Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   ich habe mir - glaube ich - was böses eingefangen, was sich lollipop nennt. (https://www.trojaner-board.de/147280-habe-mir-glaube-boeses-eingefangen-lollipop-nennt.html)

omaka52 04.01.2014 09:05
ich habe mir - glaube ich - was böses eingefangen, was sich lollipop nennt.
 
Hallo, ich habe mir Lollipop eingefangen. Mit Emsisoft Malware konnte ich nichts entfernen. Es ist immer wieder da, Werbefenster werden geöffnet etc. etc. Ich bitte euch um Hilfe, bin völlig ratlos. Danke

aharonov 04.01.2014 13:33
Hallo,

mach bitte einen FRST-Scan:


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


omaka52 04.01.2014 14:40
hi, hoffe, ich hab alles richtig gemachtFRST Additions Logfile:
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-01-2014
Ran by karin at 2014-01-04 14:32:25
Running from C:\Users\karin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Emsisoft Anti-Malware (Disabled - Out of date) {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
AS: Emsisoft Anti-Malware (Disabled - Out of date) {B1BD7E99-06FB-2B81-3B52-7834153DC387}

==================== Installed Programs ======================

µTorrent (x32 Version: 3.0.0 - )
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (x32 Version: 12.0.5.146 - Adobe Systems, Inc.)
Ashampoo Burning Studio 2010 Advanced (x32 Version: 9.2.4 - ashampoo GmbH & Co. KG)
CCleaner (Version: 3.13 - Piriform)
eMachines Recovery Management (x32 Version: 4.05.3005 - Acer Incorporated)
eMachines Registration (x32 Version: 1.02.3006 - Acer Incorporated)
eMachines Updater (x32 Version: 1.01.3017 - Acer Incorporated)
Emsisoft Anti-Malware 5.1 (x32 Version: 5.1 - Emsi Software GmbH)
EPSON SX100 Series Printer Uninstall (Version:  - SEIKO EPSON Corporation)
Facebook Messenger 2.1.4814.0 (x32 Version: 2.1.4814.0 - Facebook)
Facebook Video Calling 1.2.0.159 (x32 Version: 1.2.159 - Skype Limited)
Free YouTube Download version 3.2.0.128 (x32 Version: 3.2.0.128 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.0.128 (x32 Version: 3.12.0.128 - DVDVideoSoft Ltd.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Toolbar for Internet Explorer (x32 Version: 7.5.4805.320 - Google Inc.)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
ImagXpress (x32 Version: 7.0.74.0 - Nero AG) Hidden
Java 7 Update 45 (64-bit) (Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 4 (x32 Version: 7.0.40 - Oracle)
JavaFX 2.1.0 (x32 Version: 2.1.0 - Oracle Corporation)
Lollipop (HKCU Version:  - Lollipop Network, S.L.) <==== ATTENTION
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2 - Microsoft Corporation) Hidden
Microsoft Office Suite Activation Assistant (x32 Version: 2.9 - Microsoft Corporation)
Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (Version: 4.4.304.0 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (x32 Version: 10.0.30319 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
NC Launcher (GameForge) (x32 Version:  - NCsoft)
neroxml (x32 Version: 1.0.0 - Nero AG) Hidden
NETGEAR WG111v3 wireless USB 2.0 adapter (x32 Version: 1.01.10 - NETGEAR)
NETGEAR WG111v3 wireless USB 2.0 adapter (x32 Version: 1.01.10 - NETGEAR) Hidden
NVIDIA Display Control Panel (Version: 6.14.12.5896 - NVIDIA Corporation)
NVIDIA Drivers (Version: 1.3 - NVIDIA Corporation)
NVIDIA ForceWare Network Access Manager (Version: 1.00.7305 - NVIDIA Corporation) Hidden
NVIDIA ForceWare Network Access Manager (x32 Version:  - )
NVIDIA Grafiktreiber 307.83 (Version: 307.83 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.109.706 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 307.83 (Version: 307.83 - NVIDIA Corporation) Hidden
NVIDIA Update 1.10.8 (Version: 1.10.8 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.10.8 - NVIDIA Corporation) Hidden
Picasa 3 (x32 Version: 3.8 - Google, Inc.)
PVSonyDll (Version: 1.00.0001 - NVIDIA Corporation) Hidden
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5898 - Realtek Semiconductor Corp.)
Skype™ 5.10 (x32 Version: 5.10.114 - Skype Technologies S.A.)
Spybot - Search & Destroy (x32 Version: 2.2.25 - Safer-Networking Ltd.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
TeamSpeak 3 Client (Version:  - TeamSpeak Systems GmbH)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Updater (x32 Version: 2.6.53 - Creative Island Media, LLC)
VLC media player 1.1.5 (x32 Version: 1.1.5 - VideoLAN)
Welcome Center (x32 Version: 1.00.3008 - Acer Incorporated)
WinRAR (Version:  - )

