013-06-22 15:56 - 2013-06-22 15:56 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-22 15:56 - 2013-06-22 15:56 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:55 - 2013-06-20 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 ____A (SurfRight B.V.) C:\Users\admin\Downloads\hitmanpro_x64.exe
2013-06-18 22:34 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 22:32 - 2013-05-13 16:56 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\07623136.sys
2013-06-18 22:02 - 2013-06-18 22:02 - 01084698 ____A C:\ProgramData\2433f433
2013-06-18 22:02 - 2013-06-18 22:02 - 01084684 ____A C:\Users\jörg\AppData\Roaming\2433f433
2013-06-18 22:02 - 2013-06-18 22:02 - 01084669 ____A C:\Users\jörg\AppData\Local\2433f433
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}
2013-06-14 15:25 - 2013-06-14 15:25 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-14 14:56 - 2013-06-14 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{99EE7253-67B4-4F61-A8BC-9177B9312D33}
2013-06-13 16:44 - 2013-05-17 05:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 16:44 - 2013-05-17 05:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 16:44 - 2013-05-17 04:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 16:44 - 2013-05-17 04:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 16:44 - 2013-05-17 04:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 16:44 - 2013-05-17 04:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-13 16:44 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 16:44 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-13 16:44 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-13 16:44 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-13 16:44 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-13 16:44 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-13 16:44 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-13 16:43 - 2013-05-17 06:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 16:43 - 2013-05-17 05:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 16:43 - 2013-05-17 05:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 16:43 - 2013-05-17 05:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 16:43 - 2013-05-17 05:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 16:43 - 2013-05-17 04:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 16:43 - 2013-05-17 04:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 16:43 - 2013-05-17 04:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 16:43 - 2013-05-17 04:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 16:43 - 2013-05-17 04:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 16:43 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 16:43 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-13 16:43 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 16:43 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-13 16:43 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-13 16:43 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 16:43 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 16:43 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 16:43 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-13 16:16 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 16:16 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 16:16 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 16:16 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 16:16 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 16:16 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 16:16 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 16:16 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 16:16 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 16:16 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 16:14 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 16:14 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 16:14 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 16:14 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 16:14 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 16:06 - 2013-06-13 16:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{44E2793B-6AD0-41D5-B25A-69DFDE532F57}
2013-06-11 14:53 - 2013-06-11 14:53 - 00000000 ____D C:\Users\Manu\AppData\Local\{A0821F0E-E78A-4601-B328-5A5F35668781}
2013-06-10 20:44 - 2013-06-10 20:44 - 00000000 ____D C:\Users\jörg\AppData\Local\{7563DCB8-3CAB-493E-A1E5-3BFAA1192631}
2013-06-09 19:30 - 2013-06-09 19:30 - 00000000 ____D C:\Users\Manu\AppData\Local\{FEC6F72C-007B-4073-A665-3FDE103D2FAE}
2013-06-08 09:48 - 2013-06-08 09:48 - 00000000 ____D C:\Users\Manu\AppData\Local\{C463F1D9-FD8A-47BF-8DC5-44B3DFA22AB7}
2013-06-07 16:04 - 2013-06-07 16:04 - 00000000 ____D C:\Users\Manu\AppData\Local\{377F3E1B-52C1-418A-A5B0-397F38965AE9}
2013-06-06 18:43 - 2013-06-06 18:43 - 00000000 ____D C:\Users\jörg\AppData\Local\{65138475-27C5-448E-BCB3-4A88B43B1F56}
2013-06-06 16:14 - 2013-06-06 16:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{C5CCD79F-D5C9-408F-A647-387609FE459E}
2013-06-05 16:38 - 2013-06-05 16:38 - 00000000 ____D C:\Users\Manu\AppData\Local\{2630AFAC-26F1-4E03-86ED-E810169F8E2B}
2013-06-04 20:41 - 2013-06-04 20:41 - 00000000 ____D C:\Users\jörg\AppData\Local\{C3C906FE-0FE4-43D6-96B6-5937D326E06F}
2013-06-04 20:36 - 2013-06-04 20:36 - 00001609 ____A C:\Users\jörg\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-04 19:40 - 2013-06-04 19:40 - 00000000 ____D C:\Users\jörg\AppData\Local\{3C44CF72-A437-41AE-AFC5-C9EC1DF8556D}
2013-06-04 17:13 - 2013-06-04 17:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{BD654D46-DA3D-439F-9F7C-6EE6485BDE83}
2013-06-03 14:15 - 2013-06-03 14:15 - 00000000 ____D C:\Users\Manu\AppData\Local\{80A46B06-9E39-4984-802A-96CBCF0E00E4}
2013-06-02 21:45 - 2013-06-02 21:45 - 00000000 ____D C:\Users\jörg\AppData\Local\{9C36CA55-8318-41D5-860F-7056DC52E4B6}
2013-06-02 19:16 - 2013-06-02 21:29 - 00019764 ____A C:\Users\jörg\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil.aup
2013-06-02 19:16 - 2013-06-02 19:16 - 00000000 ____D C:\Users\jörg\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil_data
2013-06-02 11:17 - 2013-06-02 11:17 - 00000000 ____D C:\Users\Manu\AppData\Local\{9DDD6CF3-BA43-42BE-B0C0-593440A39EC4}

==================== One Month Modified Files and Folders =======

2013-07-01 20:07 - 2013-07-01 20:07 - 00000000 ____D C:\FRST
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 20:05 - 2013-07-01 20:06 - 01933776 ____A (Farbar) C:\Users\admin\Desktop\FRST64.exe
2013-07-01 20:05 - 2013-07-01 20:04 - 01933776 ____A (Farbar) C:\Users\admin\Downloads\FRST64.exe
2013-07-01 20:04 - 2011-07-28 13:36 - 00659690 ____A C:\Windows\System32\perfh007.dat
2013-07-01 20:04 - 2011-07-28 13:36 - 00132970 ____A C:\Windows\System32\perfc007.dat
2013-07-01 20:04 - 2009-07-14 07:13 - 01513970 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-01 20:01 - 2009-07-14 06:51 - 00152200 ____A C:\Windows\setupact.log
2013-07-01 19:25 - 2012-07-18 18:09 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:15 - 2011-07-29 21:19 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:59 - 2011-07-29 21:19 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-07-01 18:49 - 2013-07-01 18:49 - 00008764 ____A C:\Users\Manu\Desktop\favoriten.htm
2013-07-01 18:48 - 2013-07-01 18:48 - 00000000 ____A C:\Users\Manu\Desktop\lesezeichen.html
2013-07-01 18:47 - 2013-07-01 18:47 - 00008764 ____A C:\Users\Manu\Desktop\bookmark.htm
2013-07-01 18:13 - 2013-07-01 18:06 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\62611638.sys
2013-07-01 18:02 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-01 17:58 - 2011-07-28 03:43 - 01742806 ____A C:\Windows\WindowsUpdate.log
2013-07-01 17:21 - 2011-07-28 22:54 - 00000000 ____D C:\users\Manu
2013-07-01 17:20 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-01 17:20 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-01 17:13 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-01 15:51 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu\AppData\Local\Adobe
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:14 - 2013-06-30 19:13 - 00000000 ____D C:\Users\JD\Desktop\Tai Chi
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 18:52 - 2010-11-21 05:47 - 00131768 ____A C:\Windows\PFRO.log
2013-06-30 18:47 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 18:40 - 2013-06-29 15:57 - 00019086 ____A C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil.aup
2013-06-30 17:33 - 2012-02-25 18:49 - 00003192 ____A C:\Windows\wininit.ini
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:47 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 16:40 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\users\JD
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 17:16 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:03 - 2013-06-29 16:03 - 00156028 ____A C:\Users\JD\Desktop\libmp3lame-win-3.97.zip
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:57 - 2013-06-29 15:57 - 00000000 ____D C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil_data
2013-06-29 15:27 - 2013-06-23 13:47 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-29 14:39 - 2011-07-29 21:41 - 00000000 ____D C:\Users\Manu\AppData\Local\FreePDF_XP
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 18:25 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-28 13:42 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 19:16 - 2013-06-26 19:16 - 00013304 ____A C:\Users\JD\Desktop\SnippingTool - Verknüpfung.lnk
2013-06-26 19:12 - 2013-06-26 19:11 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-25 15:12 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-23 22:37 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 20:22 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 19:32 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 ____A C:\Users\JD\Sti_Trace.log
2013-06-23 18:13 - 2011-07-29 20:16 - 00000403 ____A C:\Windows\ODBC.INI
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 ____A C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:26 - 2013-06-23 13:19 - 00002267 ____A C:\Users\JD\Desktop\Google Chrome.lnk
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:20 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00073384 ____A C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-22 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-22 16:02 - 2013-06-30 19:31 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\99245666.sys
2013-06-22 15:56 - 2013-06-22 15:56 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-22 15:56 - 2013-06-22 15:56 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-22 15:56 - 2013-03-05 20:57 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-22 15:56 - 2013-03-05 20:57 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-22 15:56 - 2012-09-23 12:31 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-22 15:56 - 2011-08-21 12:11 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-22 15:56 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-22 15:40 - 2013-05-08 15:25 - 00000000 ____D C:\Program Files (x86)\Iminent
2013-06-22 15:28 - 2013-05-08 15:26 - 00000898 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:56 - 2013-06-20 14:55 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 ____A (SurfRight B.V.) C:\Users\admin\Downloads\hitmanpro_x64.exe
2013-06-18 22:34 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 22:02 - 2013-06-18 22:02 - 01084698 ____A C:\ProgramData\2433f433
2013-06-18 22:02 - 2013-06-18 22:02 - 01084684 ____A C:\Users\jörg\AppData\Roaming\2433f433
2013-06-18 22:02 - 2013-06-18 22:02 - 01084669 ____A C:\Users\jörg\AppData\Local\2433f433
2013-06-18 19:14 - 2011-07-30 21:00 - 00000000 ____D C:\Users\jörg\AppData\Local\Adobe
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}
2013-06-14 15:25 - 2013-06-14 15:25 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-14 15:25 - 2012-04-23 14:17 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-14 15:25 - 2011-08-17 18:20 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-14 14:56 - 2013-06-14 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{99EE7253-67B4-4F61-A8BC-9177B9312D33}
2013-06-13 16:09 - 2011-07-28 22:40 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 16:06 - 2013-06-13 16:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{44E2793B-6AD0-41D5-B25A-69DFDE532F57}
2013-06-11 14:53 - 2013-06-11 14:53 - 00000000 ____D C:\Users\Manu\AppData\Local\{A0821F0E-E78A-4601-B328-5A5F35668781}
2013-06-10 20:44 - 2013-06-10 20:44 - 00000000 ____D C:\Users\jörg\AppData\Local\{7563DCB8-3CAB-493E-A1E5-3BFAA1192631}
2013-06-09 19:30 - 2013-06-09 19:30 - 00000000 ____D C:\Users\Manu\AppData\Local\{FEC6F72C-007B-4073-A665-3FDE103D2FAE}
2013-06-08 09:48 - 2013-06-08 09:48 - 00000000 ____D C:\Users\Manu\AppData\Local\{C463F1D9-FD8A-47BF-8DC5-44B3DFA22AB7}
2013-06-07 16:04 - 2013-06-07 16:04 - 00000000 ____D C:\Users\Manu\AppData\Local\{377F3E1B-52C1-418A-A5B0-397F38965AE9}
2013-06-06 18:43 - 2013-06-06 18:43 - 00000000 ____D C:\Users\jörg\AppData\Local\{65138475-27C5-448E-BCB3-4A88B43B1F56}
2013-06-06 16:14 - 2013-06-06 16:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{C5CCD79F-D5C9-408F-A647-387609FE459E}
2013-06-05 16:38 - 2013-06-05 16:38 - 00000000 ____D C:\Users\Manu\AppData\Local\{2630AFAC-26F1-4E03-86ED-E810169F8E2B}
2013-06-04 20:41 - 2013-06-04 20:41 - 00000000 ____D C:\Users\jörg\AppData\Local\{C3C906FE-0FE4-43D6-96B6-5937D326E06F}
2013-06-04 20:36 - 2013-06-29 15:57 - 00001609 ____A C:\Users\JD\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-04 20:36 - 2013-06-04 20:36 - 00001609 ____A C:\Users\jörg\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-04 20:32 - 2011-07-30 21:00 - 00000000 ____D C:\users\jörg
2013-06-04 20:30 - 2012-09-05 18:23 - 00000000 ____D C:\Users\jörg\AppData\Roaming\Audacity
2013-06-04 20:30 - 2012-01-14 17:51 - 00000000 ____D C:\Users\jörg\AppData\Roaming\vlc
2013-06-04 20:30 - 2011-08-27 15:16 - 00000000 ____D C:\Program Files (x86)\gs
2013-06-04 20:30 - 2011-07-29 21:03 - 00000000 ____D C:\Program Files (x86)\FreePDF_XP
2013-06-04 20:30 - 2011-07-28 22:25 - 00000000 ____D C:\users\admin
2013-06-04 20:30 - 2011-04-19 14:26 - 00000000 ____D C:\ProgramData\Norton
2013-06-04 20:30 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-06-04 20:28 - 2013-05-08 15:25 - 00000000 ____D C:\ProgramData\Ask
2013-06-04 20:28 - 2012-01-01 15:53 - 00000000 ____D C:\Users\jörg\AppData\Roaming\Orbit
2013-06-04 20:14 - 2011-08-28 10:51 - 00000000 ____D C:\Users\admin\AppData\Local\FreePDF_XP
2013-06-04 20:12 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-06-04 19:40 - 2013-06-04 19:40 - 00000000 ____D C:\Users\jörg\AppData\Local\{3C44CF72-A437-41AE-AFC5-C9EC1DF8556D}
2013-06-04 17:13 - 2013-06-04 17:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{BD654D46-DA3D-439F-9F7C-6EE6485BDE83}
2013-06-03 14:15 - 2013-06-03 14:15 - 00000000 ____D C:\Users\Manu\AppData\Local\{80A46B06-9E39-4984-802A-96CBCF0E00E4}
2013-06-02 21:45 - 2013-06-02 21:45 - 00000000 ____D C:\Users\jörg\AppData\Local\{9C36CA55-8318-41D5-860F-7056DC52E4B6}
2013-06-02 21:29 - 2013-06-02 19:16 - 00019764 ____A C:\Users\jörg\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil.aup
2013-06-02 19:16 - 2013-06-02 19:16 - 00000000 ____D C:\Users\jörg\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil_data
2013-06-02 11:17 - 2013-06-02 11:17 - 00000000 ____D C:\Users\Manu\AppData\Local\{9DDD6CF3-BA43-42BE-B0C0-593440A39EC4}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-22 18:59

==================== End Of Log ============================
--- --- ---

--- --- ---


Wann ist comofix fertig ??? Wo ist das logfile ???

schrauber 02.07.2013 07:10
Liest Du auch die Anleitungen? ;)

Da steht wo das Logfile zu finden ist, unter C:\Combofix.txt :)

Indexation 02.07.2013 18:25
Gibt kein Textfile unter C - :heulen:
es hat aber ein Datei ComboFix angelegt mit dem Computersymbol
wenn ich die öffne sehe ich nochmal alle Laufwerke ????
Soll ich combofix nochmal starten -habe das Gefühl es ist nicht richtig gelaufen da es bei dem löschen hängengeblieben ist - oder ist das normal ??

schrauber 02.07.2013 18:49
wie besprochen :)

Indexation 02.07.2013 21:28
Hier nun das LogFile :-)

Fehler ist aber noch nicht weg -habe allerdings noch keinen Neustart geacht ....
Mach ich nachher noch

schrauber 03.07.2013 08:07
Logs bitte immer in den Thread posten.

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST Log bitte.

Indexation 03.07.2013 18:48
Huiiiiiii der Fehler is nach Neustart wech :taenzer:

Heissen Dank an "Schrauber" :party:

Ich werde dich wärmstens weiterempfehlen -
Was war das denn nun ? Kannst du das an den Logfiles erkennen ?

...und vor allem -> warum hat Norton versagt :twak: (Virensignaturen sind aktuell .....
auch Spybot + Defender haben das Ding nicht geknackt ....

Habe gehört das Kaspersky eh besser ist - stimmt das ?
.... obwohl - Kaspersky hat das Ding auch nicht wegbekommen


Nochmals vielen Dank :abklatsch:

schrauber 03.07.2013 18:52
Adware und so Kram. den Rest bitte auch noch machen, wir sind noch nit fertig :)

Indexation 03.07.2013 19:00
Habe es schon geshen - ich lege los ;

Indexation 03.07.2013 19:26
Logfile von Adw-Cleaner

Indexation 03.07.2013 19:47
Logfile von JRT

Indexation 03.07.2013 19:58
Logfiles von FRST

Indexation 03.07.2013 19:59
Nu bin aber mal gespannt :pfeiff:

schrauber 03.07.2013 20:42
Zitat:
Logs bitte immer in den Thread posten.
;)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

Indexation 07.07.2013 14:33
Logfile adw cleaner :
Code:
# AdwCleaner v2.304 - Datei am 03/07/2013 um 20:14:05 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : admin - HOME
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\admin\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\user.js
Datei Gelöscht : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\searchplugins\Search_Results.xml
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\Freeware.de
Ordner Gelöscht : C:\Program Files (x86)\Ilivid
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\RewardsArcadeSuite
Ordner Gelöscht : C:\Program Files (x86)\Softonic
Ordner Gelöscht : C:\Program Files (x86)\WiseConvert_1.3
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\ProgramData\IBUpdaterService
Ordner Gelöscht : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Ordner Gelöscht : C:\Users\admin\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\admin\AppData\Local\RewardsArcadeSuite
Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\Freeware.de
Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\searchresultstb
Ordner Gelöscht : C:\Users\admin\AppData\LocalLow\WiseConvert_1.3
Ordner Gelöscht : C:\Users\admin\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\extensions\ffxtlbr@babylon.com
Ordner Gelöscht : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\extensions\specialsavings@superfish.com
Ordner Gelöscht : C:\Users\admin\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\JD\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\JD\AppData\LocalLow\Freeware.de
Ordner Gelöscht : C:\Users\JD\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\JD\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\JD\AppData\LocalLow\WiseConvert_1.3
Ordner Gelöscht : C:\Users\jörg\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\jörg\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\jörg\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\jörg\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\jörg\AppData\LocalLow\Freeware.de
Ordner Gelöscht : C:\Users\jörg\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\jörg\AppData\LocalLow\WiseConvert_1.3
Ordner Gelöscht : C:\Users\jörg\AppData\Roaming\Iminent
Ordner Gelöscht : C:\Users\Manu\AppData\Roaming\Iminent

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Freeware.de
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\WiseConvert_1.3
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C6565F37-655B-4C9E-AA5F-0307AC976ED4}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B6EF6C45-5E8D-4C3B-B580-A5073261A381}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B6EF6C45-5E8D-4C3B-B580-A5073261A381}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0388404D-6072-4CEB-B521-8F090FEAEE57}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\Software\AedgePerformanceBCN
Schlüssel Gelöscht : HKLM\Software\BabylonToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{21493C1F-D071-496A-9C27-450578888291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{55C1727F-5535-4C2A-9601-8C2458608B48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{A7DDCBDE-5C86-415C-8A37-763AE183E7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\DiscoveryHelper.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GIFAnimator.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\IMTrProgress.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\IMWeb.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WMHelper.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Applications\ilividsetupv1.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DiscoveryHelper.iMesh6Discovery.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\imweb.imwebcontrol
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2736476
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2776682
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT3242337
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{252C2315-CCE0-4446-8DA7-C00292A690BA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{403A885F-CB00-40C1-BDC1-EB09053194F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Freeware.de
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\datamngrUI_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\iLividSetupV1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IminentSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SearchquMediaBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SetupDataMngr_Searchqu_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\softonic_ggl_1_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{50BA0FF5-8CF4-4A36-8DF0-BDA26616252F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{872F3C0B-4462-424C-BB9F-74C6899B9F92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\Software\SearchquSRTB
Schlüssel Gelöscht : HKLM\Software\Softonic
Schlüssel Gelöscht : HKLM\Software\WiseConvert_1.3
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{2656B92B-0207-4AFB-BEBF-F5FD231ECD39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{412CD209-DDA4-4275-8C79-55F1C93FBD47}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{50BA0FF5-8CF4-4A36-8DF0-BDA26616252F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{59570C1F-B692-48C9-91B4-7809E6945287}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5EB0259D-AB79-4AE6-A6E6-24FFE21C3DA4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{63A0F7FA-2C95-4D7E-AF25-EFCC303D20A1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6559E502-6EE1-46B8-A83C-F3A45BDA23EE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{99079A25-328F-4BD4-BE04-00955ACAA0A7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A2858A72-758F-4486-B6A1-7F1DCC0924FA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B6EF6C45-5E8D-4C3B-B580-A5073261A381}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B6F8DA9F-2696-419E-A8A3-19BE41EF51BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C63CA8A4-AB4E-49E5-A6C0-33FC86D80205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C6A7847E-8931-4A9A-B4EF-72A91E3CCF4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D51392A5-3A08-41E6-AC05-C3B0FB94C41B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DD0F1D24-E250-4E93-966C-65615720AEFB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EC1277BB-1C71-4C0D-BA6D-BFEA16E773A6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3EC1A45C-8BC3-4BFE-B226-4051C5D3D068}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5978BD2B-F737-48AC-BE63-22A2CA9954C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9D67626-DB80-4D45-8E03-BBDC51B826A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{213C8ED6-1D78-4D8F-8729-25006AA86A76}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E111A5C-3D11-4F56-9463-5310C3C69025}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6EF6C45-5E8D-4C3B-B580-A5073261A381}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Freeware.de Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\WiseConvert_1.3 Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2BEF239C-752E-4001-8048-F256E0D8CD93}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5E8CD073-21DF-4117-9BBD-D03C45D36CAE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2413}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [specialsavings@superfish.com]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{213C8ED6-1D78-4D8F-8729-25006AA86A76}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{5018CFD2-804D-4C99-9F81-25EAEA2769DE}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{7E111A5C-3D11-4F56-9463-5310C3C69025}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16490

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v10.0.2 (de)

Datei : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\prefs.js

C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\user.js ... Gelöscht !

Gelöscht : user_pref("browser.search.defaultenginename", "Search Results");
Gelöscht : user_pref("browser.search.order.1", "Search Results");
Gelöscht : user_pref("browser.search.selectedEngine", "Search Results");
Gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Gelöscht : user_pref("extensions.BabylonToolbar.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar.babTrack", "affID=101587&tt=3012_1");
Gelöscht : user_pref("extensions.BabylonToolbar.babext", "babExt");
Gelöscht : user_pref("extensions.BabylonToolbar.babtrack", "babTrack");
Gelöscht : user_pref("extensions.BabylonToolbar.bbdpng", 1);
Gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltlng", "de");
Gelöscht : user_pref("extensions.BabylonToolbar.dfltsrch", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.envrmnt", "production");
Gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Gelöscht : user_pref("extensions.BabylonToolbar.firstrun", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "E7CAFD14C2EAED764E980282341F11E2");
Gelöscht : user_pref("extensions.BabylonToolbar.hmpg", false);
Gelöscht : user_pref("extensions.BabylonToolbar.hrdid", "bcde545000000000000018f46ad5266c");
Gelöscht : user_pref("extensions.BabylonToolbar.id", "bcde545000000000000018f46ad5266c");
Gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15550");
Gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.instlday", "15550");
Gelöscht : user_pref("extensions.BabylonToolbar.instlref", "sst");
Gelöscht : user_pref("extensions.BabylonToolbar.isdcmntcmplt", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.keywordurl", "");
Gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.5.29.119:20:50");
Gelöscht : user_pref("extensions.BabylonToolbar.lastdp", 1);
Gelöscht : user_pref("extensions.BabylonToolbar.mntrvrsn", "1.3.0");
Gelöscht : user_pref("extensions.BabylonToolbar.newTab", false);
Gelöscht : user_pref("extensions.BabylonToolbar.newtab", "false");
Gelöscht : user_pref("extensions.BabylonToolbar.newtaburl", "");
Gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.prtnrid", "babylon");
Gelöscht : user_pref("extensions.BabylonToolbar.savedVrsnTs", "1");
Gelöscht : user_pref("extensions.BabylonToolbar.sg", "azb");
Gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "azb");
Gelöscht : user_pref("extensions.BabylonToolbar.smplgrp", "azb");
Gelöscht : user_pref("extensions.BabylonToolbar.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.srcext", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar.srch", "");
Gelöscht : user_pref("extensions.BabylonToolbar.srchprvdr", "");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrid", "base");
Gelöscht : user_pref("extensions.BabylonToolbar.tlbrsrchurl", "hxxp://www.google.com/search?babsrc=TB_ggl&q=");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnTs", "1.5.29.119:20:50");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.5.29.1");
Gelöscht : user_pref("extensions.BabylonToolbar.vrsnts", "1.5.29.119:20:50");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=101587&tt=3012_1");
Gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.5.29.119:20:50");
Gelöscht : user_pref("extensions.enabledAddons", "ffxtlbr%40babylon.com:1.5.0,%7B972ce4c6-7e08-4474-a285-320819[...]
Gelöscht : user_pref("keyword.URL", "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=bcde545000000000000018f46ad[...]

Datei : C:\Users\Manu\AppData\Roaming\Mozilla\Firefox\Profiles\pea0rt3t.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\jörg\AppData\Roaming\Mozilla\Firefox\Profiles\ybngdu0g.default\prefs.js

[OK] Die Datei ist sauber.

Datei : C:\Users\JD\AppData\Roaming\Mozilla\Firefox\Profiles\ezn4fbq5.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\Manu\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\jörg\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

Datei : C:\Users\JD\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [36174 octets] - [03/07/2013 20:14:05]

########## EOF - C:\AdwCleaner[S1].txt - [36235 octets] ##########
Logfile JRT
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by admin on 03.07.2013 at 20:28:57,04
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\performersoft llc
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B49ED955-277E-438A-9199-D02FF81A91EA}



~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\shoC594.tmp
Successfully deleted: [File] C:\Windows\prefetch\APNSTUB.EXE-BA03F220.pf