==================== Restore Points  =========================

11-12-2013 19:54:27 Windows Update
12-12-2013 18:50:41 Windows Update
13-12-2013 19:12:55 Windows Update
14-12-2013 20:30:01 Windows Update
15-12-2013 17:45:46 Windows Update
17-12-2013 17:47:22 Windows Update
18-12-2013 17:42:17 Windows Update
19-12-2013 18:38:39 Windows Update
20-12-2013 17:40:18 Windows Update
24-12-2013 07:32:56 Windows Update
27-12-2013 10:38:52 Windows Update
29-12-2013 18:00:57 Windows-Sicherung
31-12-2013 10:40:14 Windows Update
01-01-2014 20:23:50 Uniblue SpeedUpMyPC installation

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {05CBBD44-2132-446C-A46D-39FEDF5FC88C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {0E139413-CC3B-442E-A265-56DEE9CBB1AE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-22] (Google Inc.)
Task: {11A8E58E-4E97-4448-8DE2-CA954FE19197} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {2D8DE9F4-2149-409E-B152-1D92C5AAF921} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {42D10ABF-2FEB-4663-9878-AAFBDF3A968A} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000Core => C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {438389AB-0F6E-46FC-BA21-3EA81DC1706E} - System32\Tasks\Adobe Reader and Acrobat Manager => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-05-11] (Adobe Systems Incorporated)
Task: {4983C838-D99B-43F6-8556-B1D8F4AA1E3F} - System32\Tasks\Desk 365 RunAsStdUser => C:\Program Files (x86)\Desk 365\desk365.exe <==== ATTENTION
Task: {6225B17F-2BD8-46B6-8126-098A82B6ABA3} - System32\Tasks\{817DB7CF-9CB7-4665-A0BF-4201F830878E} => Firefox.exe hxxp://ui.skype.com/ui/0/6.6.0.106/de/go/help.faq.installer?LastError=1603
Task: {63E2FACE-6898-483B-B5D4-9E2BFC41EEBF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-09-22] (Google Inc.)
Task: {7EE32F73-F36C-4473-ADDE-E741CBC2E201} - System32\Tasks\{C5776FD4-0DD2-4F0D-928D-79C2D629F749} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {AC83D3A9-E617-4190-8AA2-AEE4FCD3D08F} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {B81B63A4-290A-4133-A478-1692DDBDF483} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000UA => C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {B94DFCEA-D14B-47E0-999D-76B3FC174E36} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2011 => C:\Program Files (x86)\TuneUp Utilities 2011\OneClick.exe
Task: {D1FFEDA4-B37C-4038-A30B-1529BF5719B0} - System32\Tasks\{FFA1E0D1-998C-49B5-8C31-FE7CF6CE9C83} => C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe [2008-06-13] ()
Task: {F1E4DDAA-F95A-479F-8712-0455B82EF1FF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-11] (Adobe Systems Incorporated)
Task: {FAE04107-9607-4BD1-843C-54AD9ED72EC1} - System32\Tasks\{6155360F-A3E5-4E7F-95ED-AD070CB2C742} => C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe [2008-06-13] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000Core.job => C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000UA.job => C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\update-S-1-5-21-85279687-4208295537-238049305-1000.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe
Task: C:\Windows\Tasks\update-sys.job => C:\Program Files (x86)\Skillbrains\Updater\Updater.exe

==================== Loaded Modules (whitelisted) =============

2013-03-07 21:32 - 2013-03-07 21:32 - 00292272 _____ () C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\CefSharp.dll
2013-03-07 21:32 - 2013-03-07 21:32 - 21014960 _____ () C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\libcef.dll
2013-03-07 21:32 - 2013-03-07 21:32 - 00179632 _____ () C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\CefSharp.WinForms.dll
2013-12-20 08:56 - 2013-12-20 08:57 - 03559024 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-01-04 13:51 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-01-04 13:51 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-01-04 13:51 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-01-04 13:51 - 2013-05-16 10:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-01-04 13:51 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2013-12-11 09:04 - 2013-12-11 09:04 - 16242056 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:E3C56885

==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: PS/2-kompatible Maus
Description: PS/2-kompatible Maus
Class Guid: {4d36e96f-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: i8042prt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (01/04/2014 08:26:47 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/04/2014 08:26:47 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/04/2014 08:26:47 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/04/2014 07:45:16 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/04/2014 07:45:16 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/04/2014 07:45:16 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/03/2014 09:31:11 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (01/03/2014 09:31:11 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/03/2014 09:31:11 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (01/03/2014 09:02:13 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.


System errors:
=============
Error: (01/04/2014 00:54:33 PM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (01/04/2014 08:16:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/04/2014 08:16:29 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/04/2014 08:16:29 AM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (01/04/2014 08:16:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/04/2014 08:16:27 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/04/2014 08:16:27 AM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (01/04/2014 08:16:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet:
%%-2140993535

Error: (01/04/2014 08:16:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%-2140993535

Error: (01/04/2014 08:16:16 AM) (Source: PNRPSvc) (User: )
Description: 0x80630801


Microsoft Office Sessions:
=========================
Error: (01/04/2014 08:26:47 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/04/2014 08:26:47 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/04/2014 08:26:47 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/04/2014 07:45:16 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/04/2014 07:45:16 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/04/2014 07:45:16 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/03/2014 09:31:11 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (01/03/2014 09:31:11 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/03/2014 09:31:11 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (01/03/2014 09:02:13 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000


==================== Memory info ===========================

Percentage of memory in use: 57%
Total physical RAM: 2814.49 MB
Available physical RAM: 1191.71 MB
Total Pagefile: 5627.16 MB
Available Pagefile: 3723.72 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: (eMachines) (Fixed) (Total:460.76 GB) (Free:405.84 GB) NTFS
Drive d: (Volume) (Fixed) (Total:458.66 GB) (Free:149.69 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 932 GB) (Disk ID: 59361E01)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=461 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=459 GB) - (Type=OF Extended)