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\admin\appdata\local\{07B45CD6-37CA-44BB-9C2F-D2E669E81D58}
Successfully deleted: [Empty Folder] C:\Users\admin\appdata\local\{4D8F9980-499A-4B5B-BB06-A13B97B1393F}
Successfully deleted: [Empty Folder] C:\Users\admin\appdata\local\{667CD7D9-2D17-418D-9782-44C5A482F4C7}



~~~ Chrome

Successfully deleted: [Folder] C:\Users\admin\appdata\local\Google\Chrome\User Data\Default\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Successfully deleted: [Folder] C:\Users\admin\appdata\local\Google\Chrome\User Data\Default\Extensions\ielefkgbofdpglioecfjcbikholflklb
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\ielefkgbofdpglioecfjcbikholflklb



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.07.2013 at 20:33:59,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Indexation 07.07.2013 14:37
Logfile FRST :

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-07-2013 02
Ran by admin (administrator) on 03-07-2013 20:53:35
Running from C:\Users\admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Adobe Systems Incorporated) c:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Orbitdownloader.com) C:\Program Files (x86)\Orbitdownloader\orbitdm.exe
(Orbitdownloader.com) C:\Program Files (x86)\Orbitdownloader\orbitnet.exe
(Farbar) C:\Users\admin\Desktop\FRST64 (2).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [iTunesHelper] "D:\I tunes\iTunesHelper.exe" [x]
HKU\JD\...\Run: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-07-29] (Google Inc.)
HKU\jörg\...\Run: [EPSON Stylus SX200 Series] C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Windows\TEMP\E_S5BF5.tmp" /EF "HKCU" [x] <===== ATTENTION
HKU\jörg\...\Run: [Copernic Desktop Search - Home] "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
HKU\jörg\...\Run: [Norton Download Manager{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}] C:\Users\Public\Downloads\Norton\{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}\NBRT-Retail-Downloader.exe /m [x]
HKU\jörg\...\Winlogon: [Shell] cmd.exe [345088 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\jörg\...\Command Processor:  <===== ATTENTION!
HKU\Manu\...\Run: [Copernic Desktop Search - Home] "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)
Startup: C:\Users\jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zahlungserinnerung.lnk
ShortcutTarget: Zahlungserinnerung.lnk -> D:\Profi cash\wzed.exe ()
Startup: C:\Users\Manu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> D:\open office\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/#output=search&sclient=psy-ab&q=test&oq=test&gs_l=hp.12..0l4.9000.9329.0.11166.4.4.0.0.0.0.88.276.4.4.0...0.0...1c.1.18.psy-ab.H4SAn_fWiPk&pbx=1&bav=on.2,or.r_qf.&bvm=bv.48572450,d.Yms&fp=ca1c41bc59b1d6d5&biw=1230&bih=534
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
BHO-x32: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Handler: ipp - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler-x32: ipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default
FF Homepage: hxxp://www.bing.com/?cc=de
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: No Name - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\Extensions\{35379F86-8CCB-4724-AE33-4278DE266C70}
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\
FF Extension: Symantec Intrusion Prevention - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn_2011_7_13_2
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\I tunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
S2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\18.7.2.3\ccSvcHst.exe [130008 2011-04-17] (Symantec Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

R0 07623136; C:\Windows\System32\DRIVERS\07623136.sys [460888 2013-05-13] (Kaspersky Lab ZAO)
R0 62611638; C:\Windows\System32\DRIVERS\62611638.sys [460888 2013-07-01] (Kaspersky Lab ZAO)
R0 99245666; C:\Windows\System32\DRIVERS\99245666.sys [460888 2013-06-22] (Kaspersky Lab ZAO)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130702.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130702.001\BHDrvx64.sys [1393240 2013-05-31] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-12-12] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-12-12] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-06-04] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130702.001\IDSvia64.sys [513184 2013-06-01] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130702.001\IDSvia64.sys [513184 2013-06-01] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\ENG64.SYS [126040 2013-06-04] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\ENG64.SYS [126040 2013-06-04] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\EX64.SYS [2098776 2013-06-04] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\EX64.SYS [2098776 2013-06-04] (Symantec Corporation)
R3 SRTSP; C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS [744568 2011-03-31] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS [40568 2011-03-31] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS [912504 2011-03-15] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2011-07-28] (Symantec Corporation)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [43640 2011-03-31] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS [171128 2011-01-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS [386168 2011-04-21] (Symantec Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

========================== Drivers MD5 =======================

C:\Windows\System32\DRIVERS\07623136.sys E656FE10D6D27794AFA08136685A69E8
C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\62611638.sys E656FE10D6D27794AFA08136685A69E8
C:\Windows\System32\DRIVERS\99245666.sys E656FE10D6D27794AFA08136685A69E8
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\drivers\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\adpu320.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\Afc.sys 6CCD1135320109D6B219F1A6E04AD9F6
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdk8.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\atikmdag.sys 7F0282DFDFFDBC30256B26B3F5566AE2
C:\Windows\System32\DRIVERS\atikmpag.sys 4CF78B1EE8A27740E6F4D50209AE5640
C:\Windows\system32\drivers\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\drivers\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\drivers\arc.sys ==> MD5 is legit
C:\Windows\system32\drivers\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athrx.sys C8679A07267F030704168E45E27C3D43
C:\Windows\system32\drivers\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130702.001\BHDrvx64.sys 6E10DB69DB1AA96207F4B14B18FF12F8
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20130702.001\BHDrvx64.sys 6E10DB69DB1AA96207F4B14B18FF12F8
C:\Windows\system32\drivers\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\drivers\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bridge.sys 5C2F352A4E961D72518261257AAE204B
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\drivers\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdrom.sys ==> MD5 is legit
C:\Windows\system32\drivers\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\system32\drivers\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys AAFCB52FE0037207FB6FBEA070D25EFE
C:\Windows\System32\drivers\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\drivers\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\system32\drivers\evbda.sys ==> MD5 is legit
C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 4353FF94D47A0A9D52B89ECCF0CDB013
C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys 4353FF94D47A0A9D52B89ECCF0CDB013
C:\Windows\system32\drivers\elxstor.sys ==> MD5 is legit
C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys C5BCCB378D0A896304A3E71BE7215983
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\drivers\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\drivers\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\drivers\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys 8E98D21EE06192492A5671A6144D092F
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\System32\drivers\HdAudio.sys 975761C778E33CD22498059B91E7373A
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\drivers\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidbth.sys ==> MD5 is legit
C:\Windows\system32\drivers\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\drivers\iaStor.sys D469B77687E12FE43E344806740B624D
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130702.001\IDSvia64.sys A48928D4CCA6F8B731989DB08CF2C0AB
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20130702.001\IDSvia64.sys A48928D4CCA6F8B731989DB08CF2C0AB
C:\Windows\system32\drivers\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHD64.sys B60ACCD29F8FAFC4A6344CD2BD5CA3A5
C:\Windows\System32\DRIVERS\IntcDAud.sys FC727061C0F47C8059E88E05D5C8E381
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\igdpmd64.sys 795C99DC4F574C97C03D0BB39CF099EE
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 7EFB9333E4ECCE6AE4AE9D777D9E553E
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys 0E154DA6CA9105354A07D0C576804037
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\drivers\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\drivers\megasas.sys ==> MD5 is legit
C:\Windows\system32\drivers\MegaSR.sys ==> MD5 is legit
C:\Windows\system32\drivers\HECIx64.sys A6518DCC42F7A6E999BB3BEA8FD87567
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\drivers\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\ENG64.SYS 56540E526B46E379A476FB5BC381B290
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\ENG64.SYS 56540E526B46E379A476FB5BC381B290
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\EX64.SYS 8A19D3991F9F14B885CDE8BC640F6B68
C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\VirusDefs\20130703.002\EX64.SYS 8A19D3991F9F14B885CDE8BC640F6B68
C:\Windows\System32\DRIVERS\NBVol.sys DACA803A8D732FE5EEAA024EC342F81D
C:\Windows\System32\DRIVERS\NBVolUp.sys 6208F622E9E35860DFB0753DFF56F0C0
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\drivers\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\system32\drivers\NTIDrvr.sys 64DDD0DEE976302F4BD93E5EFCC2F013
C:\Windows\system32\drivers\NTIDrvr.sys 64DDD0DEE976302F4BD93E5EFCC2F013
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\drivers\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\drivers\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\drivers\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PxHlpa64.sys 87B04878A6D59D6C79251DC960C674C1
C:\Windows\system32\drivers\ql2300.sys ==> MD5 is legit
C:\Windows\system32\drivers\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\drivers\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpvideominiport.sys 313F68E1A3E6345A4F47A36B07062F34
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 9BEB5F18A418FF70659CE2E356829568
C:\Windows\System32\drivers\RTL2832UBDA.sys 9F4C2C528085F06C35E8D84B938FA2DA
C:\Windows\System32\Drivers\RTL2832UUSB.sys 84EBAC411A3C54B216CC24EB84E19584
C:\Windows\System32\DRIVERS\RTL2832U_IRHID.sys C24DF587D59345FCA718FE550EB036D7
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\serenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\serial.sys ==> MD5 is legit
C:\Windows\system32\drivers\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\drivers\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys C6CC9297BD53E5229653303E556AA539
C:\Windows\System32\DRIVERS\Sftplaylh.sys 390AA7BC52CEE43F6790CDEA1E776703
C:\Windows\System32\DRIVERS\Sftredirlh.sys 617E29A0B0A2807466560D4C4E338D3E
C:\Windows\System32\DRIVERS\Sftvollh.sys 8F571F016FA1976F445147E9E6C8AE9B
C:\Windows\system32\drivers\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NISx64\1207020.003\SRTSP64.SYS 90EF30C3867BCDE4579C01A6D6E75A7A
C:\Windows\system32\drivers\NISx64\1207020.003\SRTSPX64.SYS C513E8A5E7978DA49077F5484344EE1B
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\drivers\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\drivers\NISx64\1207020.003\SYMDS64.SYS 6160145C7A87FC7672E8E3B886888176
C:\Windows\System32\drivers\NISx64\1207020.003\SYMEFA64.SYS 96AEED40D4D3521568B42027687E69E0
C:\Windows\system32\Drivers\SYMEVENT64x86.SYS 21A1C2D694C3CF962D31F5E873AB3D6F
C:\Windows\System32\DRIVERS\SymIMv.sys 3AA3B2DF451DA88C38AB00B19FA3562E
C:\Windows\system32\drivers\NISx64\1207020.003\Ironx64.SYS BD0D711D8CBFCAA19CA123306EAF53A5
C:\Windows\System32\Drivers\NISx64\1207020.003\SYMNETS.SYS A6ADB3D83023F8DAA0F7B6FDA785D83B
C:\Windows\System32\DRIVERS\SynTP.sys EF51B22706DB03F0857FADE127C804EC
C:\Windows\System32\drivers\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\DRIVERS\tcpip.sys 9849EA3843A2ADBDD1497E97A85D8CAE
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys 17C6B51CBCCDED95B3CC14E22791F85E
C:\Windows\system32\drivers\TsUsbGD.sys AD64450A4ABE076F5CB34CC08EEACB07
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\drivers\uagp35.sys ==> MD5 is legit
C:\Windows\system32\drivers\UBHelper.sys 2E22C1FD397A5A9FFEF55E9D1FC96C00
C:\Windows\system32\drivers\UBHelper.sys 2E22C1FD397A5A9FFEF55E9D1FC96C00
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\umbus.sys ==> MD5 is legit
C:\Windows\system32\drivers\umpass.sys ==> MD5 is legit
C:\Windows\System32\Drivers\usbaapl64.sys C9E9D59C0099A9FF51697E9306A44240
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbscan.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\drivers\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\drivers\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys FE88B288356E7B47B74B13372ADD906D
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-03 20:54 - 2013-07-03 20:54 - 00000000 ____D C:\Users\admin\Desktop\Erstdatein
2013-07-03 20:51 - 2013-07-03 20:52 - 00000093 ____A C:\Users\admin\Desktop\Ablauf.txt
2013-07-03 20:50 - 2013-07-03 20:50 - 01934082 ____A (Farbar) C:\Users\admin\Downloads\FRST64 (1).exe
2013-07-03 20:48 - 2013-07-03 20:48 - 01934082 ____A (Farbar) C:\Users\admin\Desktop\FRST64 (2).exe
2013-07-03 20:45 - 2013-07-03 20:45 - 00000780 ____A C:\Users\admin\Desktop\JRT.7z
2013-07-03 20:34 - 2013-07-03 20:33 - 00001731 ____A C:\Users\admin\Desktop\JRT.txt
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\JRT
2013-07-03 20:27 - 2013-07-03 20:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\admin\Desktop\JRT.exe
2013-07-03 20:23 - 2013-07-03 20:23 - 00005748 ____A C:\Users\admin\Desktop\AdwCleaner[S1].7z
2013-07-03 20:22 - 2013-07-03 20:22 - 00036163 ____A C:\Users\admin\Desktop\AdwCleaner[S1].txt
2013-07-03 20:14 - 2013-07-03 20:14 - 00036163 ____A C:\AdwCleaner[S1].txt
2013-07-03 20:09 - 2013-07-03 20:09 - 00650027 ____A C:\Users\admin\Desktop\adwcleaner.exe
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-03 16:32 - 2013-07-03 16:33 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 22:19 - 2013-07-02 22:19 - 00007139 ____A C:\Users\admin\Desktop\Combofix.7z
2013-07-02 21:10 - 2013-07-02 21:10 - 00029418 ____A C:\Users\admin\Desktop\Combofix.txt
2013-07-02 20:24 - 2013-07-02 20:24 - 00029418 ____A C:\ComboFix.txt
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:13 - 2013-07-01 21:38 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:13 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-01 21:13 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-01 21:13 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-01 21:13 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-01 21:13 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-01 21:13 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-01 21:13 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-01 21:13 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-01 21:11 - 2013-07-02 20:24 - 00000000 ____D C:\Qoobox
2013-07-01 21:11 - 2013-07-02 20:19 - 00000000 ____D C:\Windows\erdnt
2013-07-01 21:09 - 2013-07-01 21:05 - 05084517 ____R (Swearware) C:\Users\admin\Desktop\ComboFix.exe
2013-07-01 21:05 - 2013-07-01 21:05 - 05084517 ____A (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2013-07-01 20:10 - 2013-07-01 20:10 - 00061046 ____A C:\Users\admin\Desktop\FRST1.txt
2013-07-01 20:10 - 2013-07-01 20:10 - 00031109 ____A C:\Users\admin\Desktop\Addition1.txt
2013-07-01 20:07 - 2013-07-01 20:07 - 00000000 ____D C:\FRST
2013-07-01 20:06 - 2013-07-01 20:05 - 01933776 ____A (Farbar) C:\Users\admin\Desktop\FRST64(1).exe
2013-07-01 20:04 - 2013-07-01 20:05 - 01933776 ____A (Farbar) C:\Users\admin\Downloads\FRST64.exe
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:49 - 2013-07-01 18:49 - 00008764 ____A C:\Users\Manu\Desktop\favoriten.htm
2013-07-01 18:48 - 2013-07-01 18:48 - 00000000 ____A C:\Users\Manu\Desktop\lesezeichen.html
2013-07-01 18:47 - 2013-07-01 18:47 - 00008764 ____A C:\Users\Manu\Desktop\bookmark.htm
2013-07-01 18:06 - 2013-07-01 18:13 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\62611638.sys
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:31 - 2013-06-22 16:02 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\99245666.sys
2013-06-30 19:13 - 2013-06-30 19:14 - 00000000 ____D C:\Users\JD\Desktop\Tai Chi
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:40 - 2013-06-30 16:47 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-06-30 18:47 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:03 - 2013-06-29 16:03 - 00156028 ____A C:\Users\JD\Desktop\libmp3lame-win-3.97.zip
2013-06-29 16:02 - 2013-07-03 20:10 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 15:57 - 2013-06-30 18:40 - 00019086 ____A C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil.aup
2013-06-29 15:57 - 2013-06-29 15:57 - 00000000 ____D C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil_data
2013-06-29 15:57 - 2013-06-04 20:36 - 00001609 ____A C:\Users\JD\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-29 15:57 - 2013-03-24 21:33 - 35210877 ____A C:\Users\JD\Desktop\0004.mp4
2013-06-29 15:57 - 2013-03-24 17:51 - 71403622 ____A C:\Users\JD\Desktop\0001.mp4
2013-06-29 15:57 - 2013-03-10 13:26 - 00001333 ____A C:\Users\JD\Desktop\IMG_3288.JPG - Verknüpfung.lnk
2013-06-29 15:57 - 2013-03-03 23:43 - 00001494 ____A C:\Users\JD\Desktop\Photoshop.lnk
2013-06-29 15:57 - 2012-09-05 20:27 - 00001109 ____A C:\Users\JD\Desktop\audacity..lnk
2013-06-29 15:57 - 2012-07-29 19:19 - 00001154 ____A C:\Users\JD\Desktop\FreeVideoPerformer.lnk
2013-06-29 15:57 - 2012-03-22 22:05 - 00000855 ____A C:\Users\JD\Desktop\TotalMedia.lnk
2013-06-29 15:57 - 2012-01-04 17:46 - 00001010 ____A C:\Users\JD\Desktop\Teamviewer.lnk
2013-06-29 15:57 - 2011-11-08 20:32 - 00000541 ____A C:\Users\JD\Desktop\Profi cash.lnk
2013-06-29 15:57 - 2011-07-30 22:45 - 00000967 ____A C:\Users\JD\Desktop\WORD.lnk
2013-06-29 15:57 - 2011-07-30 22:41 - 00000975 ____A C:\Users\JD\Desktop\EXCEL -.lnk
2013-06-29 15:57 - 2011-07-30 21:08 - 00000355 ____A C:\Users\JD\Desktop\home.lnk
2013-06-29 15:57 - 2011-04-19 13:21 - 00001272 ____A C:\Users\JD\Desktop\Snipping Tool.lnk
2013-06-29 15:57 - 2010-10-26 13:22 - 05661184 ____A (Digiarty Software, Inc.) C:\Users\JD\Desktop\WinX_Free_FLV_to_MP4_Converter.exe
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 19:16 - 2013-06-26 19:16 - 00013304 ____A C:\Users\JD\Desktop\SnippingTool - Verknüpfung.lnk
2013-06-26 19:11 - 2013-06-26 19:12 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 ____A C:\Users\JD\Sti_Trace.log
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 ____A C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:47 - 2013-06-29 15:27 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:19 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-23 13:19 - 2013-06-30 16:21 - 00000000 ____D C:\users\JD
2013-06-23 13:19 - 2013-06-28 18:25 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-23 13:19 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 13:19 - 2013-06-23 13:26 - 00002267 ____A C:\Users\JD\Desktop\Google Chrome.lnk
2013-06-23 13:19 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00073384 ____A C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-23 13:19 - 2011-04-19 14:30 - 00000000 ____D C:\Users\JD\AppData\Local\Cyberlink
2013-06-23 13:19 - 2011-04-19 14:25 - 00000000 ____D C:\Users\JD\AppData\Roaming\Macromedia
2013-06-23 13:19 - 2011-04-19 13:33 - 00000000 ____D C:\Users\JD\AppData\Roaming\Intel Corporation
2013-06-23 13:19 - 2011-04-19 13:31 - 00000000 ____D C:\Users\JD\AppData\Roaming\InstallShield
2013-06-23 13:19 - 2010-11-21 04:50 - 00000020 ___SH C:\Users\JD\ntuser.ini
2013-06-22 15:56 - 2013-06-22 15:56 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-22 15:56 - 2013-06-22 15:56 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:55 - 2013-06-20 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 ____A (SurfRight B.V.) C:\Users\admin\Downloads\hitmanpro_x64.exe
2013-06-18 22:34 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 22:32 - 2013-05-13 16:56 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\07623136.sys
2013-06-18 22:02 - 2013-06-18 22:02 - 01084684 ____A C:\Users\jörg\AppData\Roaming\2433f433
2013-06-18 22:02 - 2013-06-18 22:02 - 01084669 ____A C:\Users\jörg\AppData\Local\2433f433
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}
2013-06-14 15:25 - 2013-06-14 15:25 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-14 14:56 - 2013-06-14 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{99EE7253-67B4-4F61-A8BC-9177B9312D33}
2013-06-13 16:44 - 2013-05-17 05:02 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-13 16:44 - 2013-05-17 05:00 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-13 16:44 - 2013-05-17 04:56 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-13 16:44 - 2013-05-17 04:51 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-13 16:44 - 2013-05-17 04:51 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-13 16:44 - 2013-05-17 04:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-13 16:44 - 2013-05-17 00:28 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-13 16:44 - 2013-05-17 00:26 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-13 16:44 - 2013-05-17 00:21 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-13 16:44 - 2013-05-17 00:20 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-13 16:44 - 2013-05-17 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-13 16:44 - 2013-05-17 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-13 16:44 - 2013-05-17 00:12 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-13 16:43 - 2013-05-17 06:05 - 17824768 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-13 16:43 - 2013-05-17 05:27 - 10926080 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-13 16:43 - 2013-05-17 05:09 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-13 16:43 - 2013-05-17 05:02 - 01346560 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-13 16:43 - 2013-05-17 05:01 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-13 16:43 - 2013-05-17 04:58 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-13 16:43 - 2013-05-17 04:56 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-13 16:43 - 2013-05-17 04:55 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-13 16:43 - 2013-05-17 04:54 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-13 16:43 - 2013-05-17 04:53 - 02147840 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-13 16:43 - 2013-05-17 01:08 - 12329984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-13 16:43 - 2013-05-17 00:49 - 09738752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-13 16:43 - 2013-05-17 00:39 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-13 16:43 - 2013-05-17 00:28 - 01104384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-13 16:43 - 2013-05-17 00:27 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-13 16:43 - 2013-05-17 00:23 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-13 16:43 - 2013-05-17 00:21 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-13 16:43 - 2013-05-17 00:19 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-13 16:43 - 2013-05-17 00:17 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-13 16:16 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 16:16 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 16:16 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 16:16 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 16:16 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-13 16:16 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-13 16:16 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-13 16:16 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 16:16 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-13 16:16 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-13 16:14 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 16:14 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-13 16:14 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 16:14 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 16:14 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-13 16:06 - 2013-06-13 16:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{44E2793B-6AD0-41D5-B25A-69DFDE532F57}
2013-06-11 14:53 - 2013-06-11 14:53 - 00000000 ____D C:\Users\Manu\AppData\Local\{A0821F0E-E78A-4601-B328-5A5F35668781}
2013-06-10 20:44 - 2013-06-10 20:44 - 00000000 ____D C:\Users\jörg\AppData\Local\{7563DCB8-3CAB-493E-A1E5-3BFAA1192631}
2013-06-09 19:30 - 2013-06-09 19:30 - 00000000 ____D C:\Users\Manu\AppData\Local\{FEC6F72C-007B-4073-A665-3FDE103D2FAE}
2013-06-08 09:48 - 2013-06-08 09:48 - 00000000 ____D C:\Users\Manu\AppData\Local\{C463F1D9-FD8A-47BF-8DC5-44B3DFA22AB7}
2013-06-07 16:04 - 2013-06-07 16:04 - 00000000 ____D C:\Users\Manu\AppData\Local\{377F3E1B-52C1-418A-A5B0-397F38965AE9}
2013-06-06 18:43 - 2013-06-06 18:43 - 00000000 ____D C:\Users\jörg\AppData\Local\{65138475-27C5-448E-BCB3-4A88B43B1F56}
2013-06-06 16:14 - 2013-06-06 16:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{C5CCD79F-D5C9-408F-A647-387609FE459E}
2013-06-05 16:38 - 2013-06-05 16:38 - 00000000 ____D C:\Users\Manu\AppData\Local\{2630AFAC-26F1-4E03-86ED-E810169F8E2B}
2013-06-04 20:41 - 2013-06-04 20:41 - 00000000 ____D C:\Users\jörg\AppData\Local\{C3C906FE-0FE4-43D6-96B6-5937D326E06F}
2013-06-04 20:36 - 2013-06-04 20:36 - 00001609 ____A C:\Users\jörg\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-04 19:40 - 2013-06-04 19:40 - 00000000 ____D C:\Users\jörg\AppData\Local\{3C44CF72-A437-41AE-AFC5-C9EC1DF8556D}
2013-06-04 17:13 - 2013-06-04 17:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{BD654D46-DA3D-439F-9F7C-6EE6485BDE83}
2013-06-03 14:15 - 2013-06-03 14:15 - 00000000 ____D C:\Users\Manu\AppData\Local\{80A46B06-9E39-4984-802A-96CBCF0E00E4}

==================== One Month Modified Files and Folders =======

2013-07-03 20:54 - 2013-07-03 20:54 - 00000000 ____D C:\Users\admin\Desktop\Erstdatein
2013-07-03 20:52 - 2013-07-03 20:51 - 00000093 ____A C:\Users\admin\Desktop\Ablauf.txt
2013-07-03 20:50 - 2013-07-03 20:50 - 01934082 ____A (Farbar) C:\Users\admin\Downloads\FRST64 (1).exe
2013-07-03 20:49 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-03 20:48 - 2013-07-03 20:48 - 01934082 ____A (Farbar) C:\Users\admin\Desktop\FRST64 (2).exe
2013-07-03 20:46 - 2011-07-28 03:43 - 01809994 ____A C:\Windows\WindowsUpdate.log
2013-07-03 20:45 - 2013-07-03 20:45 - 00000780 ____A C:\Users\admin\Desktop\JRT.7z