==================== End Of Log ============================
--- --- ---



FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by karin (administrator) on KARIN-PC on 04-01-2014 14:29:37
Running from C:\Users\karin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Emsi Software GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
(Acer) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Skillbrains) C:\Users\karin\AppData\Local\Skillbrains\lightshot\3.2.0.0\Lightshot.exe
(Updater) C:\ProgramData\Updater\updater.exe
() C:\Users\karin\AppData\Local\Lollipop\Lollipop.exe
() C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe
(Facebook) C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe
(WatchDog) C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(WatchDog) C:\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe
(Emsi Software GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2start.exe
(WatchDog) C:\ProgramData\RHelpers\IeHelper\IeHelper.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_170.exe
(UpdaterResponse) C:\Users\karin\AppData\Local\Temp\setup{CEF6732C-5427-486A-AA3C-44D14ADE66B8}.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [OOTag] - C:\Windows\OOBEOffer\OOBEOffer\OOTag.exe [23072 2009-09-28] (Microsoft)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-10-29] (Google Inc.)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [EPSON SX100 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIEDE.EXE /FU "C:\Windows\TEMP\E_SDA33.tmp" /EF "HKCU"
HKCU\...\Run: [Facebook Update] - C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [17418928 2012-07-13] (Skype Technologies S.A.)
HKCU\...\Run: [LightShot] - C:\Users\karin\AppData\Local\Skillbrains\lightshot\LightShot.exe [220160 2012-02-02] ()
HKCU\...\Run: [Updater] - C:\ProgramData\Updater\updater.exe [486264 2013-12-18] (Updater)
HKCU\...\Run: [lollipop] - C:\Users\karin\AppData\Local\Lollipop\Lollipop.exe [3791872 2014-01-01] ()
Startup: C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.nationzoom.com/?type=hp&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.nationzoom.com/?type=hp&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW_deDE398
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=TRL2&o=15902&src=crm&q={searchTerms}&locale=de_DE&apn_ptnrs=TW&apn_dtid=YYYYYYYYDE&apn_uid=631864DC-2A1A-4240-AC98-005CDF7BA67A&apn_sauid=5F815D1F-C4B6-4040-9273-F974B0AE5C67
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.nationzoom.com/web/?type=ds&ts=1388601747&from=adks&uid=126614527_462834_406AEA2E&q={searchTerms}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW_deDE398
SearchScopes: HKCU - {E627DC4B-8C04-4234-A2D4-1D634EE01C41} URL = hxxp://fastestwebsearch.com/search?q={searchterms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.110 80.69.100.214

FireFox:
========
FF ProfilePath: C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663
FF user.js: detected! => C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\user.js
FF DefaultSearchEngine: nationzoom
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\karin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fastestwebsearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\nationzoom.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Greasemonkey - C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\karin\AppData\Roaming\5031
FF Extension: Java String Helper - C:\Users\karin\AppData\Roaming\5031