2013-07-03 20:33 - 2013-07-03 20:34 - 00001731 ____A C:\Users\admin\Desktop\JRT.txt
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\JRT
2013-07-03 20:27 - 2013-07-03 20:27 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\admin\Desktop\JRT.exe
2013-07-03 20:25 - 2012-07-18 18:09 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-03 20:23 - 2013-07-03 20:23 - 00005748 ____A C:\Users\admin\Desktop\AdwCleaner[S1].7z
2013-07-03 20:23 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-03 20:23 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-03 20:22 - 2013-07-03 20:22 - 00036163 ____A C:\Users\admin\Desktop\AdwCleaner[S1].txt
2013-07-03 20:21 - 2011-07-29 21:19 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-03 20:16 - 2010-11-21 05:47 - 00134644 ____A C:\Windows\PFRO.log
2013-07-03 20:16 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-03 20:16 - 2009-07-14 06:51 - 00152536 ____A C:\Windows\setupact.log
2013-07-03 20:14 - 2013-07-03 20:14 - 00036163 ____A C:\AdwCleaner[S1].txt
2013-07-03 20:10 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-07-03 20:09 - 2013-07-03 20:09 - 00650027 ____A C:\Users\admin\Desktop\adwcleaner.exe
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-03 17:15 - 2011-07-29 21:19 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-03 16:40 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu\AppData\Local\Adobe
2013-07-03 16:33 - 2013-07-03 16:32 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-03 16:31 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-07-02 22:29 - 2011-08-27 11:21 - 00000000 ____D C:\Users\admin\AppData\Local\Apple Computer
2013-07-02 22:29 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Local\Windows Live
2013-07-02 22:22 - 2011-07-28 13:36 - 00659690 ____A C:\Windows\System32\perfh007.dat
2013-07-02 22:22 - 2011-07-28 13:36 - 00132970 ____A C:\Windows\System32\perfc007.dat
2013-07-02 22:22 - 2009-07-14 07:13 - 01513970 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-02 22:19 - 2013-07-02 22:19 - 00007139 ____A C:\Users\admin\Desktop\Combofix.7z
2013-07-02 21:19 - 2011-07-28 22:26 - 00000000 ____D C:\Users\admin\AppData\Local\VirtualStore
2013-07-02 21:10 - 2013-07-02 21:10 - 00029418 ____A C:\Users\admin\Desktop\Combofix.txt
2013-07-02 20:24 - 2013-07-02 20:24 - 00029418 ____A C:\ComboFix.txt
2013-07-02 20:24 - 2013-07-01 21:11 - 00000000 ____D C:\Qoobox
2013-07-02 20:24 - 2009-07-14 05:20 - 00000000 __RHD C:\users\Default
2013-07-02 20:19 - 2013-07-01 21:11 - 00000000 ____D C:\Windows\erdnt
2013-07-02 20:16 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:38 - 2013-07-01 21:13 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:05 - 2013-07-01 21:09 - 05084517 ____R (Swearware) C:\Users\admin\Desktop\ComboFix.exe
2013-07-01 21:05 - 2013-07-01 21:05 - 05084517 ____A (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2013-07-01 20:10 - 2013-07-01 20:10 - 00061046 ____A C:\Users\admin\Desktop\FRST1.txt
2013-07-01 20:10 - 2013-07-01 20:10 - 00031109 ____A C:\Users\admin\Desktop\Addition1.txt
2013-07-01 20:07 - 2013-07-01 20:07 - 00000000 ____D C:\FRST
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 20:05 - 2013-07-01 20:06 - 01933776 ____A (Farbar) C:\Users\admin\Desktop\FRST64(1).exe
2013-07-01 20:05 - 2013-07-01 20:04 - 01933776 ____A (Farbar) C:\Users\admin\Downloads\FRST64.exe
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-07-01 18:49 - 2013-07-01 18:49 - 00008764 ____A C:\Users\Manu\Desktop\favoriten.htm
2013-07-01 18:48 - 2013-07-01 18:48 - 00000000 ____A C:\Users\Manu\Desktop\lesezeichen.html
2013-07-01 18:47 - 2013-07-01 18:47 - 00008764 ____A C:\Users\Manu\Desktop\bookmark.htm
2013-07-01 18:13 - 2013-07-01 18:06 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\62611638.sys
2013-07-01 17:21 - 2011-07-28 22:54 - 00000000 ____D C:\users\Manu
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:14 - 2013-06-30 19:13 - 00000000 ____D C:\Users\JD\Desktop\Tai Chi
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 18:47 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 18:40 - 2013-06-29 15:57 - 00019086 ____A C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil.aup
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:47 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 16:40 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\users\JD
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:03 - 2013-06-29 16:03 - 00156028 ____A C:\Users\JD\Desktop\libmp3lame-win-3.97.zip
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:57 - 2013-06-29 15:57 - 00000000 ____D C:\Users\JD\Desktop\mp3- Tai Chi Chuan ( Taiji) Traditioneller Yang Stil - 108er Langform 2. Teil_data
2013-06-29 15:27 - 2013-06-23 13:47 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-29 14:39 - 2011-07-29 21:41 - 00000000 ____D C:\Users\Manu\AppData\Local\FreePDF_XP
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 18:25 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-28 13:42 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 19:16 - 2013-06-26 19:16 - 00013304 ____A C:\Users\JD\Desktop\SnippingTool - Verknüpfung.lnk
2013-06-26 19:12 - 2013-06-26 19:11 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-23 22:37 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 20:22 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 19:32 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 ____A C:\Users\JD\Sti_Trace.log
2013-06-23 18:13 - 2011-07-29 20:16 - 00000403 ____A C:\Windows\ODBC.INI
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 ____A C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:26 - 2013-06-23 13:19 - 00002267 ____A C:\Users\JD\Desktop\Google Chrome.lnk
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:20 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00073384 ____A C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-22 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-22 16:02 - 2013-06-30 19:31 - 00460888 ____A (Kaspersky Lab ZAO) C:\Windows\System32\Drivers\99245666.sys
2013-06-22 15:56 - 2013-06-22 15:56 - 00263592 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-06-22 15:56 - 2013-06-22 15:56 - 00096168 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-06-22 15:56 - 2013-03-05 20:57 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-06-22 15:56 - 2013-03-05 20:57 - 00175016 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-06-22 15:56 - 2012-09-23 12:31 - 00867240 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-06-22 15:56 - 2011-08-21 12:11 - 00789416 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-06-22 15:56 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-06-22 15:28 - 2013-05-08 15:26 - 00000898 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:56 - 2013-06-20 14:55 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 ____A (SurfRight B.V.) C:\Users\admin\Downloads\hitmanpro_x64.exe
2013-06-18 22:34 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 22:02 - 2013-06-18 22:02 - 01084684 ____A C:\Users\jörg\AppData\Roaming\2433f433
2013-06-18 22:02 - 2013-06-18 22:02 - 01084669 ____A C:\Users\jörg\AppData\Local\2433f433
2013-06-18 19:14 - 2011-07-30 21:00 - 00000000 ____D C:\Users\jörg\AppData\Local\Adobe
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}
2013-06-14 15:25 - 2013-06-14 15:25 - 09089416 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-06-14 15:25 - 2012-04-23 14:17 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-14 15:25 - 2011-08-17 18:20 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-14 14:56 - 2013-06-14 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{99EE7253-67B4-4F61-A8BC-9177B9312D33}
2013-06-13 16:09 - 2011-07-28 22:40 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 16:06 - 2013-06-13 16:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{44E2793B-6AD0-41D5-B25A-69DFDE532F57}
2013-06-11 14:53 - 2013-06-11 14:53 - 00000000 ____D C:\Users\Manu\AppData\Local\{A0821F0E-E78A-4601-B328-5A5F35668781}
2013-06-10 20:44 - 2013-06-10 20:44 - 00000000 ____D C:\Users\jörg\AppData\Local\{7563DCB8-3CAB-493E-A1E5-3BFAA1192631}
2013-06-09 19:30 - 2013-06-09 19:30 - 00000000 ____D C:\Users\Manu\AppData\Local\{FEC6F72C-007B-4073-A665-3FDE103D2FAE}
2013-06-08 09:48 - 2013-06-08 09:48 - 00000000 ____D C:\Users\Manu\AppData\Local\{C463F1D9-FD8A-47BF-8DC5-44B3DFA22AB7}
2013-06-07 16:04 - 2013-06-07 16:04 - 00000000 ____D C:\Users\Manu\AppData\Local\{377F3E1B-52C1-418A-A5B0-397F38965AE9}
2013-06-06 18:43 - 2013-06-06 18:43 - 00000000 ____D C:\Users\jörg\AppData\Local\{65138475-27C5-448E-BCB3-4A88B43B1F56}
2013-06-06 16:14 - 2013-06-06 16:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{C5CCD79F-D5C9-408F-A647-387609FE459E}
2013-06-05 16:38 - 2013-06-05 16:38 - 00000000 ____D C:\Users\Manu\AppData\Local\{2630AFAC-26F1-4E03-86ED-E810169F8E2B}
2013-06-04 20:41 - 2013-06-04 20:41 - 00000000 ____D C:\Users\jörg\AppData\Local\{C3C906FE-0FE4-43D6-96B6-5937D326E06F}
2013-06-04 20:36 - 2013-06-29 15:57 - 00001609 ____A C:\Users\JD\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-04 20:36 - 2013-06-04 20:36 - 00001609 ____A C:\Users\jörg\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-06-04 20:32 - 2011-07-30 21:00 - 00000000 ____D C:\users\jörg
2013-06-04 20:30 - 2012-09-05 18:23 - 00000000 ____D C:\Users\jörg\AppData\Roaming\Audacity
2013-06-04 20:30 - 2012-01-14 17:51 - 00000000 ____D C:\Users\jörg\AppData\Roaming\vlc
2013-06-04 20:30 - 2011-08-27 15:16 - 00000000 ____D C:\Program Files (x86)\gs
2013-06-04 20:30 - 2011-07-29 21:03 - 00000000 ____D C:\Program Files (x86)\FreePDF_XP
2013-06-04 20:30 - 2011-07-28 22:25 - 00000000 ____D C:\users\admin
2013-06-04 20:30 - 2011-04-19 14:26 - 00000000 ____D C:\ProgramData\Norton
2013-06-04 20:30 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-06-04 20:28 - 2012-01-01 15:53 - 00000000 ____D C:\Users\jörg\AppData\Roaming\Orbit
2013-06-04 20:14 - 2011-08-28 10:51 - 00000000 ____D C:\Users\admin\AppData\Local\FreePDF_XP
2013-06-04 20:12 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-06-04 19:40 - 2013-06-04 19:40 - 00000000 ____D C:\Users\jörg\AppData\Local\{3C44CF72-A437-41AE-AFC5-C9EC1DF8556D}
2013-06-04 17:13 - 2013-06-04 17:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{BD654D46-DA3D-439F-9F7C-6EE6485BDE83}
2013-06-03 14:15 - 2013-06-03 14:15 - 00000000 ____D C:\Users\Manu\AppData\Local\{80A46B06-9E39-4984-802A-96CBCF0E00E4}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=\Device\HarddiskVolume2
description            Windows Boot Manager
locale                  de-DE
inherit                {globalsettings}
default                {current}
resumeobject            {1a9c7dba-b90c-11e0-8e30-ecf0b726b566}
displayorder            {current}
toolsdisplayorder      {memdiag}
timeout                30

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  partition=C:
path                    \Windows\system32\winload.exe
description            Windows 7
locale                  de-DE
inherit                {bootloadersettings}
recoverysequence        {1a9c7dbc-b90c-11e0-8e30-ecf0b726b566}
recoveryenabled        Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {1a9c7dba-b90c-11e0-8e30-ecf0b726b566}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {1a9c7dbc-b90c-11e0-8e30-ecf0b726b566}
device                  ramdisk=[C:]\Recovery\1a9c7dbc-b90c-11e0-8e30-ecf0b726b566\Winre.wim,{1a9c7dbd-b90c-11e0-8e30-ecf0b726b566}
path                    \windows\system32\winload.exe
description            Windows Recovery Environment
inherit                {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\1a9c7dbc-b90c-11e0-8e30-ecf0b726b566\Winre.wim,{1a9c7dbd-b90c-11e0-8e30-ecf0b726b566}
systemroot              \windows
nx                      OptIn
winpe                  Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {1a9c7dba-b90c-11e0-8e30-ecf0b726b566}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description            Windows Resume Application
locale                  de-DE
inherit                {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=\Device\HarddiskVolume2
path                    \boot\memtest.exe
description            Windows Memory Diagnostic
locale                  de-DE
inherit                {globalsettings}
badmemoryaccess        Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype              Serial
debugport              1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype    Serial
hypervisordebugport    1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {1a9c7dbd-b90c-11e0-8e30-ecf0b726b566}
description            Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\1a9c7dbc-b90c-11e0-8e30-ecf0b726b566\boot.sdi



LastRegBack: 2013-06-22 18:59

==================== End Of Log ============================
--- --- ---

--- --- ---


Fehler immer noch nicht wech :daumenrunter:

schrauber 07.07.2013 18:29
In welchem Browser? Oder in allen?

Indexation 07.07.2013 18:34
Nur bei Explorer/Google :headbang:




- Firefox macht keine Probleme weder bei Google noch bing ......

schrauber 07.07.2013 18:46
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
Startup: C:\Users\jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zahlungserinnerung.lnk
ShortcutTarget: Zahlungserinnerung.lnk -> D:\Profi cash\wzed.exe ()
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/#output=search&sclient=psy-ab&q=test&oq=test&gs_l=hp.12..0l4.9000.9329.0.11166.4.4.0.0.0.0.88.276.4.4.0...0.0...1c.1.18.psy-ab.H4SAn_fWiPk&pbx=1&bav=on.2,or.r_qf.&bvm=bv.48572450,d.Yms&fp=ca1c41bc59b1d6d5&biw=1230&bih=534
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Handler: ipp - No CLSID Value -
Handler: msdaipp - No CLSID Value -
Handler-x32: ipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
R0 07623136; C:\Windows\System32\DRIVERS\07623136.sys [460888 2013-05-13] (Kaspersky Lab ZAO)
R0 62611638; C:\Windows\System32\DRIVERS\62611638.sys [460888 2013-07-01] (Kaspersky Lab ZAO)
R0 99245666; C:\Windows\System32\DRIVERS\99245666.sys [460888 2013-06-22] (Kaspersky Lab ZAO)
C:\Windows\System32\DRIVERS\07623136.sys
C:\Windows\System32\DRIVERS\62611638.sys
C:\Windows\System32\DRIVERS\99245666.sys

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



und ein frisches FRST log bitte.

Indexation 08.07.2013 21:14
Bin heute unterwegs - werde es gleich morgen ausführen :-)

schrauber 08.07.2013 21:37
jup :)

Indexation 13.07.2013 11:21
Hat etwas gedauert - nu aber ;-)

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 03-07-2013 02
Ran by admin at 2013-07-13 12:19:55 Run:1
Running from C:\Users\admin\Desktop
Boot Mode: Normal
==============================================

C:\Users\jörg\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zahlungserinnerung.lnk => Moved successfully.
D:\Profi cash\wzed.exe => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Search Page => Value deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Value deleted successfully.
HKCR\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Key not found.
HKCR\PROTOCOLS\Handler\ipp => Key deleted successfully.
HKCR\PROTOCOLS\Handler\msdaipp => Key deleted successfully.
HKCR\Wow6432Node\PROTOCOLS\Handler\ipp => Key not found.
HKCR\Wow6432Node\PROTOCOLS\Handler\msdaipp => Key not found.
07623136 => Service deleted successfully.
62611638 => Service deleted successfully.
99245666 => Service deleted successfully.
C:\Windows\System32\DRIVERS\07623136.sys => Moved successfully.
C:\Windows\System32\DRIVERS\62611638.sys => Moved successfully.
C:\Windows\System32\DRIVERS\99245666.sys => Moved successfully.


The system needs a manual reboot.

==== End of Fixlog ====
Nach eine Neustart sieht es im ersten Step gut aus - teste heute Abend mal alle Benutzer auf der Büchse durch :daumenhoc

schrauber 13.07.2013 14:57
Mach das und gib Rückmeldung :)

Indexation 13.07.2013 20:48
Ich bin begeistert - "es" scheint tastsächlich weg zu sein :taenzer:

Meinen herzlichsten Dank @ schrauber für die Hilfe :party:

Nun die alles entscheidende Frage :
Was war das ?
Wieso ist es durch die Firewall und durch Norton geschlüpft ?:pfui:
Warum hat auch Kaspersky das Ding nicht gefunden ?
Viele Fragen ....

schrauber 13.07.2013 21:11
Norton is scheisse, und Adware findet man mit automatischen Erkennungen nur sau schwer.


Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Indexation 14.07.2013 11:04
Muss ich SpywareBlaster bei jedem User neu einstellen oder starte "es" automatisch bei allen usern wenn ich es über admin installiert habe ?

Welceh Antivirensoftware empfiehlst du denn -wenn Norton scheisse ist

schrauber 14.07.2013 12:50
Musste bei jedem neu einstellen. Avast oder Emsisoft :)

Indexation 14.07.2013 15:09
Lasse gerade scunia laufen - "es" hängt mit folgender Meldung :
Matching detected data against Secunia File Signatures
Antivirusprogramme waren aber deaktiviert ?!?!

Malwarebytes läuft auch gerade und hat 4 infinzierte Objekte gefunden ----manno :-(

Ha scunia ist doch fertig : Meldung
Gratuliere! Die gerade abgeschlossene Überprüfung Ihres PCs hat keine unsicheren Anwendungen zu Tage gefördert.:Boogie:

Zitat:
Zitat von schrauber (Beitrag 1110017)
Musste bei jedem neu einstellen. Avast oder Emsisoft :)
Avast ist ganz schön teuer 70 € für das komplettpackage

schrauber 14.07.2013 18:42
Ich empfehle Emsisoft :)

Was hat MBAM gefunden?

Indexation 14.07.2013 20:55
Hi Schrauber -
soweit läuft alles ganz gut -alle User sind soweit OK -
Habe jetz erstmal Spyblaster + Kaspersky (Trail) drauf - Emisoft kenn ich ja nun gar nicht-
Habne die auch eine Testversion ?
Ein Problem besteht im Moment noch kann nur die Startseite des Explorers nicht ändern - liegt das an Malwarebytes ?
Wie kann ich das ändern - diese MSN Site nervt.

MAche nochmal eine Suchlauf mit Malwarebytes und melde mich dann wieder

Logfile
Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.07.14.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
JD :: HOME [limitiert]

Schutz: Aktiviert

14.07.2013 21:55:02
MBAM-log-2013-07-14 (22-06-45).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244849
Laufzeit: 8 Minute(n), 30 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\jörg\AppData\Roaming\2433f433 (Trojan.Agent.TPL) -> Keine Aktion durchgeführt.
C:\Users\jörg\AppData\Local\2433f433 (Trojan.Agent.TPL) -> Keine Aktion durchgeführt.

(Ende)

Ergänzung:
Infizierte Dateien: 2
C:\Users\jörg\AppData\Roaming\2433f433 (Trojan.Agent.TPL) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\jörg\AppData\Local\2433f433 (Trojan.Agent.TPL) -> Erfolgreich gelöscht und in Quarantäne gestellt.

schrauber 14.07.2013 21:45
Zitat:
Habne die auch eine Testversion ?
ja, 30 Tage.
Zitat:
Ein Problem besteht im Moment noch kann nur die Startseite des Explorers nicht ändern - liegt das an Malwarebytes ?
Wie kann ich das ändern - diese MSN Site nervt.
Setz den IE mal komplett zurück.

Poste mal ein frisches FRST log, ich will nen letzten Blick drauf werfen :)

Indexation 15.07.2013 21:58
IE zurücksetzen ? Wie ? - Meinst du die Standardeisntellung ?
Die habe ich aber bei keinem User geändert .
Als Admin kann ich die Startsite verändern - alle anderen User nicht - muss also m.E. ein Rechteproblem sein - oder ?:blabla:

Hier die gewünschten Logfiles - wo ist noch was faul ? :confused:
FRST :
FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by admin (administrator) on 15-07-2013 22:33:24
Running from C:\Users\admin\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Mail\wlmail.exe
(Microsoft Corporation) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
(Mozilla Corporation) D:\firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe
(Orbitdownloader.com) C:\Program Files (x86)\Orbitdownloader\orbitdm.exe
(Orbitdownloader.com) C:\Program Files (x86)\Orbitdownloader\orbitnet.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] - "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - "D:\I tunes\iTunesHelper.exe" [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-05-16] (Kaspersky Lab ZAO)
HKU\jörg\...\Run: [EPSON Stylus SX200 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Windows\TEMP\E_S5BF5.tmp" /EF "HKCU" [x] <===== ATTENTION
HKU\jörg\...\Run: [Copernic Desktop Search - Home] - "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
HKU\jörg\...\Run: [Norton Download Manager{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}] - C:\Users\Public\Downloads\Norton\{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}\NBRT-Retail-Downloader.exe /m [x]
HKU\jörg\...\Winlogon: [Shell] cmd.exe [345088 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\jörg\...\Command Processor:  <===== ATTENTION!
HKU\Manu\...\Run: [Copernic Desktop Search - Home] - "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
HKU\Manu\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-07-29] (Google Inc.)
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [2521040 2013-05-23] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)
Startup: C:\Users\Manu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> D:\open office\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
HKCU SearchScopes: DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\bin\ssv.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\bin\jp2ssv.dll No File
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\Neuer Ordner\bin\ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll (Delta-search.com)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\Neuer Ordner\bin\jp2ssv.dll No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll (Delta-search.com)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\user.js
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - D:\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\java\Neuer Ordner\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\searchplugins\babylon.xml
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\searchplugins\delta.xml
FF Extension: Delta Toolbar - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\Extensions\ffxtlbr@delta.com
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF StartMenuInternet: FIREFOX.EXE - D:\firefox\firefox.exe

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\I tunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-05-16] (Kaspersky Lab ZAO)
R2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2827728 2013-05-23] ()
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 MBAMScheduler; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [118520 2013-03-01] (Riverbed Technology, Inc.)
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-05-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-05-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-16] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-15 22:33 - 2013-07-15 22:33 - 00000000 ____D C:\FRST
2013-07-15 22:33 - 2013-07-14 01:42 - 01777839 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2013-07-15 22:22 - 2013-07-15 22:22 - 00270416 _____ C:\Windows\Minidump\071513-29842-01.dmp
2013-07-15 20:20 - 2013-07-15 20:20 - 00000000 ____D C:\Users\JD\AppData\Local\{1342C6E4-7E64-46B0-B968-7EE3E797378B}
2013-07-15 10:21 - 2013-07-15 10:21 - 00000000 ____D C:\Users\Manu\AppData\Local\{0C5CC93E-F3DA-4435-BBC1-A09B16247A25}
2013-07-15 10:18 - 2013-07-15 22:22 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-07-14 23:15 - 2013-07-14 23:15 - 00000000 ____D C:\Users\JD\AppData\Local\{278743F6-9D8D-46B0-8D22-2BEFBE706E80}
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:35 - 2013-07-15 10:49 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 21:06 - 2013-07-14 21:06 - 00013324 _____ C:\Users\Manu\Desktop\excel.lnk
2013-07-14 20:57 - 2013-07-14 20:57 - 00000000 ____D C:\Users\Manu\AppData\Local\{829D777B-F4F1-41FB-A5B6-50336FD178F9}
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\Documents\My Weblog Posts
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\AppData\Local\{BF2CD784-DE2D-4D90-9A37-9DA3DBABBBF9}
2013-07-14 20:34 - 2013-07-14 20:34 - 00003380 _____ C:\Windows\System32\Tasks\EPUpdater
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Delta
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Program Files (x86)\Delta
2013-07-14 20:33 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\BabSolution
2013-07-14 20:33 - 2013-07-14 20:33 - 00001063 _____ C:\Users\admin\Desktop\Orbit.lnk
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\OpenCandy
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\Babylon
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\ProgramData\Babylon
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Program Files (x86)\WinPcap
2013-07-14 20:31 - 2013-07-14 20:31 - 00000000 ____D C:\Users\admin\AppData\Local\PackageAware
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:02 - 2013-05-16 07:27 - 00064856 _____ (Kaspersky Lab) C:\Windows\system32\klfphc.dll
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 20:00 - 2013-05-16 07:27 - 00620128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-07-14 20:00 - 2013-05-16 07:27 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 13:03 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-14 12:59 - 2013-07-14 12:59 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-14 12:49 - 2013-06-04 20:36 - 00001609 _____ C:\Users\admin\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 11:14 - 2013-07-14 11:15 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-13 23:11 - 2013-07-14 20:57 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:35 - 2013-07-13 21:40 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:57 - 2013-07-13 19:58 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-10 17:11 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 17:11 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 17:11 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 17:11 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 17:11 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 17:11 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 17:11 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 17:11 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 17:11 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 17:11 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 17:11 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 17:11 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 17:11 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 16:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 16:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 16:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 16:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 16:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 16:19 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 16:19 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 16:12 - 2013-07-10 16:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{BB7EBC30-E2A3-44B2-9E39-135E0D5B4566}
2013-07-09 16:13 - 2013-07-09 16:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{57DDD5C2-D4F8-4F1C-9371-FE8588387495}
2013-07-08 16:10 - 2013-07-08 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{D0BA7700-6E2C-4337-A565-9E53F138F503}
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-05 16:10 - 2013-07-05 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{C6CBFB65-4F96-4E70-B4BC-024DCA10699E}
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-03 16:32 - 2013-07-03 16:33 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:13 - 2013-07-01 21:38 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:11 - 2013-07-14 12:09 - 00000000 ____D C:\Windows\erdnt
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:40 - 2013-06-30 16:47 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-07-07 19:36 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:02 - 2013-07-13 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 15:57 - 2013-06-04 20:36 - 00001609 _____ C:\Users\JD\Desktop\Zugangsdaten.lnk
2013-06-29 15:57 - 2013-03-10 13:26 - 00001333 _____ C:\Users\JD\Desktop\IMG_3288.JPG - Verknüpfung.lnk
2013-06-29 15:57 - 2012-09-05 20:27 - 00001109 _____ C:\Users\JD\Desktop\audacity..lnk
2013-06-29 15:57 - 2012-07-29 19:19 - 00001154 _____ C:\Users\JD\Desktop\FreeVideoPerformer.lnk
2013-06-29 15:57 - 2012-03-22 22:05 - 00000855 _____ C:\Users\JD\Desktop\TotalMedia.lnk
2013-06-29 15:57 - 2012-01-04 17:46 - 00001010 _____ C:\Users\JD\Desktop\Teamviewer.lnk
2013-06-29 15:57 - 2011-11-08 20:32 - 00000541 _____ C:\Users\JD\Desktop\Profi cash.lnk
2013-06-29 15:57 - 2011-07-30 22:45 - 00000967 _____ C:\Users\JD\Desktop\WORD.lnk
2013-06-29 15:57 - 2011-07-30 22:41 - 00000975 _____ C:\Users\JD\Desktop\EXCEL -.lnk
2013-06-29 15:57 - 2011-07-30 21:08 - 00000355 _____ C:\Users\JD\Desktop\home.lnk
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 19:11 - 2013-06-26 19:12 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 _____ C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:47 - 2013-06-29 15:27 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:19 - 2013-07-14 22:37 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-23 13:19 - 2013-07-14 21:37 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-30 16:21 - 00000000 ____D C:\Users\JD
2013-06-23 13:19 - 2013-06-28 18:25 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-23 13:19 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 13:19 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-23 13:19 - 2011-04-19 14:30 - 00000000 ____D C:\Users\JD\AppData\Local\Cyberlink
2013-06-23 13:19 - 2011-04-19 14:25 - 00000000 ____D C:\Users\JD\AppData\Roaming\Macromedia
2013-06-23 13:19 - 2011-04-19 13:33 - 00000000 ____D C:\Users\JD\AppData\Roaming\Intel Corporation
2013-06-23 13:19 - 2011-04-19 13:31 - 00000000 ____D C:\Users\JD\AppData\Roaming\InstallShield
2013-06-23 13:19 - 2010-11-21 04:50 - 00000020 ___SH C:\Users\JD\ntuser.ini
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:55 - 2013-06-20 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 _____ (SurfRight B.V.) C:\Users\admin\Downloads\hitmanpro_x64.exe
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 _____ (SurfRight B.V.) C:\Users\admin\Desktop\hitmanpro_x64.exe
2013-06-18 22:34 - 2013-07-15 22:28 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}

==================== One Month Modified Files and Folders =======

2013-07-15 22:33 - 2013-07-15 22:33 - 00000000 ____D C:\FRST
2013-07-15 22:32 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-15 22:31 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-15 22:31 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-15 22:28 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-15 22:28 - 2011-07-29 21:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-15 22:25 - 2012-07-18 18:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-15 22:25 - 2011-07-29 21:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-15 22:22 - 2013-07-15 22:22 - 00270416 _____ C:\Windows\Minidump\071513-29842-01.dmp
2013-07-15 22:22 - 2013-07-15 10:18 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-07-15 22:22 - 2012-07-01 19:52 - 00000000 ____D C:\Windows\Minidump
2013-07-15 22:22 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-15 22:22 - 2009-07-14 06:51 - 00154362 _____ C:\Windows\setupact.log
2013-07-15 20:23 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-07-15 20:22 - 2011-07-28 03:43 - 01726647 _____ C:\Windows\WindowsUpdate.log
2013-07-15 20:20 - 2013-07-15 20:20 - 00000000 ____D C:\Users\JD\AppData\Local\{1342C6E4-7E64-46B0-B968-7EE3E797378B}
2013-07-15 11:01 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu
2013-07-15 10:49 - 2013-07-14 21:35 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-15 10:28 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu\AppData\Local\Adobe
2013-07-15 10:21 - 2013-07-15 10:21 - 00000000 ____D C:\Users\Manu\AppData\Local\{0C5CC93E-F3DA-4435-BBC1-A09B16247A25}
2013-07-14 23:15 - 2013-07-14 23:15 - 00000000 ____D C:\Users\JD\AppData\Local\{278743F6-9D8D-46B0-8D22-2BEFBE706E80}
2013-07-14 22:37 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-07-14 22:36 - 2011-07-28 13:36 - 00659690 _____ C:\Windows\system32\perfh007.dat
2013-07-14 22:36 - 2011-07-28 13:36 - 00132970 _____ C:\Windows\system32\perfc007.dat
2013-07-14 22:36 - 2009-07-14 07:13 - 01513970 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:37 - 2013-06-23 13:19 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 21:35 - 2012-06-26 13:44 - 00000000 ____D C:\Users\Manu\AppData\Local\Google
2013-07-14 21:06 - 2013-07-14 21:06 - 00013324 _____ C:\Users\Manu\Desktop\excel.lnk
2013-07-14 20:57 - 2013-07-14 20:57 - 00000000 ____D C:\Users\Manu\AppData\Local\{829D777B-F4F1-41FB-A5B6-50336FD178F9}
2013-07-14 20:57 - 2013-07-13 23:11 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:53 - 2011-07-28 22:54 - 00073384 _____ C:\Users\Manu\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:38 - 2010-11-21 05:47 - 00642826 _____ C:\Windows\PFRO.log
2013-07-14 20:38 - 2009-07-14 06:45 - 04955680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\Documents\My Weblog Posts
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\AppData\Local\{BF2CD784-DE2D-4D90-9A37-9DA3DBABBBF9}
2013-07-14 20:35 - 2013-05-16 07:27 - 00054368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2013-07-14 20:35 - 2011-08-07 17:32 - 00000000 ____D C:\Users\admin\AppData\Local\Windows Live Writer
2013-07-14 20:34 - 2013-07-14 20:34 - 00003380 _____ C:\Windows\System32\Tasks\EPUpdater
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Delta
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Program Files (x86)\Delta
2013-07-14 20:34 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\BabSolution
2013-07-14 20:33 - 2013-07-14 20:33 - 00001063 _____ C:\Users\admin\Desktop\Orbit.lnk
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\OpenCandy
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\Babylon
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\ProgramData\Babylon
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Program Files (x86)\WinPcap
2013-07-14 20:33 - 2012-03-02 19:52 - 00000000 ____D C:\Program Files (x86)\Orbitdownloader
2013-07-14 20:31 - 2013-07-14 20:31 - 00000000 ____D C:\Users\admin\AppData\Local\PackageAware
2013-07-14 20:28 - 2011-12-30 18:18 - 00000000 ____D C:\Windows\SysWOW64\unknown
2013-07-14 20:28 - 2011-07-28 22:25 - 00073384 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:27 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2013-07-14 20:27 - 2011-04-19 14:24 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:20 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 19:46 - 2013-02-08 22:42 - 00000000 ____D C:\Program Files (x86)\Freecom
2013-07-14 19:46 - 2011-09-11 17:47 - 00000000 ____D C:\ProgramData\WinZip
2013-07-14 13:30 - 2012-08-06 10:29 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 12:59 - 2013-07-14 12:59 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-14 12:45 - 2012-09-23 12:31 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-07-14 12:45 - 2011-08-21 12:11 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-14 12:44 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-14 12:34 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Local\Adobe
2013-07-14 12:33 - 2011-04-19 14:24 - 00000000 ____D C:\ProgramData\Adobe
2013-07-14 12:29 - 2013-07-14 12:30 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 12:09 - 2013-07-01 21:11 - 00000000 ____D C:\Windows\erdnt
2013-07-14 11:15 - 2013-07-14 11:14 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-14 01:42 - 2013-07-15 22:33 - 01777839 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:37 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:40 - 2013-07-13 21:35 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:58 - 2013-07-13 19:57 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-13 12:20 - 2011-07-29 21:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 12:20 - 2011-07-29 21:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 16:12 - 2013-07-10 16:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{BB7EBC30-E2A3-44B2-9E39-135E0D5B4566}
2013-07-09 16:13 - 2013-07-09 16:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{57DDD5C2-D4F8-4F1C-9371-FE8588387495}
2013-07-08 16:10 - 2013-07-08 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{D0BA7700-6E2C-4337-A565-9E53F138F503}
2013-07-07 19:36 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-05 16:10 - 2013-07-05 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{C6CBFB65-4F96-4E70-B4BC-024DCA10699E}
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-03 16:33 - 2013-07-03 16:32 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 22:29 - 2011-08-27 11:21 - 00000000 ____D C:\Users\admin\AppData\Local\Apple Computer
2013-07-02 22:29 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Local\Windows Live
2013-07-02 21:19 - 2011-07-28 22:26 - 00000000 ____D C:\Users\admin\AppData\Local\VirtualStore
2013-07-02 20:24 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-02 20:20 - 2011-07-28 22:25 - 00000000 ___RD C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-02 20:16 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:38 - 2013-07-01 21:13 - 00000000 ____D C:\1-ComboFix
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 19:00 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:47 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:27 - 2013-06-23 13:47 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-29 14:39 - 2011-07-29 21:41 - 00000000 ____D C:\Users\Manu\AppData\Local\FreePDF_XP
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 18:25 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-28 13:42 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 19:12 - 2013-06-26 19:11 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-24 00:57 - 2011-07-28 22:40 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-23 22:37 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 20:22 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 19:32 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 18:13 - 2011-07-29 20:16 - 00000403 _____ C:\Windows\ODBC.INI
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 _____ C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:20 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-22 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-22 15:28 - 2013-05-08 15:26 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:56 - 2013-06-20 14:55 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 _____ (SurfRight B.V.) C:\Users\admin\Downloads\hitmanpro_x64.exe
2013-06-18 23:02 - 2013-06-18 23:02 - 09755584 _____ (SurfRight B.V.) C:\Users\admin\Desktop\hitmanpro_x64.exe
2013-06-18 22:23 - 2011-07-28 22:25 - 00000000 ___RD C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-06-18 19:14 - 2011-07-30 21:00 - 00000000 ____D C:\Users\jörg\AppData\Local\Adobe
2013-06-18 19:08 - 2011-11-12 21:38 - 00003910 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5C497AA6-8DA4-4F51-9231-255D2BE41896}
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-15 13:47

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---



und dann noch "Addition" :
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 14-07-2013
Ran by admin at 2013-07-15 22:34:45
Running from C:\Users\admin\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
ABBYY FineReader 6.0 Sprint (x32 Version: 6.00.1395.4512)
Acrobat.com (x32 Version: 1.6.65)
ActiveX контрола на Windows Live Mesh за отдалечени връзки (x32 Version: 15.4.5722.2)
ActiveX-kontroll för fjärranslutningar för Windows Live Mesh (x32 Version: 15.4.5722.2)
Adobe AIR (x32 Version: 3.6.0.5970)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Download Assistant (x32 Version: 1.2.5)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Photoshop CS6 (x32 Version: 13.0)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Agatha Christie - 4:50 from Paddington (x32 Version: 2.2.0.95)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
Applian FLV and Media Player 3.1.1.12 (x32 Version: 3.1.1.12)
ArcSoft TotalMedia 3.5 (x32 Version: 3.5.28.291)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.36)
ATI Catalyst Install Manager (Version: 3.0.808.0)
Audacity 2.0.2 (x32 Version: 2.0.2)
Backup Manager V3 (x32 Version: 3.0.0.90)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Bonjour (Version: 3.0.0.10)
BrowserDefender (x32)
Camera RAW Plug-In for EPSON Creativity Suite (x32 Version: 2.3.0.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center InstallProxy (x32 Version: 2011.0331.249.3126)
Catalyst Control Center Localization All (x32 Version: 2011.0331.249.3126)
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0331.249.3126)
CCC Help Chinese Standard (x32 Version: 2011.0331.0248.3126)
CCC Help Chinese Traditional (x32 Version: 2011.0331.0248.3126)
CCC Help Czech (x32 Version: 2011.0331.0248.3126)
CCC Help Danish (x32 Version: 2011.0331.0248.3126)
CCC Help Dutch (x32 Version: 2011.0331.0248.3126)
CCC Help English (x32 Version: 2011.0331.0248.3126)
CCC Help Finnish (x32 Version: 2011.0331.0248.3126)
CCC Help French (x32 Version: 2011.0331.0248.3126)
CCC Help German (x32 Version: 2011.0331.0248.3126)
CCC Help Greek (x32 Version: 2011.0331.0248.3126)
CCC Help Hungarian (x32 Version: 2011.0331.0248.3126)
CCC Help Italian (x32 Version: 2011.0331.0248.3126)
CCC Help Japanese (x32 Version: 2011.0331.0248.3126)
CCC Help Korean (x32 Version: 2011.0331.0248.3126)
CCC Help Norwegian (x32 Version: 2011.0331.0248.3126)
CCC Help Polish (x32 Version: 2011.0331.0248.3126)
CCC Help Portuguese (x32 Version: 2011.0331.0248.3126)
CCC Help Russian (x32 Version: 2011.0331.0248.3126)
CCC Help Spanish (x32 Version: 2011.0331.0248.3126)
CCC Help Swedish (x32 Version: 2011.0331.0248.3126)
CCC Help Thai (x32 Version: 2011.0331.0248.3126)
CCC Help Turkish (x32 Version: 2011.0331.0248.3126)
ccc-core-static (x32 Version: 2011.0331.249.3126)
ccc-utility64 (Version: 2011.0331.249.3126)
CDex - Open Source Digital Audio CD Extractor (x32 Version: 1.70.4.2009)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Configo (x32 Version: 2.1.7.0)
Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2)
Control ActiveX del Windows Live Mesh per a connexions remotes (x32 Version: 15.4.5722.2)
Control ActiveX Windows Live Mesh pentru conexiuni la distanță (x32 Version: 15.4.5722.2)
Controle ActiveX do Windows Live Mesh para Conexões Remotas (x32 Version: 15.4.5722.2)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (x32 Version: 15.4.5722.2)
Crazy Chicken Kart 2 (x32 Version: 2.2.0.95)
CyberLink MediaEspresso (x32 Version: 6.0.1027_32100)
D3DX10 (x32 Version: 15.4.2368.0902)
Delta Chrome Toolbar (x32)
Delta toolbar  (x32 Version: 1.8.21.5)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
DivX-Setup (x32 Version: 2.6.1.9)
ElsterFormular (x32 Version: 14.0.0.10960)
EPSON Attach To Email (x32 Version: 1.01.0000)
EPSON Easy Photo Print (x32 Version: 1.5.1.0)
EPSON File Manager (x32 Version: 1.3.1.0)
EPSON Scan (x32)
EPSON Scan Assistant (x32 Version: 1.10.00)
EPSON Stylus SX200_SX400_TX200_TX400 Handbuch (x32)
FATE (x32 Version: 2.2.0.95)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (x32 Version: 15.4.5722.2)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922)
Free FLV Converter V 7.5.0 (x32 Version: 7.5.0.0)
Free YouTube Download version 3.2.1.320 (x32 Version: 3.2.1.320)
Freecom Product Update 1.06 (x32)
FreePDF (Remove only) (x32)
Freez FLV to MP3 Converter (x32 Version: 1.5)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotogràfica del Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Google Chrome (x32 Version: 28.0.1500.72)
Google Earth (x32 Version: 7.0.3.8542)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)
Google Update Helper (x32 Version: 1.3.21.153)
GPL Ghostscript 8.64 (x32)
HomeMedia (x32 Version: 2.0.8520)
iCloud (Version: 2.1.1.3)
Identity Card (x32 Version: 1.00.3006)
Intel(R) Display Audio Driver (x32 Version: 6.14.00.3074)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
iTunes (Version: 11.0.4.4)
Java 7 Update 25 (64-bit) (Version: 7.0.250)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Java(TM) 6 Update 38 (x32 Version: 6.0.380)
JDownloader 0.9 (x32 Version: 0.9)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
John Deere Drive Green (x32 Version: 2.2.0.95)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Kaspersky Internet Security 2013 (x32 Version: 13.0.1.4190)
Kontrola Windows Live Mesh ActiveX za daljinske veze (x32 Version: 15.4.5722.2)
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2)
Launch Manager (x32 Version: 5.1.4)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2000 Premium (x32 Version: 9.00.2816)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (x32 Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 10.0.2 (x86 de) (x32 Version: 10.0.2)
Mozilla Firefox 22.0 (x86 de) (HKCU Version: 22.0)
MSI to redistribute MS VS2005 CRT libraries (x32 Version: 8.0.50727.42)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Mystery P.I. - The London Caper (x32 Version: 2.2.0.95)
Nero Backup Drivers (Version: 1.0.11100.8.0)
Nero Control Center 10 (x32 Version: 10.2.11100.1.1)
Nero ControlCenter 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Core Components 10 (x32 Version: 2.0.18100.8.8)
Nero DiscSpeed 10 (x32 Version: 6.2.10500.2.100)
Nero DiscSpeed 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Express 10 (x32 Version: 10.2.12000.21.100)
Nero Express 10 Help (CHM) (x32 Version: 10.5.10200)
Nero Multimedia Suite 10 Essentials (x32 Version: 10.5.10300)
Nero StartSmart 10 (x32 Version: 10.2.11600.14.100)
Nero StartSmart 10 Help (CHM) (x32 Version: 10.5.10000)
Nero Update (x32 Version: 1.0.0018)
ON Stylus SX200 Series Printer Uninstall
OpenOffice.org 3.3 (x32 Version: 3.3.9567)
Orbit Downloader (x32)
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená připojení (x32 Version: 15.4.5722.2)
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2)
Packard Bell Games (x32 Version: 1.0.2.4)
Packard Bell MyBackup (x32 Version: 3.0.0.90)
Packard Bell Power Management (x32 Version: 6.00.3006)
Packard Bell Recovery Management (x32 Version: 5.00.3002)
Packard Bell Registration (x32 Version: 1.03.3004)
Packard Bell ScreenSaver (x32 Version: 1.1.1025.2010)
Packard Bell Social Networks (x32 Version: 2.0.2211)
Packard Bell Updater (x32 Version: 1.02.3005)
PDF Settings CS6 (x32 Version: 11.0)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.95)
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Polar Bowler (x32 Version: 2.2.0.95)
Pošta Windows Live (x32 Version: 15.4.3502.0922)
Profi cash (x32)
PX Profile Update (x32 Version: 1.00.1.)
QuickTime (x32 Version: 7.73.80.64)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
REALTEK DTV USB DEVICE (x32 Version: 1.00.0000)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6329)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30123)
RedMon - Redirection Port Monitor
RewardsArcadeSuite (HKCU)
Secure Eraser v4.0 (x32)
Skype™ 5.10 (x32 Version: 5.10.116)
Slingo Deluxe (x32 Version: 2.2.0.95)
Spybot - Search & Destroy (x32 Version: 1.6.2)
SpywareBlaster 5.0 (x32 Version: 5.0.0)
StarMoney (x32 Version: 2.0)
StarMoney (x32 Version: 3.0.5.8)
StarMoney 8.0  (x32 Version: 8.0)
Synaptics Pointing Device Driver (Version: 15.1.6.0)
Torchlight (x32 Version: 2.2.0.95)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
Urruneko konexioetarako Windows Live Mesh ActiveX kontrola (x32 Version: 15.4.5722.2)
Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
Video Web Camera (x32 Version: 1.0.1523)
VideoConverter (x32)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
VLC media player 1.1.11 (x32 Version: 1.1.11)
Wedding Dash (x32 Version: 2.2.0.95)
Welcome Center (x32 Version: 1.02.3102)
WildTangent Games App (Packard Bell Games) (x32 Version: 4.0.3.57)
Windows Live Argazki Galeria (x32 Version: 15.4.3502.0922)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922)
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Live 影像中心 (x32 Version: 15.4.3502.0922)
Windows Live 程式集 (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WinPcap 4.1.3 (x32 Version: 4.1.0.2980)
WinX Free FLV to MP4 Converter 4.1.7 (x32)
Zuma Deluxe (x32 Version: 2.2.0.95)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922)
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922)
Почта Windows Live (x32 Version: 15.4.3502.0922)
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922)
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922)
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (x32 Version: 15.4.5722.2)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922)
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (x32 Version: 15.4.5722.2)
بريد Windows Live (x32 Version: 15.4.3502.0922)
عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة (x32 Version: 15.4.5722.2)
معرض صور Windows Live (x32 Version: 15.4.3502.0922)
ตัวควบคุม ActiveX ใน Windows Live Mesh สำหรับการเชื่อมต่อระยะไกล (ไทย) (x32 Version: 15.4.5722.2)
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (x32 Version: 15.4.5722.2)

==================== Restore Points  =========================

14-07-2013 10:28:34 Installed Java 7 Update 25 (64-bit)
14-07-2013 10:42:32 Removed Java 7 Update 25
14-07-2013 10:44:56 Installed Java 7 Update 25
14-07-2013 11:11:50 Windows Update
14-07-2013 17:43:56 Removed Microsoft Silverlight
14-07-2013 17:46:18 WinZip 15.0 wird entfernt
14-07-2013 18:21:30 Removed Norton Online Backup
14-07-2013 18:25:06 Removed Adobe Premiere Elements 9.

==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-07-02 20:16 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {05E85065-6656-4428-8354-48B69374C49F} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => C:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {16730B1D-FF19-4019-B458-583B0F10930C} - System32\Tasks\AdobeAAMUpdater-1.0-home-jörg => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {277F5A78-E82A-4029-B7E1-F6F469598154} - System32\Tasks\DeviceDetector => C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe [2010-10-28] (CyberLink)
Task: {2B67024A-00BB-4A12-B31D-75CEAEF38327} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {3A3E53BE-F637-4CBE-9EE3-7B2498F73CB7} - System32\Tasks\EPUpdater => C:\Users\admin\AppData\Roaming\BABSOL~1\Shared\BabMaint.exe [2013-06-06] ()
Task: {597CCC43-0860-4880-8F24-B5B2B6B2D937} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {60193A6D-E0B7-480F-8AC6-289BFE6BBD06} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2799057012-1557965162-470920329-1004 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {72D588D8-BE7B-49E6-B5D6-2B21DA28DC4C} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-14] (Adobe Systems Incorporated)
Task: {74723509-D50E-40F4-A4E8-2B6F9D66BF61} - System32\Tasks\User_Feed_Synchronization-{5C497AA6-8DA4-4F51-9231-255D2BE41896} => C:\Windows\system32\msfeedssync.exe [2011-07-28] (Microsoft Corporation)
Task: {98EAF0E2-62FF-41B5-BC9B-09C1BC06AD3C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-29] (Google Inc.)
Task: {C7D2F019-EE9B-4EC0-84FE-9ADFE36BCD69} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-21] (Microsoft Corporation)
Task: {CFCA6B2D-A4D3-4511-BC1A-88EC5978CBBE} - System32\Tasks\BrowserDefendert => C:\Windows\system32\sc.exe [2009-07-14] (Microsoft Corporation)
Task: {D0FD4A03-5F63-460A-A834-6F37086B10DC} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {DE75400B-3886-447C-9DF1-EB96F1A9124D} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-07-29] (Google Inc.)
Task: {E00BA8FA-2C19-46D6-B7D6-0E768914F1FE} - System32\Tasks\AdobeAAMUpdater-1.0-home-Manu => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-04-04] (Adobe Systems Incorporated)
Task: {E55DB095-337A-4A84-89A3-9E4AFF305883} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2799057012-1557965162-470920329-1007 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {FE27252D-67E3-4AE5-9D07-465D2160F3B8} - System32\Tasks\WPD\SqmUpload_S-1-5-21-2799057012-1557965162-470920329-1003 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/15/2013 10:23:33 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2013 08:18:42 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2013 02:02:28 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 9.0.8112.16496 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1bcc

Startzeit: 01ce815316013d94

Endzeit: 0

Anwendungspfad: C:\Program Files (x86)\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (07/15/2013 01:58:02 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/15/2013 01:58:00 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/15/2013 01:57:58 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/15/2013 01:57:56 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/15/2013 01:57:48 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/15/2013 01:57:46 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (07/15/2013 01:57:44 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 0x800700b7

Error: (07/15/2013 10:23:57 PM) (Source: WMPNetworkSvc) (User: )
Description: 00x800700b7hxxp://+:10243/WMPNSSv4/2811996591/


Microsoft Office Sessions:
=========================
Error: (07/15/2013 10:23:33 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2013 08:18:42 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/15/2013 02:02:28 PM) (Source: Application Hang)(User: )
Description: iexplore.exe9.0.8112.164961bcc01ce815316013d940C:\Program Files (x86)\Internet Explorer\iexplore.exe

Error: (07/15/2013 01:58:02 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8

Error: (07/15/2013 01:58:00 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8

Error: (07/15/2013 01:57:58 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8

Error: (07/15/2013 01:57:56 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8

Error: (07/15/2013 01:57:48 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8

Error: (07/15/2013 01:57:46 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8

Error: (07/15/2013 01:57:44 PM) (Source: SideBySide)(User: )
Description: assemblyIdentitylanguage*d:\spybot\spybot - search & destroy\DelZip179.dlld:\spybot\spybot - search & destroy\DelZip179.dll8


CodeIntegrity Errors:
===================================
  Date: 2013-07-15 13:54:50.282
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.282
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.282
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.267
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.251
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.251
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\ELAMBKUP\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.204
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.204