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2978720 2011-06-07] (Emsi Software GmbH)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [625184 2009-04-19] ()
R2 Greg_Service; C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [207904 2009-04-19] ()
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.)
R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [240160 2009-07-04] (Acer)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [85800 2011-02-24] (Emsi Software GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [48216 2010-09-05] (Emsi Software GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [14720 2010-05-05] (Emsi Software GmbH)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [416768 2009-06-10] (Realtek Semiconductor Corporation                          )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-09-23] ()
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2010-09-22] (Symantec Corporation)
U3 a95744fu; C:\Windows\System32\Drivers\a95744fu.sys [0 ] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-04 14:26 - 2014-01-04 14:30 - 00017133 _____ C:\Users\karin\Downloads\FRST.txt
2014-01-04 14:26 - 2014-01-04 14:26 - 00000000 ____D C:\FRST
2014-01-04 14:25 - 2014-01-04 14:26 - 01931368 _____ (Farbar) C:\Users\karin\Downloads\FRST64.exe
2014-01-04 13:52 - 2014-01-04 13:52 - 00001384 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-01-04 13:52 - 2014-01-04 13:52 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-04 13:52 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-01-04 13:51 - 2014-01-04 13:57 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-04 13:51 - 2014-01-04 13:52 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-04 13:47 - 2014-01-04 13:48 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25(1).exe
2014-01-04 13:45 - 2014-01-04 13:46 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25.exe
2014-01-02 08:51 - 2014-01-04 08:14 - 00000560 _____ C:\Windows\setupact.log
2014-01-02 08:51 - 2014-01-02 09:22 - 00002466 _____ C:\Windows\PFRO.log
2014-01-02 08:51 - 2014-01-02 08:51 - 00000000 _____ C:\Windows\setuperr.log
2014-01-01 21:18 - 2014-01-01 21:20 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2014-01-01 21:17 - 2014-01-04 14:25 - 00000000 ____D C:\Users\karin\AppData\Local\Lollipop
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-01 21:15 - 2014-01-01 21:15 - 00337960 _____ (Amônétízé Ltd) C:\Users\karin\Downloads\MozFir24__4812_il1314.exe
2014-01-01 20:37 - 2014-01-01 21:09 - 00000000 ____D C:\Users\karin\AppData\Roaming\Systweak
2014-01-01 20:37 - 2014-01-01 20:38 - 00755792 _____ C:\Users\karin\Downloads\Firefox_Setup.exe
2014-01-01 20:37 - 2013-07-11 13:49 - 00020312 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-01-01 20:31 - 2014-01-01 20:32 - 00109144 _____ () C:\Users\karin\Downloads\Setup.exe
2014-01-01 20:21 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\eCyber
2014-01-01 20:20 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\iSafe
2014-01-01 20:20 - 2014-01-01 20:20 - 00000000 ____D C:\Windows\system32\log
2014-01-01 20:19 - 2014-01-01 20:24 - 00000000 ____D C:\Program Files (x86)\WinZipper
2014-01-01 20:19 - 2014-01-01 20:19 - 00000000 ____D C:\Users\karin\AppData\Roaming\WinZipper
2014-01-01 20:12 - 2014-01-01 20:12 - 00000000 ____D C:\ProgramData\TubeDimmer
2014-01-01 19:46 - 2014-01-01 21:08 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2014-01-01 19:44 - 2014-01-01 20:19 - 00000000 ____D C:\Program Files (x86)\Desk 365
2014-01-01 19:44 - 2014-01-01 19:50 - 00000000 ____D C:\Users\karin\AppData\Roaming\Desk 365
2014-01-01 19:44 - 2014-01-01 19:45 - 00000000 ____D C:\ProgramData\Updater
2014-01-01 19:44 - 2014-01-01 19:44 - 00000000 ____D C:\ProgramData\RHelpers
2014-01-01 19:43 - 2014-01-01 20:24 - 00000000 ____D C:\ProgramData\WPM
2013-12-20 18:41 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-20 18:41 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-20 18:41 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-20 18:41 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-20 18:41 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-20 18:41 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-20 18:41 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-20 18:41 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-20 18:41 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-20 18:41 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-20 18:41 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-20 18:41 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-20 18:41 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-20 18:41 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-20 18:41 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-20 18:41 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-20 18:41 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-20 18:41 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-20 18:41 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-20 18:41 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-20 18:41 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-20 18:41 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-20 18:41 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-20 18:41 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-20 18:41 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-20 18:41 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-20 18:41 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-20 18:40 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-20 18:40 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-20 18:40 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-20 18:40 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-20 08:56 - 2013-12-20 08:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 18:52 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-18 18:46 - 2013-12-18 18:46 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-12 19:55 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 19:55 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 19:55 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 19:55 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 07:08 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 07:08 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 07:08 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 07:08 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 07:08 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 07:08 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 07:08 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 07:08 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 07:08 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 07:08 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 07:08 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 07:08 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 07:08 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 07:08 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 07:08 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 07:08 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 07:08 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 07:08 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 07:08 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