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-15 13:54:50.204
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\KLELAMX64\klelam.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-02 20:01:58.873
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 63%
Total physical RAM: 3947.86 MB
Available physical RAM: 1450.69 MB
Total Pagefile: 7893.9 MB
Available Pagefile: 4666.76 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (Packard Bell) (Fixed) (Total:103.86 GB) (Free:23.86 GB) NTFS (Disk=0 Partition=3)
Drive d: (Software) (Fixed) (Total:97.66 GB) (Free:83.99 GB) NTFS (Disk=0 Partition=4)
Drive e: (Data) (Fixed) (Total:244.14 GB) (Free:59.54 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 5EBAD0F3)
Partition 1: (Not Active) - (Size=20 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=104 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=342 GB) - (Type=OF Extended)

==================== End Of Log ============================
Ergänzung :
Bei IE kann ich (wenn ich normaler User bin) weder die Startsite einstellen noch "es" so einstellen,dass "er" sich mit meinem Googlekonto verbindet.
Geht zwar . muss es halt immer wieder neu machen .
Habe unter Extras - Inernetoptionen - Erweierte Einstellungen alles zurückgesetzt.
Ist es DAS was du meinst mit zurücksetzen ? -Das funzt jedenfalls nicht :-(
Ebenso hab ich das Problem, dass IE den Cache nicht leert bzw. überschreibt - d.h. eine akAualiserung der Website erfolgt nicht - ich merke das wenn ich
eine Website über TYPO administriere und mir das "Ergebnis ansehen will " - "er" zeigt immer noch die alte Verison
Wenn ich die gleiche Seite z.B. in Firefox öffene ist alles paletti

Fazit : IE hat durch das ganze Ding einen ganz schönen Schlag weg

schrauber 16.07.2013 07:25
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
HKU\jörg\...\Winlogon: [Shell] cmd.exe [345088 2010-11-21] (Microsoft Corporation) <==== ATTENTION
HKU\jörg\...\Command Processor:  <===== ATTENTION!
HKCU SearchScopes: DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\user.js
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
2013-07-15 20:20 - 2013-07-15 20:20 - 00000000 ____D C:\Users\JD\AppData\Local\{1342C6E4-7E64-46B0-B968-7EE3E797378B}
2013-07-15 10:21 - 2013-07-15 10:21 - 00000000 ____D C:\Users\Manu\AppData\Local\{0C5CC93E-F3DA-4435-BBC1-A09B16247A25}
2013-07-15 10:18 - 2013-07-15 22:22 - 00003436 _____ C:\Windows\System32\Tasks\BrowserDefendert
2013-07-14 23:15 - 2013-07-14 23:15 - 00000000 ____D C:\Users\JD\AppData\Local\{278743F6-9D8D-46B0-8D22-2BEFBE706E80}
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\Delta
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\Program Files (x86)\Delta
2013-07-14 20:33 - 2013-07-14 20:34 - 00000000 ____D C:\Users\admin\AppData\Roaming\BabSolution
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\OpenCandy
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Users\admin\AppData\Roaming\Babylon
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\ProgramData\Babylon
2013-07-14 20:33 - 2013-07-14 20:33 - 00000000 ____D C:\Program Files (x86)\WinPcap

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Nun bitte reobooten. Poste mal ein frisches FRST log mit Admin und einmal mit dem normalen Benutzerkonto.

Indexation 16.07.2013 22:53
Habe doch die Logs gepostet ...wo sind sie hin ?????

Wo sind meine Antworten ?

Ok über Firefox sehe ich alles ..... -- irre -> IE spinnt scheinbar völlig ...:pfui:

Melde mich um und folge führe dein script aus ....

Sooo ..script ist durch ....
Bin angemeldet als admin
IE scheint zu laufen ...veränderung der Startsite ist problemlos möglich.
Hier ist das Log
( Melde mich dann um auf einen normalen User teste und schicke das log

Log von adminuser :
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-07-2013
Ran by admin at 2013-07-16 23:21:05 Run:1
Running from C:\Users\admin\Desktop
Boot Mode: Normal
==============================================

HKU\jörg\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\jörg\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully.
HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found.
C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default\user.js => Moved successfully.
Firefox newtab deleted successfully.
Firefox homepage deleted successfully.
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943" ==> The Chrome "Settings" can be used to fix the entry.
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms} ==> The Chrome "Settings" can be used to fix the entry.
C:\Users\JD\AppData\Local\{1342C6E4-7E64-46B0-B968-7EE3E797378B} => Moved successfully.
C:\Users\Manu\AppData\Local\{0C5CC93E-F3DA-4435-BBC1-A09B16247A25} => Moved successfully.
C:\Windows\System32\Tasks\BrowserDefendert => Moved successfully.
C:\Users\JD\AppData\Local\{278743F6-9D8D-46B0-8D22-2BEFBE706E80} => Moved successfully.
C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender => Moved successfully.
C:\Users\admin\AppData\Roaming\Delta => Moved successfully.

"C:\ProgramData\BrowserDefender" directory move:

C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl => Moved successfully.
Could not move "C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe" => Scheduled to move on reboot.
Could not move "C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings" => Scheduled to move on reboot.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\dm => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\uninstall.exe => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23 => Moved successfully.
C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\bprotector.js => Moved successfully.
Could not move "C:\ProgramData\BrowserDefender" directory. => Scheduled to move on reboot.

C:\Program Files (x86)\Delta => Moved successfully.
C:\Users\admin\AppData\Roaming\BabSolution => Moved successfully.
C:\Users\admin\AppData\Roaming\OpenCandy => Moved successfully.
C:\Users\admin\AppData\Roaming\Babylon => Moved successfully.
C:\ProgramData\Babylon => Moved successfully.
C:\Program Files (x86)\WinPcap => Moved successfully.

=========== Result of Scheduled Files to move ===========
"C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe" => File could not move.
"C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.settings" => File could not move.
"C:\ProgramData\BrowserDefender" => Directory could not move.

==== End of Fixlog ====
Krass ..... bin über normalen User (ich) drin ...sehe im T-Board als letzten thread einen Eintrag von dir ????
Schrebe einfach mal trotzdem ....

Änderen der Startsite geht .... den automatischen login beim Googlekonte nimmt er nicht - muss mich immer neu anmelden.

Hier das Log danach melde ich mich mit dem zweit user (meine Frau ) an - mal sehen was da läuft ...mehr User gibts auf der Büchse nicht


FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by JD (ATTENTION: The logged in user is not administrator) on 16-07-2013 23:31:33
Running from C:\Users\JD\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKCU\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-07-29] (Google Inc.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] - "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - "D:\I tunes\iTunesHelper.exe" [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-05-16] (Kaspersky Lab ZAO)
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [356376 2013-05-16] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\bin\ssv.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\bin\jp2ssv.dll No File
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\Neuer Ordner\bin\ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\Neuer Ordner\bin\jp2ssv.dll No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll No File
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Toolbar: HKCU - No Name - {213C8ED6-1D78-4D8F-8729-25006AA86A76} -  No File
Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\JD\AppData\Roaming\Mozilla\Firefox\Profiles\ezn4fbq5.default
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - D:\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\java\Neuer Ordner\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF StartMenuInternet: FIREFOX.EXE - D:\firefox\firefox.exe

Chrome:
=======

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-05-16] (Kaspersky Lab ZAO)
R2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2827728 2013-05-23] ()
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-05-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-05-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-16] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-16 23:31 - 2013-07-14 01:42 - 01777839 _____ (Farbar) C:\Users\JD\Desktop\FRST64.exe
2013-07-16 20:22 - 2013-07-16 20:23 - 00000000 ____D C:\Users\JD\AppData\Local\{0B1E31F6-97D5-45DA-BC53-79E0649C1467}
2013-07-15 22:33 - 2013-07-16 23:23 - 00000000 ____D C:\FRST
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:35 - 2013-07-15 10:49 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:02 - 2013-05-16 07:27 - 00064856 _____ (Kaspersky Lab) C:\Windows\system32\klfphc.dll
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 20:00 - 2013-05-16 07:27 - 00620128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-07-14 20:00 - 2013-05-16 07:27 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 13:03 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 11:14 - 2013-07-14 11:15 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-13 23:11 - 2013-07-14 20:57 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:35 - 2013-07-13 21:40 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:57 - 2013-07-13 19:58 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-10 17:11 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 17:11 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 17:11 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 17:11 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 17:11 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 17:11 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 17:11 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 17:11 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 17:11 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 17:11 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 17:11 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 17:11 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 17:11 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 16:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 16:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 16:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 16:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 16:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 16:19 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 16:19 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:13 - 2013-07-01 21:38 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:11 - 2013-07-14 12:09 - 00000000 ____D C:\Windows\erdnt
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:40 - 2013-06-30 16:47 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-07-07 19:36 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:02 - 2013-07-13 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 15:57 - 2013-06-04 20:36 - 00001609 _____ C:\Users\JD\Desktop\Zugangsdaten.lnk
2013-06-29 15:57 - 2013-03-10 13:26 - 00001333 _____ C:\Users\JD\Desktop\IMG_3288.JPG - Verknüpfung.lnk
2013-06-29 15:57 - 2012-09-05 20:27 - 00001109 _____ C:\Users\JD\Desktop\audacity..lnk
2013-06-29 15:57 - 2012-03-22 22:05 - 00000855 _____ C:\Users\JD\Desktop\TotalMedia.lnk
2013-06-29 15:57 - 2012-01-04 17:46 - 00001010 _____ C:\Users\JD\Desktop\Teamviewer.lnk
2013-06-29 15:57 - 2011-11-08 20:32 - 00000541 _____ C:\Users\JD\Desktop\Profi cash.lnk
2013-06-29 15:57 - 2011-07-30 22:45 - 00000967 _____ C:\Users\JD\Desktop\WORD.lnk
2013-06-29 15:57 - 2011-07-30 22:41 - 00000975 _____ C:\Users\JD\Desktop\EXCEL -.lnk
2013-06-29 15:57 - 2011-07-30 21:08 - 00000355 _____ C:\Users\JD\Desktop\home.lnk
2013-06-26 19:11 - 2013-06-26 19:12 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 _____ C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:47 - 2013-06-29 15:27 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:19 - 2013-07-14 22:37 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-23 13:19 - 2013-07-14 21:37 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-30 16:21 - 00000000 ____D C:\Users\JD
2013-06-23 13:19 - 2013-06-28 18:25 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-23 13:19 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 13:19 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00001451 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00001417 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-23 13:19 - 2011-04-19 14:30 - 00000000 ____D C:\Users\JD\AppData\Local\Cyberlink
2013-06-23 13:19 - 2011-04-19 14:25 - 00000000 ____D C:\Users\JD\AppData\Roaming\Macromedia
2013-06-23 13:19 - 2011-04-19 13:33 - 00000000 ____D C:\Users\JD\AppData\Roaming\Intel Corporation
2013-06-23 13:19 - 2011-04-19 13:31 - 00000000 ____D C:\Users\JD\AppData\Roaming\InstallShield
2013-06-23 13:19 - 2010-11-21 04:50 - 00000020 ___SH C:\Users\JD\ntuser.ini
2013-06-23 13:19 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-06-23 13:19 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-06-18 22:34 - 2013-07-16 23:30 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}

==================== One Month Modified Files and Folders =======

2013-07-16 23:30 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-16 23:30 - 2011-07-29 21:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-16 23:30 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-16 23:30 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-16 23:25 - 2012-07-18 18:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-16 23:25 - 2011-07-29 21:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-16 23:23 - 2013-07-15 22:33 - 00000000 ____D C:\FRST
2013-07-16 23:22 - 2010-11-21 05:47 - 00649632 _____ C:\Windows\PFRO.log
2013-07-16 23:22 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-16 23:22 - 2009-07-14 06:51 - 00154530 _____ C:\Windows\setupact.log
2013-07-16 23:21 - 2011-07-28 03:43 - 01783196 _____ C:\Windows\WindowsUpdate.log
2013-07-16 20:23 - 2013-07-16 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\{0B1E31F6-97D5-45DA-BC53-79E0649C1467}
2013-07-15 22:41 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-15 22:22 - 2012-07-01 19:52 - 00000000 ____D C:\Windows\Minidump
2013-07-15 20:23 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-07-15 11:01 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu
2013-07-15 10:49 - 2013-07-14 21:35 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 22:37 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-07-14 22:36 - 2011-07-28 13:36 - 00659690 _____ C:\Windows\system32\perfh007.dat
2013-07-14 22:36 - 2011-07-28 13:36 - 00132970 _____ C:\Windows\system32\perfc007.dat
2013-07-14 22:36 - 2009-07-14 07:13 - 01513970 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:37 - 2013-06-23 13:19 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:57 - 2013-07-13 23:11 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:38 - 2009-07-14 06:45 - 04955680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-14 20:35 - 2013-05-16 07:27 - 00054368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:33 - 2012-03-02 19:52 - 00000000 ____D C:\Program Files (x86)\Orbitdownloader
2013-07-14 20:28 - 2011-12-30 18:18 - 00000000 ____D C:\Windows\SysWOW64\unknown
2013-07-14 20:27 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2013-07-14 20:27 - 2011-04-19 14:24 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:20 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 19:46 - 2013-02-08 22:42 - 00000000 ____D C:\Program Files (x86)\Freecom
2013-07-14 19:46 - 2011-09-11 17:47 - 00000000 ____D C:\ProgramData\WinZip
2013-07-14 13:30 - 2012-08-06 10:29 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-14 12:45 - 2012-09-23 12:31 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-07-14 12:45 - 2011-08-21 12:11 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-14 12:44 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-14 12:33 - 2011-04-19 14:24 - 00000000 ____D C:\ProgramData\Adobe
2013-07-14 12:29 - 2013-07-14 12:30 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 12:09 - 2013-07-01 21:11 - 00000000 ____D C:\Windows\erdnt
2013-07-14 11:15 - 2013-07-14 11:14 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-14 01:42 - 2013-07-16 23:31 - 01777839 _____ (Farbar) C:\Users\JD\Desktop\FRST64.exe
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:37 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:40 - 2013-07-13 21:35 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:58 - 2013-07-13 19:57 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-07 19:36 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-02 20:24 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-02 20:16 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:38 - 2013-07-01 21:13 - 00000000 ____D C:\1-ComboFix
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:47 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:27 - 2013-06-23 13:47 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-28 18:25 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-28 13:42 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-26 19:12 - 2013-06-26 19:11 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-24 00:57 - 2011-07-28 22:40 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-23 22:37 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 20:22 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 19:32 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 18:13 - 2011-07-29 20:16 - 00000403 _____ C:\Windows\ODBC.INI
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 _____ C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:20 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00001451 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00001417 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-22 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-22 15:28 - 2013-05-08 15:26 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-18 19:14 - 2011-07-30 21:00 - 00000000 ____D C:\Users\jörg\AppData\Local\Adobe
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}
2013-06-16 17:32 - 2013-06-16 17:32 - 00000000 ____D C:\Users\jörg\AppData\Local\{267C70E8-5B72-45D7-9CDF-DECD5E6E3A5C}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---

Also meinen Accout spinnt IE partiell immer noch ...wenn ich Euer board aufrufe und mich einloggen will versucht er immer wieder die Site zu öffnen ...klappt aber nicht ...habe abgebrochen

Hier nun das Log von User 2
Hier sieht alles gut aus
Startsite kann geändert werden
Automatischer login vom Googleaccount funzt auch
Kann mich sogar ohne Probleme bei Euch einloggen und schreibe ...wie du siehst

Hier das Log

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by Manu (ATTENTION: The logged in user is not administrator) on 16-07-2013 23:46:25
Running from C:\Users\Manu\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(OpenOffice.org) D:\open office\program\soffice.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(OpenOffice.org) D:\open office\program\soffice.bin
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKCU\...\Run: [Copernic Desktop Search - Home] - "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
HKCU\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-07-29] (Google Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] - "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - "D:\I tunes\iTunesHelper.exe" [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-05-16] (Kaspersky Lab ZAO)
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [356376 2013-05-16] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)
Startup: C:\Users\Manu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> D:\open office\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\bin\ssv.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\bin\jp2ssv.dll No File
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\Neuer Ordner\bin\ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: delta Helper Object - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.21.5\bh\delta.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\Neuer Ordner\bin\jp2ssv.dll No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKLM-x32 - Delta Toolbar - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.21.5\deltaTlbr.dll No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Manu\AppData\Roaming\Mozilla\Firefox\Profiles\pea0rt3t.default
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - D:\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\java\Neuer Ordner\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF HKCU\...\Firefox\Extensions: [{682f771b-e90c-4be5-aea0-04d05076d71e}] D:\search\Copernic Desktop Search - Home\Firefox100Connector
FF StartMenuInternet: FIREFOX.EXE - D:\firefox\firefox.exe

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\20.0.1132.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\I tunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (YouTube) - C:\Users\Manu\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\Manu\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\Manu\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\Manu\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-05-16] (Kaspersky Lab ZAO)
R2 BrowserDefendert; C:\ProgramData\BrowserDefender\2.6.1339.144\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserDefender.exe [2827728 2013-05-23] ()
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-05-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-05-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-16] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-16 23:46 - 2013-07-14 01:42 - 01777839 _____ (Farbar) C:\Users\Manu\Desktop\FRST64.exe
2013-07-16 15:35 - 2013-07-16 15:35 - 00000000 ____D C:\Users\Manu\AppData\Local\{B64A4DEB-B27C-4F38-A72E-9B7CE1D470FD}
2013-07-15 22:33 - 2013-07-16 23:23 - 00000000 ____D C:\FRST
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:35 - 2013-07-15 10:49 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 21:06 - 2013-07-14 21:06 - 00013324 _____ C:\Users\Manu\Desktop\excel.lnk
2013-07-14 20:57 - 2013-07-14 20:57 - 00000000 ____D C:\Users\Manu\AppData\Local\{829D777B-F4F1-41FB-A5B6-50336FD178F9}
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:02 - 2013-05-16 07:27 - 00064856 _____ (Kaspersky Lab) C:\Windows\system32\klfphc.dll
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 20:00 - 2013-05-16 07:27 - 00620128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-07-14 20:00 - 2013-05-16 07:27 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-07-14 19:24 - 2013-07-14 19:24 - 00000000 ____D C:\Users\Manu\Music\Documents\Symantec
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 13:03 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-13 23:11 - 2013-07-14 20:57 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:35 - 2013-07-13 21:40 - 00000000 ____D C:\Windows\system32\MRT
2013-07-10 17:11 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 17:11 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 17:11 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 17:11 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 17:11 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 17:11 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 17:11 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 17:11 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 17:11 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 17:11 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 17:11 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 17:11 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 17:11 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 16:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 16:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 16:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 16:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 16:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 16:19 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 16:19 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 16:12 - 2013-07-10 16:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{BB7EBC30-E2A3-44B2-9E39-135E0D5B4566}
2013-07-09 16:13 - 2013-07-09 16:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{57DDD5C2-D4F8-4F1C-9371-FE8588387495}
2013-07-08 16:10 - 2013-07-08 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{D0BA7700-6E2C-4337-A565-9E53F138F503}
2013-07-05 16:10 - 2013-07-05 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{C6CBFB65-4F96-4E70-B4BC-024DCA10699E}
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 16:32 - 2013-07-03 16:33 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:13 - 2013-07-01 21:38 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:11 - 2013-07-14 12:09 - 00000000 ____D C:\Windows\erdnt
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-07-07 19:36 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:02 - 2013-07-13 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:21 - 2013-06-23 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 13:19 - 2013-06-30 16:21 - 00000000 ____D C:\Users\JD
2013-06-23 13:19 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 13:19 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2011-04-19 14:25 - 00000000 ____D C:\Users\JD\AppData\Roaming\Macromedia
2013-06-23 13:19 - 2011-04-19 13:33 - 00000000 ____D C:\Users\JD\AppData\Roaming\Intel Corporation
2013-06-23 13:19 - 2011-04-19 13:31 - 00000000 ____D C:\Users\JD\AppData\Roaming\InstallShield
2013-06-23 13:19 - 2010-11-21 04:50 - 00000020 ___SH C:\Users\JD\ntuser.ini
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:55 - 2013-06-20 14:56 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}
2013-06-18 22:34 - 2013-07-16 23:43 - 00000000 ____D C:\ProgramData\Kaspersky Lab

==================== One Month Modified Files and Folders =======

2013-07-16 23:43 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-16 23:43 - 2011-07-29 21:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-16 23:30 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-16 23:30 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-16 23:26 - 2011-07-28 03:43 - 01783196 _____ C:\Windows\WindowsUpdate.log
2013-07-16 23:25 - 2012-07-18 18:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-16 23:25 - 2011-07-29 21:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-16 23:23 - 2013-07-15 22:33 - 00000000 ____D C:\FRST
2013-07-16 23:22 - 2010-11-21 05:47 - 00649632 _____ C:\Windows\PFRO.log
2013-07-16 23:22 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-16 23:22 - 2009-07-14 06:51 - 00154530 _____ C:\Windows\setupact.log
2013-07-16 15:43 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu\AppData\Local\Adobe
2013-07-16 15:35 - 2013-07-16 15:35 - 00000000 ____D C:\Users\Manu\AppData\Local\{B64A4DEB-B27C-4F38-A72E-9B7CE1D470FD}