==================== One Month Modified Files and Folders =======

2014-01-04 14:30 - 2014-01-04 14:26 - 00017133 _____ C:\Users\karin\Downloads\FRST.txt
2014-01-04 14:26 - 2014-01-04 14:26 - 00000000 ____D C:\FRST
2014-01-04 14:26 - 2014-01-04 14:25 - 01931368 _____ (Farbar) C:\Users\karin\Downloads\FRST64.exe
2014-01-04 14:25 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Local\Lollipop
2014-01-04 14:04 - 2012-07-23 22:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-04 13:57 - 2014-01-04 13:51 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-04 13:52 - 2014-01-04 13:52 - 00001384 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-01-04 13:52 - 2014-01-04 13:52 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-04 13:52 - 2014-01-04 13:51 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-04 13:48 - 2014-01-04 13:47 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25(1).exe
2014-01-04 13:48 - 2010-09-22 22:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-04 13:46 - 2014-01-04 13:45 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25.exe
2014-01-04 13:36 - 2013-07-13 07:15 - 01985611 _____ C:\Windows\WindowsUpdate.log
2014-01-04 12:57 - 2011-10-06 19:03 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000UA.job
2014-01-04 08:26 - 2010-09-23 06:28 - 23256106 _____ C:\Windows\system32\perfh007.dat
2014-01-04 08:26 - 2010-09-23 06:28 - 07270090 _____ C:\Windows\system32\perfc007.dat
2014-01-04 08:26 - 2009-07-14 06:13 - 00006354 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-04 08:22 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-04 08:22 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-04 08:16 - 2010-09-22 22:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-04 08:14 - 2014-01-02 08:51 - 00000560 _____ C:\Windows\setupact.log
2014-01-04 08:14 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-02 09:22 - 2014-01-02 08:51 - 00002466 _____ C:\Windows\PFRO.log
2014-01-02 08:51 - 2014-01-02 08:51 - 00000000 _____ C:\Windows\setuperr.log
2014-01-01 21:57 - 2010-09-25 14:41 - 00000000 ____D C:\Windows\Minidump
2014-01-01 21:57 - 2009-10-29 04:52 - 00000000 ____D C:\Windows\Panther
2014-01-01 21:20 - 2014-01-01 21:18 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-01 21:15 - 2014-01-01 21:15 - 00337960 _____ (Amônétízé Ltd) C:\Users\karin\Downloads\MozFir24__4812_il1314.exe
2014-01-01 21:09 - 2014-01-01 20:37 - 00000000 ____D C:\Users\karin\AppData\Roaming\Systweak
2014-01-01 21:08 - 2014-01-01 19:46 - 00000000 ____D C:\Program Files (x86)\MyPC Backup
2014-01-01 21:08 - 2010-09-22 20:50 - 00000000 ___RD C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-01 20:38 - 2014-01-01 20:37 - 00755792 _____ C:\Users\karin\Downloads\Firefox_Setup.exe
2014-01-01 20:32 - 2014-01-01 20:31 - 00109144 _____ () C:\Users\karin\Downloads\Setup.exe
2014-01-01 20:24 - 2014-01-01 20:19 - 00000000 ____D C:\Program Files (x86)\WinZipper
2014-01-01 20:24 - 2014-01-01 19:43 - 00000000 ____D C:\ProgramData\WPM
2014-01-01 20:21 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\eCyber
2014-01-01 20:21 - 2014-01-01 20:20 - 00000000 ____D C:\Users\karin\AppData\Roaming\iSafe
2014-01-01 20:20 - 2014-01-01 20:20 - 00000000 ____D C:\Windows\system32\log
2014-01-01 20:19 - 2014-01-01 20:19 - 00000000 ____D C:\Users\karin\AppData\Roaming\WinZipper
2014-01-01 20:19 - 2014-01-01 19:44 - 00000000 ____D C:\Program Files (x86)\Desk 365
2014-01-01 20:19 - 2011-02-19 22:03 - 00421032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2014-01-01 20:19 - 2011-02-18 23:40 - 00773800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2014-01-01 20:13 - 2011-01-06 22:04 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2014-01-01 20:12 - 2014-01-01 20:12 - 00000000 ____D C:\ProgramData\TubeDimmer
2014-01-01 19:50 - 2014-01-01 19:44 - 00000000 ____D C:\Users\karin\AppData\Roaming\Desk 365
2014-01-01 19:45 - 2014-01-01 19:44 - 00000000 ____D C:\ProgramData\Updater
2014-01-01 19:44 - 2014-01-01 19:44 - 00000000 ____D C:\ProgramData\RHelpers
2014-01-01 19:42 - 2011-03-11 17:04 - 00001330 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-01 19:42 - 2010-09-22 20:50 - 00001616 _____ C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-12-31 11:43 - 2010-09-22 20:45 - 00000000 ____D C:\Users\karin
2013-12-28 14:56 - 2011-04-20 11:18 - 00000000 ____D C:\Users\karin\AppData\Roaming\Skype
2013-12-24 07:59 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-20 08:57 - 2013-12-20 08:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 09:40 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-19 06:57 - 2011-10-06 19:03 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000Core.job
2013-12-19 06:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-18 18:46 - 2013-12-18 18:46 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-15 18:48 - 2013-07-16 17:27 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 18:46 - 2010-09-23 06:37 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 06:44 - 2009-07-14 05:45 - 00308000 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 09:05 - 2012-07-23 22:06 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 09:05 - 2012-07-23 22:06 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 09:05 - 2012-07-23 22:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