2013-07-15 22:41 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-15 22:22 - 2012-07-01 19:52 - 00000000 ____D C:\Windows\Minidump
2013-07-15 20:23 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-07-15 11:01 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu
2013-07-15 10:49 - 2013-07-14 21:35 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 22:36 - 2011-07-28 13:36 - 00659690 _____ C:\Windows\system32\perfh007.dat
2013-07-14 22:36 - 2011-07-28 13:36 - 00132970 _____ C:\Windows\system32\perfc007.dat
2013-07-14 22:36 - 2009-07-14 07:13 - 01513970 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:35 - 2012-06-26 13:44 - 00000000 ____D C:\Users\Manu\AppData\Local\Google
2013-07-14 21:06 - 2013-07-14 21:06 - 00013324 _____ C:\Users\Manu\Desktop\excel.lnk
2013-07-14 20:57 - 2013-07-14 20:57 - 00000000 ____D C:\Users\Manu\AppData\Local\{829D777B-F4F1-41FB-A5B6-50336FD178F9}
2013-07-14 20:57 - 2013-07-13 23:11 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:53 - 2011-07-28 22:54 - 00073384 _____ C:\Users\Manu\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:38 - 2009-07-14 06:45 - 04955680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-14 20:35 - 2013-05-16 07:27 - 00054368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2013-07-14 20:34 - 2013-07-14 20:34 - 00000000 ____D C:\ProgramData\BrowserDefender
2013-07-14 20:33 - 2012-03-02 19:52 - 00000000 ____D C:\Program Files (x86)\Orbitdownloader
2013-07-14 20:28 - 2011-12-30 18:18 - 00000000 ____D C:\Windows\SysWOW64\unknown
2013-07-14 20:27 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2013-07-14 20:27 - 2011-04-19 14:24 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:20 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 19:46 - 2013-02-08 22:42 - 00000000 ____D C:\Program Files (x86)\Freecom
2013-07-14 19:46 - 2011-09-11 17:47 - 00000000 ____D C:\ProgramData\WinZip
2013-07-14 19:24 - 2013-07-14 19:24 - 00000000 ____D C:\Users\Manu\Music\Documents\Symantec
2013-07-14 13:30 - 2012-08-06 10:29 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-14 12:45 - 2012-09-23 12:31 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-07-14 12:45 - 2011-08-21 12:11 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-14 12:44 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-14 12:33 - 2011-04-19 14:24 - 00000000 ____D C:\ProgramData\Adobe
2013-07-14 12:29 - 2013-07-14 12:30 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 12:09 - 2013-07-01 21:11 - 00000000 ____D C:\Windows\erdnt
2013-07-14 01:42 - 2013-07-16 23:46 - 01777839 _____ (Farbar) C:\Users\Manu\Desktop\FRST64.exe
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:37 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:40 - 2013-07-13 21:35 - 00000000 ____D C:\Windows\system32\MRT
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 16:12 - 2013-07-10 16:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{BB7EBC30-E2A3-44B2-9E39-135E0D5B4566}
2013-07-09 16:13 - 2013-07-09 16:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{57DDD5C2-D4F8-4F1C-9371-FE8588387495}
2013-07-08 16:10 - 2013-07-08 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{D0BA7700-6E2C-4337-A565-9E53F138F503}
2013-07-07 19:36 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-07-05 16:10 - 2013-07-05 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{C6CBFB65-4F96-4E70-B4BC-024DCA10699E}
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 16:33 - 2013-07-03 16:32 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 20:24 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-02 20:16 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:38 - 2013-07-01 21:13 - 00000000 ____D C:\1-ComboFix
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 14:39 - 2011-07-29 21:41 - 00000000 ____D C:\Users\Manu\AppData\Local\FreePDF_XP
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}
2013-06-28 13:45 - 2013-06-28 13:45 - 00000000 ____D C:\Users\Manu\AppData\Local\{CF15F97D-FD2A-4921-9620-F46E5FAE8FE9}
2013-06-28 13:42 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-27 15:46 - 2013-06-27 15:46 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D30D727-0318-40CE-BBBF-2EE5696849ED}
2013-06-26 16:22 - 2013-06-26 16:22 - 00000000 ____D C:\Users\Manu\AppData\Local\{12172258-93F8-4732-B7DB-EA3ABDD86310}
2013-06-25 19:12 - 2013-06-25 19:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{81026923-5E18-4EA7-B18D-3CD51D7B2524}
2013-06-24 15:49 - 2013-06-24 15:49 - 00000000 ____D C:\Users\Manu\AppData\Local\{BFEDC1D9-3EBA-4CCE-8A01-0AC2B1BE3311}
2013-06-24 00:57 - 2011-07-28 22:40 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-23 22:37 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 20:40 - 2013-06-23 20:40 - 00000000 ____D C:\Users\Manu\AppData\Local\{E3FEFA46-4EE9-4B5F-82AC-51C42AEFCFA8}
2013-06-23 19:32 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 18:13 - 2011-07-29 20:16 - 00000403 _____ C:\Windows\ODBC.INI
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:20 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-22 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-22 15:28 - 2013-05-08 15:26 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-21 17:06 - 2013-06-21 17:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{58054010-D9C4-493A-BA5C-ECC6AB248295}
2013-06-20 14:56 - 2013-06-20 14:55 - 00000000 ____D C:\Users\Manu\AppData\Local\{20F75D8B-C59D-4957-B684-2730AE880216}
2013-06-19 14:43 - 2013-06-19 14:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{EB4454CD-9472-471D-82BD-C8AC2DC6FADA}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
--- --- ---

--- --- ---

schrauber 17.07.2013 08:17
Auf dem Profil mit den Problemen bitte nochmal AdwCleaner laufen lassen und ein frisches FRST log posten.

Indexation 17.07.2013 22:37
Adw-Cleaner ist durch
Hier ist das log von dem User der spinnt :headbang:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013
Ran by JD (ATTENTION: The logged in user is not administrator) on 17-07-2013 23:33:13
Running from C:\Users\JD\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(CyberLink) C:\Program Files (x86)\CyberLink\MediaEspresso\DeviceDetector\DeviceDetector.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKCU\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-07-29] (Google Inc.)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] - "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - "D:\I tunes\iTunesHelper.exe" [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-05-16] (Kaspersky Lab ZAO)
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [356376 2013-05-16] ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\bin\ssv.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\bin\jp2ssv.dll No File
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\Neuer Ordner\bin\ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\Neuer Ordner\bin\jp2ssv.dll No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Toolbar: HKCU - No Name - {213C8ED6-1D78-4D8F-8729-25006AA86A76} -  No File
Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\JD\AppData\Roaming\Mozilla\Firefox\Profiles\ezn4fbq5.default
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - D:\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\java\Neuer Ordner\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF StartMenuInternet: FIREFOX.EXE - D:\firefox\firefox.exe

Chrome:
=======

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-05-16] (Kaspersky Lab ZAO)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 lmhosts; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 MBAMScheduler; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NlaSvc; C:\Windows\System32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 nsi; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)
S3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [x]

==================== Drivers (Whitelisted) ====================

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-05-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-05-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-16] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-17 23:33 - 2013-07-14 01:42 - 01777839 _____ (Farbar) C:\Users\JD\Desktop\FRST64.exe
2013-07-17 20:24 - 2013-07-17 20:25 - 00000000 ____D C:\Users\JD\AppData\Local\{DBF6468B-3C1E-4302-B760-38B54B6F5AFB}
2013-07-16 20:22 - 2013-07-16 20:23 - 00000000 ____D C:\Users\JD\AppData\Local\{0B1E31F6-97D5-45DA-BC53-79E0649C1467}
2013-07-15 22:33 - 2013-07-16 23:23 - 00000000 ____D C:\FRST
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:35 - 2013-07-15 10:49 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:02 - 2013-05-16 07:27 - 00064856 _____ (Kaspersky Lab) C:\Windows\system32\klfphc.dll
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 20:00 - 2013-05-16 07:27 - 00620128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-07-14 20:00 - 2013-05-16 07:27 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 13:03 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 11:14 - 2013-07-14 11:15 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-13 23:11 - 2013-07-14 20:57 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:35 - 2013-07-13 21:40 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:57 - 2013-07-13 19:58 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-10 17:11 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 17:11 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 17:11 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 17:11 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 17:11 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 17:11 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 17:11 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 17:11 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 17:11 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 17:11 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 17:11 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 17:11 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 17:11 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 16:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 16:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 16:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 16:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 16:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 16:19 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 16:19 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:13 - 2013-07-01 21:38 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:11 - 2013-07-14 12:09 - 00000000 ____D C:\Windows\erdnt
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:40 - 2013-06-30 16:47 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-07-07 19:36 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:02 - 2013-07-17 23:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 15:57 - 2013-06-04 20:36 - 00001609 _____ C:\Users\JD\Desktop\Zugangsdaten.lnk
2013-06-29 15:57 - 2013-03-10 13:26 - 00001333 _____ C:\Users\JD\Desktop\IMG_3288.JPG - Verknüpfung.lnk
2013-06-29 15:57 - 2012-09-05 20:27 - 00001109 _____ C:\Users\JD\Desktop\audacity..lnk
2013-06-29 15:57 - 2012-03-22 22:05 - 00000855 _____ C:\Users\JD\Desktop\TotalMedia.lnk
2013-06-29 15:57 - 2012-01-04 17:46 - 00001010 _____ C:\Users\JD\Desktop\Teamviewer.lnk
2013-06-29 15:57 - 2011-11-08 20:32 - 00000541 _____ C:\Users\JD\Desktop\Profi cash.lnk
2013-06-29 15:57 - 2011-07-30 22:45 - 00000967 _____ C:\Users\JD\Desktop\WORD.lnk
2013-06-29 15:57 - 2011-07-30 22:41 - 00000975 _____ C:\Users\JD\Desktop\EXCEL -.lnk
2013-06-29 15:57 - 2011-07-30 21:08 - 00000355 _____ C:\Users\JD\Desktop\home.lnk
2013-06-26 19:11 - 2013-06-26 19:12 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 _____ C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:47 - 2013-06-29 15:27 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:24 - 2013-06-23 13:30 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 22:37 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:19 - 2013-07-14 22:37 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-06-23 13:19 - 2013-07-14 21:37 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-23 13:19 - 2013-06-30 16:21 - 00000000 ____D C:\Users\JD
2013-06-23 13:19 - 2013-06-28 18:25 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-23 13:19 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 13:19 - 2013-06-23 18:30 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 13:19 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00001451 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00001417 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-23 13:19 - 2011-04-19 14:30 - 00000000 ____D C:\Users\JD\AppData\Local\Cyberlink
2013-06-23 13:19 - 2011-04-19 14:25 - 00000000 ____D C:\Users\JD\AppData\Roaming\Macromedia
2013-06-23 13:19 - 2011-04-19 13:33 - 00000000 ____D C:\Users\JD\AppData\Roaming\Intel Corporation
2013-06-23 13:19 - 2011-04-19 13:31 - 00000000 ____D C:\Users\JD\AppData\Roaming\InstallShield
2013-06-23 13:19 - 2010-11-21 04:50 - 00000020 ___SH C:\Users\JD\ntuser.ini
2013-06-23 13:19 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-06-23 13:19 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-06-18 22:34 - 2013-07-17 23:29 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}

==================== One Month Modified Files and Folders =======

2013-07-17 23:29 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-17 23:28 - 2011-07-29 21:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-17 23:28 - 2010-11-21 05:47 - 00650770 _____ C:\Windows\PFRO.log
2013-07-17 23:28 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-17 23:28 - 2009-07-14 06:51 - 00154922 _____ C:\Windows\setupact.log
2013-07-17 23:27 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-07-17 23:27 - 2011-07-28 03:43 - 01822934 _____ C:\Windows\WindowsUpdate.log
2013-07-17 23:25 - 2012-07-18 18:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-17 23:25 - 2011-07-29 21:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-17 20:29 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-17 20:29 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-17 20:25 - 2013-07-17 20:24 - 00000000 ____D C:\Users\JD\AppData\Local\{DBF6468B-3C1E-4302-B760-38B54B6F5AFB}
2013-07-17 15:47 - 2011-07-28 13:36 - 00659690 _____ C:\Windows\system32\perfh007.dat
2013-07-17 15:47 - 2011-07-28 13:36 - 00132970 _____ C:\Windows\system32\perfc007.dat
2013-07-17 15:47 - 2009-07-14 07:13 - 01513970 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-16 23:23 - 2013-07-15 22:33 - 00000000 ____D C:\FRST
2013-07-16 20:23 - 2013-07-16 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\{0B1E31F6-97D5-45DA-BC53-79E0649C1467}
2013-07-15 22:41 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-15 22:22 - 2012-07-01 19:52 - 00000000 ____D C:\Windows\Minidump
2013-07-15 20:23 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-07-15 11:01 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu
2013-07-15 10:49 - 2013-07-14 21:35 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 22:37 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:37 - 2013-06-23 13:19 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:57 - 2013-07-13 23:11 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:38 - 2009-07-14 06:45 - 04955680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-14 20:35 - 2013-05-16 07:27 - 00054368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2013-07-14 20:33 - 2012-03-02 19:52 - 00000000 ____D C:\Program Files (x86)\Orbitdownloader
2013-07-14 20:28 - 2011-12-30 18:18 - 00000000 ____D C:\Windows\SysWOW64\unknown
2013-07-14 20:27 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2013-07-14 20:27 - 2011-04-19 14:24 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:20 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 19:46 - 2013-02-08 22:42 - 00000000 ____D C:\Program Files (x86)\Freecom
2013-07-14 19:46 - 2011-09-11 17:47 - 00000000 ____D C:\ProgramData\WinZip
2013-07-14 13:30 - 2012-08-06 10:29 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-14 12:45 - 2012-09-23 12:31 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-07-14 12:45 - 2011-08-21 12:11 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-14 12:44 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-14 12:33 - 2011-04-19 14:24 - 00000000 ____D C:\ProgramData\Adobe
2013-07-14 12:29 - 2013-07-14 12:30 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 12:09 - 2013-07-01 21:11 - 00000000 ____D C:\Windows\erdnt
2013-07-14 11:15 - 2013-07-14 11:14 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-14 01:42 - 2013-07-17 23:33 - 01777839 _____ (Farbar) C:\Users\JD\Desktop\FRST64.exe
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:40 - 2013-07-13 21:35 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:58 - 2013-07-13 19:57 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-07 19:36 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-02 20:24 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-02 20:16 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:38 - 2013-07-01 21:13 - 00000000 ____D C:\1-ComboFix
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:47 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:27 - 2013-06-23 13:47 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-28 18:25 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Apple Computer
2013-06-28 13:42 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-06-26 19:12 - 2013-06-26 19:11 - 00000000 ____D C:\Users\JD\AppData\Local\{C5EB48C1-30C5-4AEF-9AD7-D4E702E19C4D}
2013-06-24 00:57 - 2011-07-28 22:40 - 78277128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-23 22:37 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Roaming\Windows Live Writer
2013-06-23 20:22 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live Writer
2013-06-23 19:32 - 2013-06-23 19:32 - 00000000 ____D C:\Users\JD\AppData\Local\Apple
2013-06-23 19:32 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Apple Computer
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\Adobe
2013-06-23 18:30 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Adobe
2013-06-23 18:24 - 2013-06-23 18:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\EPSON
2013-06-23 18:23 - 2013-06-23 18:23 - 00000000 _____ C:\Users\JD\Sti_Trace.log
2013-06-23 18:13 - 2011-07-29 20:16 - 00000403 _____ C:\Windows\ODBC.INI
2013-06-23 14:39 - 2013-06-23 14:39 - 00001502 _____ C:\Users\JD\Desktop\Windows Live Mail.lnk
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Roaming\Google
2013-06-23 13:30 - 2013-06-23 13:24 - 00000000 ____D C:\Users\JD\AppData\Local\Google
2013-06-23 13:21 - 2013-06-23 13:21 - 00000000 ____D C:\Users\JD\AppData\Local\{7D8C5629-8D8E-40C7-8407-BAAA224646DF}
2013-06-23 13:20 - 2013-06-23 13:20 - 00000000 ____D C:\Users\JD\AppData\Local\ArcSoft
2013-06-23 13:20 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Roaming\ArcSoft
2013-06-23 13:19 - 2013-06-23 13:19 - 00001451 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00001417 _____ C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Vorlagen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Startmenü
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Netzwerkumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Lokale Einstellungen
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Eigene Dateien
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Druckumgebung
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Musik
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Documents\Eigene Bilder
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Verlauf
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\AppData\Local\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 __SHD C:\Users\JD\Anwendungsdaten
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ___RD C:\Users\JD\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-06-23 13:19 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\VirtualStore
2013-06-22 19:11 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-22 15:28 - 2013-05-08 15:26 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-06-18 19:14 - 2011-07-30 21:00 - 00000000 ____D C:\Users\jörg\AppData\Local\Adobe
2013-06-18 19:07 - 2013-06-18 19:07 - 00000000 ____D C:\Users\jörg\AppData\Local\{A2442D88-5E58-49A3-A333-204F436735D8}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== End Of Log ============================
--- --- ---

schrauber 18.07.2013 08:17
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
AppInit_DLLs-x32: c:\progra~3\browse~1\261339~1.144\{c16c1~1\browse~1.dll [356376 2013-05-16] ()
StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\bin\ssv.dll No File
BHO-x32: Octh Class - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files (x86)\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\java\Neuer Ordner\bin\ssv.dll No File
Toolbar: HKLM-x32 - Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files (x86)\Orbitdownloader\GrabPro.dll ()
Toolbar: HKCU - No Name - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} -  No File
Toolbar: HKCU - No Name - {213C8ED6-1D78-4D8F-8729-25006AA86A76} -  No File
Toolbar: HKCU - No Name - {7E111A5C-3D11-4F56-9463-5310C3C69025} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
FF NewTab: hxxp://www1.delta-search.com/?babsrc=NT_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=BCDE2AF46AD5266C&affID=121563&tsp=4943
S3 rpcapd; "%ProgramFiles(x86)%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles(x86)%\WinPcap\rpcapd.ini" [x]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Nochmal testen.

Indexation 24.07.2013 19:09
bin unterwegs - melde mich in Kürze ;-)

Generell über Admin oder in dem Account der spinnt und dort als admin ?

schrauber 25.07.2013 07:15
Der Account der spinnt, als Admin :)

Indexation 29.07.2013 20:15
Hier das Log nach dem Fix :
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 14-07-2013
Ran by admin at 2013-07-29 21:09:17 Run:3
Running from C:\Users\Manu\Desktop
Boot Mode: Normal
==============================================

HKLM\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\SOFTWARE\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command\\Default => Value was restored successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully.
HKCR\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{000123B4-9B42-4900-B3F7-F4B073EFC214} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{000123B4-9B42-4900-B3F7-F4B073EFC214} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{326E768D-4182-46FD-9C16-1449A49795F4} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{326E768D-4182-46FD-9C16-1449A49795F4} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Value deleted successfully.
HKCR\Wow6432Node\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Value not found.
HKCR\CLSID\{C55BBCD6-41AD-48AD-9953-3609C48EACC7} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{213C8ED6-1D78-4D8F-8729-25006AA86A76} => Value not found.
HKCR\CLSID\{213C8ED6-1D78-4D8F-8729-25006AA86A76} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7E111A5C-3D11-4F56-9463-5310C3C69025} => Value not found.
HKCR\CLSID\{7E111A5C-3D11-4F56-9463-5310C3C69025} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value not found.
HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found.
Firefox newtab deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
Firefox homepage deleted successfully.
rpcapd => Service deleted successfully.

==== End of Fixlog ====
Neuer Scan von FRST --Logfile :

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 14-07-2013 (ATTENTION: FRST version is 15 days old)
Ran by admin (administrator) on 29-07-2013 21:10:33
Running from C:\Users\Manu\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe
() C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Star Finanz - Software Entwicklung und Vertriebs GmbH) C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Malwarebytes Corporation) D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamgui.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Philips) D:\prestigo\2.1.7.0\Configo.exe
(ArcSoft, Inc.) D:\TV\TMMonitor.exe
(OpenOffice.org) D:\open office\program\soffice.exe
(OpenOffice.org) D:\open office\program\soffice.bin
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
(Apple Inc.) D:\I tunes\iTunesHelper.exe
(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Acer Incorporated) C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerEvent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_7_700_224_ActiveX.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [11785832 2011-03-10] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2280232 2010-07-29] (Synaptics Incorporated)
HKLM\...\Run: [AdobeAAMUpdater-1.0] - "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [446392 2012-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [Power Management] - C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerTray.exe [1796200 2011-02-22] (Acer Incorporated)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Runonce: [Report] - \AdwCleaner[S1].txt [x]
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-13] (Intel Corporation)
HKLM-x32\...\Run: [BackupManagerTray] - "C:\Program Files (x86)\NTI\Packard Bell MyBackup\BackupManagerTray.exe" -h -k [295744 2011-03-09] (NTI Corporation)
HKLM-x32\...\Run: [StartCCC] - "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [336384 2011-03-31] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [LManager] - C:\Program Files (x86)\Launch Manager\LManager.exe [1081424 2011-03-14] (Dritek System Inc.)
HKLM-x32\...\Run: [FreePDF Assistant] - "C:\Program Files (x86)\FreePDF_XP\fpassist.exe" [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [ArcSoft Connection Service] - C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [SwitchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AdobeCS6ServiceManager] - "C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe" -launchedbylogin [1073312 2012-03-09] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] - "D:\I tunes\iTunesHelper.exe" [x]
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [AVP] - "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [356376 2013-05-16] (Kaspersky Lab ZAO)
HKU\JD\...\Run: [swg] - "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [39408 2011-07-29] (Google Inc.)
HKU\jörg\...\Run: [EPSON Stylus SX200 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEFE.EXE /FU "C:\Windows\TEMP\E_S5BF5.tmp" /EF "HKCU" [x] <===== ATTENTION
HKU\jörg\...\Run: [Copernic Desktop Search - Home] - "D:\search\Copernic Desktop Search - Home\DesktopSearchService.exe" /tray [x]
HKU\jörg\...\Run: [Norton Download Manager{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}] - C:\Users\Public\Downloads\Norton\{NBRT41-B34-Retail-4abb-B07C-C084B04B4F12}\NBRT-Retail-Downloader.exe /m [x]
Startup: C:\ProgramData\Start Menu\Programs\Startup\Philips Configo.lnk
ShortcutTarget: Philips Configo.lnk -> D:\prestigo\2.1.7.0\Configo.exe (Philips)
Startup: C:\ProgramData\Start Menu\Programs\Startup\TMMonitor.lnk
ShortcutTarget: TMMonitor.lnk -> D:\TV\TMMonitor.exe (ArcSoft, Inc.)
Startup: C:\Users\Manu\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> D:\open office\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://packardbell.msn.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://packardbell.msn.com
BHO: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\bin\jp2ssv.dll No File
BHO: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
BHO-x32: Content Blocker Plugin - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Virtual Keyboard Plugin - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\java\Neuer Ordner\bin\jp2ssv.dll No File
BHO-x32: URL Advisor Plugin - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\4b8kq9k8.default
FF NetworkProxy: "no_proxies_on", "*.local"
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - D:\java\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\I tunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - D:\java\Neuer Ordner\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [crossriderapp1950@crossrider.com] C:\Users\admin\AppData\Local\RewardsArcadeSuite\1950\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions:  C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF Extension: Kaspersky URL Advisor - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [virtual_keyboard@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF Extension: Virtual Keyboard - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [content_blocker@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF Extension: Content Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [anti_banner@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF Extension: Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com
FF HKLM-x32\...\Firefox\Extensions: [online_banking@kaspersky.com] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF Extension: Safe Money - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com
FF StartMenuInternet: FIREFOX.EXE - D:\firefox\firefox.exe

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\24.0.1312.57\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.220.4) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U22) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (WildTangent Games App Presence Detector) - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - D:\I tunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (YouTube) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0
CHR Extension: (Google Search) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0
CHR Extension: (DivX Plus Web Player HTML5 \u003Cvideo\u003E) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0
CHR Extension: (Gmail) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [356376 2013-05-16] (Kaspersky Lab ZAO)
R2 ePowerSvc; C:\Program Files\Packard Bell\Packard Bell Power Management\ePowerSvc.exe [873064 2011-02-22] (Acer Incorporated)
R2 GREGService; C:\Program Files (x86)\Packard Bell\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
R2 Live Updater Service; C:\Program Files\Packard Bell\Packard Bell Updater\UpdaterService.exe [244624 2011-01-31] (Acer Incorporated)
R2 MBAMScheduler; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; D:\Security\Malwarebytes Anti-Malware 1.75\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Packard Bell MyBackup\IScheduleSvc.exe [257344 2011-03-09] (NTI Corporation)
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [244904 2010-10-28] ()
R2 StarMoney 8.0 OnlineUpdate; C:\Program Files (x86)\StarMoney 8.0\ouservice\StarMoneyOnlineUpdate.exe [699680 2012-12-21] (Star Finanz - Software Entwicklung und Vertriebs GmbH)

==================== Drivers (Whitelisted) ====================

R0 kl1; C:\Windows\System32\DRIVERS\kl1.sys [458584 2012-06-19] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [620128 2013-05-16] (Kaspersky Lab ZAO)
R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [28504 2012-08-02] (Kaspersky Lab ZAO)
R3 klkbdflt; C:\Windows\System32\DRIVERS\klkbdflt.sys [29016 2013-05-16] (Kaspersky Lab)
R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [29528 2013-05-16] (Kaspersky Lab)
R1 kltdi; C:\Windows\System32\DRIVERS\kltdi.sys [54368 2013-07-14] (Kaspersky Lab ZAO)
R1 kneps; C:\Windows\System32\DRIVERS\kneps.sys [178448 2013-05-16] (Kaspersky Lab ZAO)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NPF; C:\Windows\System32\drivers\npf.sys [36600 2013-03-01] (Riverbed Technology, Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-29 21:04 - 2013-07-14 01:42 - 01777839 _____ (Farbar) C:\Users\Manu\Desktop\FRST64.exe
2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Malwarebytes
2013-07-29 20:46 - 2013-07-29 20:46 - 00000000 ____D C:\Users\JD\AppData\Local\FreePDF_XP
2013-07-29 19:41 - 2013-07-29 19:41 - 00059904 _____ C:\Users\JD\Desktop\ausgabentext.xls
2013-07-29 16:35 - 2013-07-29 16:35 - 00000000 ____D C:\Users\Manu\AppData\Local\{177CFEF0-5C0B-43C1-821A-DB61B4898DDF}
2013-07-26 16:14 - 2013-07-26 16:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{F82E1D90-8243-43AF-9BE9-5792C893C65F}
2013-07-25 16:02 - 2013-07-25 16:02 - 00000000 ____D C:\Users\Manu\AppData\Local\{96C16BC3-88B7-4444-B2BB-BC5B2A6E590A}
2013-07-24 19:47 - 2013-07-24 19:47 - 00000000 ____D C:\Users\JD\AppData\Local\{BF36E560-1455-49D9-8662-62CC7EF5A259}
2013-07-24 10:20 - 2013-07-24 10:20 - 00000000 ____D C:\Users\Manu\AppData\Local\{1EA7443D-57E0-4BBC-949E-F6EAE4A794C0}
2013-07-22 16:43 - 2013-07-22 16:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{5EBDCCE4-8400-4145-B8D2-692C157C71E5}
2013-07-17 23:34 - 2013-07-17 23:34 - 00046107 _____ C:\Users\JD\Desktop\FRST.txt
2013-07-17 23:26 - 2013-07-17 23:26 - 00012430 _____ C:\Users\admin\Desktop\AdwCleaner[R2].txt
2013-07-17 23:24 - 2013-07-17 23:24 - 00012495 _____ C:\Users\admin\Desktop\AdwCleaner[R1].txt
2013-07-17 20:24 - 2013-07-17 20:25 - 00000000 ____D C:\Users\JD\AppData\Local\{DBF6468B-3C1E-4302-B760-38B54B6F5AFB}
2013-07-17 15:42 - 2013-07-17 15:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{B119F44A-874C-4F45-9F72-037B36B58AE2}
2013-07-16 23:18 - 2013-07-14 01:42 - 01777839 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2013-07-16 20:22 - 2013-07-16 20:23 - 00000000 ____D C:\Users\JD\AppData\Local\{0B1E31F6-97D5-45DA-BC53-79E0649C1467}
2013-07-16 15:35 - 2013-07-16 15:35 - 00000000 ____D C:\Users\Manu\AppData\Local\{B64A4DEB-B27C-4F38-A72E-9B7CE1D470FD}
2013-07-15 22:33 - 2013-07-16 23:23 - 00000000 ____D C:\FRST
2013-07-15 22:22 - 2013-07-15 22:22 - 00270416 _____ C:\Windows\Minidump\071513-29842-01.dmp
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:35 - 2013-07-15 10:49 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 21:06 - 2013-07-14 21:06 - 00013324 _____ C:\Users\Manu\Desktop\excel.lnk
2013-07-14 20:57 - 2013-07-14 20:57 - 00000000 ____D C:\Users\Manu\AppData\Local\{829D777B-F4F1-41FB-A5B6-50336FD178F9}
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\Documents\My Weblog Posts
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\AppData\Local\{BF2CD784-DE2D-4D90-9A37-9DA3DBABBBF9}
2013-07-14 20:34 - 2013-07-14 20:34 - 00003380 _____ C:\Windows\System32\Tasks\EPUpdater
2013-07-14 20:33 - 2013-07-14 20:33 - 00001063 _____ C:\Users\admin\Desktop\Orbit.lnk
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:02 - 2013-05-16 07:27 - 00064856 _____ (Kaspersky Lab) C:\Windows\system32\klfphc.dll
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 20:00 - 2013-05-16 07:27 - 00620128 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klif.sys
2013-07-14 20:00 - 2013-05-16 07:27 - 00090208 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\klflt.sys
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 13:03 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-14 12:59 - 2013-07-14 12:59 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-14 12:49 - 2013-06-04 20:36 - 00001609 _____ C:\Users\admin\Desktop\Zugangsdaten.doc - Verknüpfung.lnk
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:30 - 2013-07-14 12:29 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:30 - 2013-07-14 12:29 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 11:14 - 2013-07-14 11:15 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-13 23:11 - 2013-07-18 00:15 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:35 - 2013-07-13 21:40 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:57 - 2013-07-13 19:58 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-10 17:11 - 2013-05-29 08:15 - 17829376 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 17:11 - 2013-05-29 07:50 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 17:11 - 2013-05-29 07:43 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 17:11 - 2013-05-29 07:36 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 17:11 - 2013-05-29 07:35 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 17:11 - 2013-05-29 07:34 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 07:33 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-10 17:11 - 2013-05-29 07:31 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-10 17:11 - 2013-05-29 07:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 07:27 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 17:11 - 2013-05-29 07:27 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 07:25 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 07:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 07:18 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 17:11 - 2013-05-29 03:56 - 12333568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 17:11 - 2013-05-29 03:50 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 17:11 - 2013-05-29 03:48 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-07-10 17:11 - 2013-05-29 03:41 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 17:11 - 2013-05-29 03:41 - 01104384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 17:11 - 2013-05-29 03:40 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-07-10 17:11 - 2013-05-29 03:38 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 17:11 - 2013-05-29 03:37 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-07-10 17:11 - 2013-05-29 03:36 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 17:11 - 2013-05-29 03:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 17:11 - 2013-05-29 03:33 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 17:11 - 2013-05-29 03:33 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-07-10 17:11 - 2013-05-29 03:29 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 16:19 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 16:19 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 16:19 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 16:19 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 16:19 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 16:19 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 16:19 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 16:12 - 2013-07-10 16:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{BB7EBC30-E2A3-44B2-9E39-135E0D5B4566}
2013-07-09 16:13 - 2013-07-09 16:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{57DDD5C2-D4F8-4F1C-9371-FE8588387495}
2013-07-08 16:10 - 2013-07-08 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{D0BA7700-6E2C-4337-A565-9E53F138F503}
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-05 16:10 - 2013-07-05 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{C6CBFB65-4F96-4E70-B4BC-024DCA10699E}
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-03 16:32 - 2013-07-03 16:33 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:13 - 2013-07-01 21:38 - 00000000 ____D C:\1-ComboFix
2013-07-01 21:11 - 2013-07-14 12:09 - 00000000 ____D C:\Windows\erdnt
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 16:48 - 2013-06-30 16:57 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:40 - 2013-06-30 16:47 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:27 - 2013-06-29 16:28 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:05 - 2013-07-07 19:36 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-06-29 16:02 - 2013-07-29 20:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:58 - 2013-06-30 19:09 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-29 15:57 - 2013-06-04 20:36 - 00001609 _____ C:\Users\JD\Desktop\Zugangsdaten.lnk
2013-06-29 15:57 - 2013-03-10 13:26 - 00001333 _____ C:\Users\JD\Desktop\IMG_3288.JPG - Verknüpfung.lnk
2013-06-29 15:57 - 2012-09-05 20:27 - 00001109 _____ C:\Users\JD\Desktop\audacity..lnk
2013-06-29 15:57 - 2012-03-22 22:05 - 00000855 _____ C:\Users\JD\Desktop\TotalMedia.lnk
2013-06-29 15:57 - 2012-01-04 17:46 - 00001010 _____ C:\Users\JD\Desktop\Teamviewer.lnk
2013-06-29 15:57 - 2011-11-08 20:32 - 00000541 _____ C:\Users\JD\Desktop\Profi cash.lnk
2013-06-29 15:57 - 2011-07-30 22:45 - 00000967 _____ C:\Users\JD\Desktop\WORD.lnk
2013-06-29 15:57 - 2011-07-30 22:41 - 00000975 _____ C:\Users\JD\Desktop\EXCEL -.lnk
2013-06-29 15:57 - 2011-07-30 21:08 - 00000355 _____ C:\Users\JD\Desktop\home.lnk
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}

==================== One Month Modified Files and Folders =======

2013-07-29 21:01 - 2013-07-29 21:01 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Malwarebytes
2013-07-29 21:01 - 2011-07-28 03:43 - 01986130 _____ C:\Windows\WindowsUpdate.log
2013-07-29 21:00 - 2013-06-18 22:34 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-07-29 21:00 - 2011-07-29 21:19 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-29 20:57 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-29 20:57 - 2009-07-14 06:45 - 00016752 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-29 20:49 - 2012-07-18 18:09 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-29 20:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-07-29 20:49 - 2009-07-14 06:51 - 00155706 _____ C:\Windows\setupact.log
2013-07-29 20:48 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\Orbit
2013-07-29 20:46 - 2013-07-29 20:46 - 00000000 ____D C:\Users\JD\AppData\Local\FreePDF_XP
2013-07-29 20:42 - 2012-07-18 18:09 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-29 20:42 - 2012-04-23 14:17 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-29 20:42 - 2011-08-17 18:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-29 20:41 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Local\Adobe
2013-07-29 20:25 - 2011-07-29 21:19 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-29 19:41 - 2013-07-29 19:41 - 00059904 _____ C:\Users\JD\Desktop\ausgabentext.xls
2013-07-29 16:41 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu\AppData\Local\Adobe
2013-07-29 16:35 - 2013-07-29 16:35 - 00000000 ____D C:\Users\Manu\AppData\Local\{177CFEF0-5C0B-43C1-821A-DB61B4898DDF}
2013-07-29 16:31 - 2013-02-10 18:05 - 00000000 ____D C:\Program Files (x86)\StarMoney 8.0
2013-07-26 16:14 - 2013-07-26 16:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{F82E1D90-8243-43AF-9BE9-5792C893C65F}
2013-07-25 16:05 - 2011-07-28 13:36 - 00659690 _____ C:\Windows\system32\perfh007.dat
2013-07-25 16:05 - 2011-07-28 13:36 - 00132970 _____ C:\Windows\system32\perfc007.dat
2013-07-25 16:05 - 2009-07-14 07:13 - 01513970 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-25 16:02 - 2013-07-25 16:02 - 00000000 ____D C:\Users\Manu\AppData\Local\{96C16BC3-88B7-4444-B2BB-BC5B2A6E590A}
2013-07-24 19:47 - 2013-07-24 19:47 - 00000000 ____D C:\Users\JD\AppData\Local\{BF36E560-1455-49D9-8662-62CC7EF5A259}
2013-07-24 10:20 - 2013-07-24 10:20 - 00000000 ____D C:\Users\Manu\AppData\Local\{1EA7443D-57E0-4BBC-949E-F6EAE4A794C0}
2013-07-22 16:43 - 2013-07-22 16:43 - 00000000 ____D C:\Users\Manu\AppData\Local\{5EBDCCE4-8400-4145-B8D2-692C157C71E5}
2013-07-20 19:14 - 2011-07-29 21:41 - 00000000 ____D C:\Users\Manu\AppData\Local\FreePDF_XP
2013-07-18 00:15 - 2013-07-13 23:11 - 00000000 ____D C:\Program Files (x86)\SpywareBlaster
2013-07-17 23:34 - 2013-07-17 23:34 - 00046107 _____ C:\Users\JD\Desktop\FRST.txt
2013-07-17 23:28 - 2010-11-21 05:47 - 00650770 _____ C:\Windows\PFRO.log
2013-07-17 23:26 - 2013-07-17 23:26 - 00012430 _____ C:\Users\admin\Desktop\AdwCleaner[R2].txt
2013-07-17 23:24 - 2013-07-17 23:24 - 00012495 _____ C:\Users\admin\Desktop\AdwCleaner[R1].txt
2013-07-17 20:25 - 2013-07-17 20:24 - 00000000 ____D C:\Users\JD\AppData\Local\{DBF6468B-3C1E-4302-B760-38B54B6F5AFB}
2013-07-17 15:43 - 2013-07-17 15:42 - 00000000 ____D C:\Users\Manu\AppData\Local\{B119F44A-874C-4F45-9F72-037B36B58AE2}
2013-07-16 23:23 - 2013-07-15 22:33 - 00000000 ____D C:\FRST
2013-07-16 20:23 - 2013-07-16 20:22 - 00000000 ____D C:\Users\JD\AppData\Local\{0B1E31F6-97D5-45DA-BC53-79E0649C1467}
2013-07-16 15:35 - 2013-07-16 15:35 - 00000000 ____D C:\Users\Manu\AppData\Local\{B64A4DEB-B27C-4F38-A72E-9B7CE1D470FD}
2013-07-15 22:41 - 2012-01-01 15:53 - 00000000 ____D C:\Users\admin\AppData\Roaming\Orbit
2013-07-15 22:22 - 2013-07-15 22:22 - 00270416 _____ C:\Windows\Minidump\071513-29842-01.dmp
2013-07-15 22:22 - 2012-07-01 19:52 - 00000000 ____D C:\Windows\Minidump
2013-07-15 11:01 - 2011-07-28 22:54 - 00000000 ____D C:\Users\Manu
2013-07-15 10:49 - 2013-07-14 21:35 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Google
2013-07-14 22:37 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD\AppData\Local\Windows Live
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 2.lnk
2013-07-14 22:29 - 2013-07-14 22:29 - 00001328 _____ C:\Users\JD\Desktop\Tai Chi 1.lnk
2013-07-14 21:51 - 2013-07-14 21:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Malwarebytes
2013-07-14 21:37 - 2013-06-23 13:19 - 00073384 _____ C:\Users\JD\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 21:35 - 2012-06-26 13:44 - 00000000 ____D C:\Users\Manu\AppData\Local\Google
2013-07-14 21:06 - 2013-07-14 21:06 - 00013324 _____ C:\Users\Manu\Desktop\excel.lnk
2013-07-14 20:57 - 2013-07-14 20:57 - 00000000 ____D C:\Users\Manu\AppData\Local\{829D777B-F4F1-41FB-A5B6-50336FD178F9}
2013-07-14 20:53 - 2013-07-14 20:53 - 00008224 _____ C:\Windows\system32\GDIPFONTCACHEV1.DAT
2013-07-14 20:53 - 2011-07-28 22:54 - 00073384 _____ C:\Users\Manu\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:38 - 2009-07-14 06:45 - 04955680 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\Documents\My Weblog Posts
2013-07-14 20:35 - 2013-07-14 20:35 - 00000000 ____D C:\Users\admin\AppData\Local\{BF2CD784-DE2D-4D90-9A37-9DA3DBABBBF9}
2013-07-14 20:35 - 2013-05-16 07:27 - 00054368 _____ (Kaspersky Lab ZAO) C:\Windows\system32\Drivers\kltdi.sys
2013-07-14 20:35 - 2011-08-07 17:32 - 00000000 ____D C:\Users\admin\AppData\Local\Windows Live Writer
2013-07-14 20:34 - 2013-07-14 20:34 - 00003380 _____ C:\Windows\System32\Tasks\EPUpdater
2013-07-14 20:33 - 2013-07-14 20:33 - 00001063 _____ C:\Users\admin\Desktop\Orbit.lnk
2013-07-14 20:33 - 2012-03-02 19:52 - 00000000 ____D C:\Program Files (x86)\Orbitdownloader
2013-07-14 20:28 - 2011-12-30 18:18 - 00000000 ____D C:\Windows\SysWOW64\unknown
2013-07-14 20:28 - 2011-07-28 22:25 - 00073384 _____ C:\Users\admin\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-14 20:27 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Roaming\Adobe
2013-07-14 20:27 - 2011-04-19 14:24 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-07-14 20:26 - 2013-07-14 20:26 - 00000000 ____D C:\Windows\SysWOW64\syncdb
2013-07-14 20:20 - 2011-07-29 21:03 - 00000000 ____D C:\ProgramData\FreePDF
2013-07-14 20:01 - 2013-07-14 20:01 - 00000000 ____D C:\Windows\ELAMBKUP
2013-07-14 20:00 - 2013-07-14 20:00 - 00000000 ____D C:\Program Files (x86)\Kaspersky Lab
2013-07-14 19:46 - 2013-02-08 22:42 - 00000000 ____D C:\Program Files (x86)\Freecom
2013-07-14 19:46 - 2011-09-11 17:47 - 00000000 ____D C:\ProgramData\WinZip
2013-07-14 13:30 - 2012-08-06 10:29 - 00000000 ____D C:\Users\Public\Downloads\Norton
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\Users\admin\AppData\Roaming\Malwarebytes
2013-07-14 13:03 - 2013-07-14 13:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-14 12:59 - 2013-07-14 12:59 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\admin\Desktop\mbam-setup-1.75.0.1300.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-14 12:45 - 2013-07-14 12:45 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-14 12:45 - 2013-03-05 20:57 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-14 12:45 - 2012-09-23 12:31 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-07-14 12:45 - 2011-08-21 12:11 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-14 12:44 - 2011-08-21 12:11 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-14 12:33 - 2011-04-19 14:24 - 00000000 ____D C:\ProgramData\Adobe
2013-07-14 12:29 - 2013-07-14 12:30 - 01093032 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00972712 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-07-14 12:29 - 2013-07-14 12:30 - 00312232 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00188840 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-07-14 12:29 - 2013-07-14 12:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2013-07-14 12:17 - 2013-07-14 12:17 - 00000948 _____ C:\DelFix.txt
2013-07-14 12:09 - 2013-07-01 21:11 - 00000000 ____D C:\Windows\erdnt
2013-07-14 11:15 - 2013-07-14 11:14 - 00000000 ____D C:\Users\JD\AppData\Local\{67FE893D-0D97-4A7C-B1B4-23F2B7D0D9AE}
2013-07-14 01:42 - 2013-07-29 21:04 - 01777839 _____ (Farbar) C:\Users\Manu\Desktop\FRST64.exe
2013-07-14 01:42 - 2013-07-16 23:18 - 01777839 _____ (Farbar) C:\Users\admin\Desktop\FRST64.exe
2013-07-13 23:11 - 2013-07-13 23:11 - 00000000 ____D C:\ProgramData\Licenses
2013-07-13 22:36 - 2013-07-13 22:36 - 00000000 ____D C:\Temp-Cleaner
2013-07-13 21:40 - 2013-07-13 21:35 - 00000000 ____D C:\Windows\system32\MRT
2013-07-13 19:58 - 2013-07-13 19:57 - 00000000 ____D C:\Users\JD\AppData\Local\{E4D7C614-BE37-4E49-BFF5-CDC88F55F888}
2013-07-13 12:20 - 2011-07-29 21:19 - 00004104 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 12:20 - 2011-07-29 21:19 - 00003852 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 03:18 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 16:12 - 2013-07-10 16:12 - 00000000 ____D C:\Users\Manu\AppData\Local\{BB7EBC30-E2A3-44B2-9E39-135E0D5B4566}
2013-07-09 16:13 - 2013-07-09 16:13 - 00000000 ____D C:\Users\Manu\AppData\Local\{57DDD5C2-D4F8-4F1C-9371-FE8588387495}
2013-07-08 16:10 - 2013-07-08 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{D0BA7700-6E2C-4337-A565-9E53F138F503}
2013-07-07 19:36 - 2013-06-29 16:05 - 00000000 ____D C:\Users\JD\AppData\Roaming\Applian FLV and Media Player
2013-07-07 19:28 - 2013-07-07 19:28 - 00000000 ____D C:\Users\JD\AppData\Local\Macromedia
2013-07-05 16:10 - 2013-07-05 16:10 - 00000000 ____D C:\Users\Manu\AppData\Local\{C6CBFB65-4F96-4E70-B4BC-024DCA10699E}
2013-07-03 20:28 - 2013-07-03 20:28 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 19:42 - 2013-07-03 19:42 - 00000000 ____D C:\Users\JD\AppData\Local\{06876C2D-A76F-4900-B279-D2D687A0AC2D}
2013-07-03 16:33 - 2013-07-03 16:32 - 00000000 ____D C:\Users\Manu\AppData\Local\{AC0C1DF1-B046-489F-AC26-DEA92D840090}
2013-07-02 22:29 - 2011-08-27 11:21 - 00000000 ____D C:\Users\admin\AppData\Local\Apple Computer
2013-07-02 22:29 - 2011-07-28 22:25 - 00000000 ____D C:\Users\admin\AppData\Local\Windows Live
2013-07-02 21:19 - 2011-07-28 22:26 - 00000000 ____D C:\Users\admin\AppData\Local\VirtualStore
2013-07-02 20:24 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-02 20:20 - 2011-07-28 22:25 - 00000000 ___RD C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-07-02 20:16 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-07-02 16:23 - 2013-07-02 16:23 - 00000000 ____D C:\Users\Manu\AppData\Local\{43D7EAD5-B798-47C0-9A34-5DC5FBA2C123}
2013-07-01 22:16 - 2013-07-01 22:16 - 00000000 ____D C:\Users\Manu\AppData\Roaming\DivX
2013-07-01 21:38 - 2013-07-01 21:13 - 00000000 ____D C:\1-ComboFix
2013-07-01 20:07 - 2011-08-05 18:47 - 00000000 ____D C:\Users\admin\AppData\Roaming\Apple Computer
2013-07-01 19:15 - 2013-07-01 19:15 - 00000000 ____D C:\Users\admin\AppData\Local\Macromedia
2013-07-01 19:01 - 2013-07-01 19:01 - 00000000 ____D C:\Users\JD\AppData\Local\{3D9F68A6-A700-4BD6-B3D7-E00B98D0E883}
2013-07-01 18:58 - 2012-04-11 10:47 - 00000000 ____D C:\Users\Manu\AppData\Roaming\Orbit
2013-07-01 15:44 - 2013-07-01 15:44 - 00000000 ____D C:\Users\Manu\AppData\Local\{BE2D3B67-3432-4D70-9484-89DE2876AE15}
2013-06-30 19:09 - 2013-06-29 15:58 - 00000000 ____D C:\Users\JD\AppData\Roaming\Audacity
2013-06-30 19:00 - 2009-07-14 07:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2013-06-30 18:46 - 2013-06-30 18:46 - 00001453 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iTunes
2013-06-30 18:45 - 2013-06-30 18:45 - 00000000 ____D C:\Program Files\iPod
2013-06-30 18:45 - 2013-01-01 15:06 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-06-30 16:57 - 2013-06-30 16:48 - 00000000 ____D C:\Users\JD\AppData\Roaming\vlc
2013-06-30 16:47 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{4B6F1783-475F-4BBA-B2E4-A2E1066B7B92}
2013-06-30 16:40 - 2013-06-30 16:40 - 00000000 ____D C:\Users\JD\AppData\Local\{305B313F-8EAF-47FE-9E73-6FBB8F7B581B}
2013-06-30 16:21 - 2013-06-23 13:19 - 00000000 ____D C:\Users\JD
2013-06-30 14:06 - 2013-06-30 14:06 - 00000000 ____D C:\Users\Manu\AppData\Local\{B6C34DF3-9A63-4832-9B58-84F2D7A73B36}
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Roaming\Mozilla
2013-06-30 13:51 - 2013-06-30 13:51 - 00000000 ____D C:\Users\JD\AppData\Local\Mozilla
2013-06-29 16:28 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\MediaEspresso
2013-06-29 16:27 - 2013-06-29 16:27 - 00000000 ____D C:\Users\JD\AppData\Roaming\CyberLink
2013-06-29 16:02 - 2013-06-29 16:02 - 00000000 ____D C:\Users\JD\AppData\Roaming\ProgSense
2013-06-29 15:27 - 2013-06-23 13:47 - 00000000 ____D C:\Users\JD\AppData\Local\CrashDumps
2013-06-29 14:14 - 2013-06-29 14:14 - 00000000 ____D C:\Users\Manu\AppData\Local\{8D5FB07C-1332-4180-811D-0B0937414065}

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-15 13:47

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

IE" erzählt mir jetzt " Die aktuellen Sicherheitseinstellungen sind ein Risiko ..... Reparieren Ja/Nein :heulen:

schrauber 30.07.2013 06:41
IE jetzt komplett zurücksetzen, dann testen.

Indexation 30.07.2013 18:49
Mag jetzt dumm klingen - aber wie setze ich IE komplett zurück - mittlerweile weiss ich nicht mehr ob ich das alles verstehe .
Ich sehe z.b. im IE den letzten thread von dir gar nicht - er läd nicht die neuste Seite sondern zeigt mit irgendeinen cache (im mom gehe ich über firefox)
Letzter Eintrag zu diesem thread nach IE = 18.07.2013, 09:17 - so ein Quatsch

ich glaube ich hau die Kiste einfach platt und setze alles neu auf ...FRUST :headbang:

Korrektur - das Akualisierungsproblem ist auf dem anderen account - jetzt bin ich auf dem account von dem du das letzte log hast - dort funzt die Aktualisierung - muss jetzt nur wissen wie man IE zurücksetzt -> was immer komplet auch heisst :-(

schrauber 31.07.2013 08:17
Setze folgendermassen den Internet Explorer zurück:
  • Öffne den Internet Explorer und gehe zu Extras -> Internetoptionen.
  • Klicke in der Registerkarte Erweitert unter "Internet Explorer-Einstellungen zurücksetzen" auf Zurücksetzen...
  • Klicke im Dialogfeld "Internet Explorer-Einstellungen zurücksetzen" zum Bestätigen auf Zurücksetzen.
(Hier findest du die bebilderte Anleitung.)


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:52 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131