Some content of TEMP:
====================
C:\Users\karin\AppData\Local\Temp\setup{CEF6732C-5427-486A-AA3C-44D14ADE66B8}.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-30 12:22

==================== End Of Log ============================
--- --- ---

--- --- ---

aharonov 04.01.2014 15:06
Ok, so weiter:


Schritt 1
  • Gehe zu Start --> Systemsteuerung und öffne Programme und Funktionen.
  • Suche und deinstalliere dort der Reihe nach folgende Einträge:
    Lollipop
    Updater
  • Schliesse das Fenster wieder und führe einen Neustart durch, wenn das gefordert wurde.



Schritt 2

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



Schritt 3

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.




Schritt 4

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

omaka52 04.01.2014 16:21
hi, ich glaube, dass ich es - dank deiner hilfe - geschafft habe, was ich tun sollteCombofix Logfile:
Code:
ComboFix 14-01-04.03 - karin 04.01.2014  15:50:40.1.1 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.2814.1592 [GMT 1:00]
ausgeführt von:: c:\users\karin\Downloads\ComboFix.exe
AV: Emsisoft Anti-Malware *Disabled/Outdated* {0ADC9F7D-20C1-240F-01E2-43466EBA893A}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
SP: Emsisoft Anti-Malware *Disabled/Outdated* {B1BD7E99-06FB-2B81-3B52-7834153DC387}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\emachines.ico
c:\users\karin\AppData\Roaming\.#
c:\users\karin\AppData\Roaming\AcroIEHelpe.txt
c:\users\karin\AppData\Roaming\srvblck2.tmp
c:\windows\isRS-000.tmp
c:\windows\security\Database\tmp.edb
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-12-04 bis 2014-01-04  ))))))))))))))))))))))))))))))
.
.
2014-01-04 15:03 . 2014-01-04 15:04        --------        d-----w-        c:\users\karin\AppData\Local\temp
2014-01-04 15:03 . 2014-01-04 15:03        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2014-01-04 15:03 . 2014-01-04 15:03        --------        d-----w-        c:\users\DefaultAppPool\AppData\Local\temp
2014-01-04 15:03 . 2014-01-04 15:03        --------        d-----w-        c:\users\Default\AppData\Local\temp
2014-01-04 14:29 . 2014-01-04 14:32        --------        d-----w-        C:\AdwCleaner
2014-01-04 13:26 . 2014-01-04 13:26        --------        d-----w-        C:\FRST
2014-01-04 12:51 . 2014-01-04 13:48        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2014-01-04 12:51 . 2014-01-04 14:33        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy 2
2014-01-04 06:42 . 2014-01-04 06:42        75888        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CEFEB290-2D8B-42C2-B687-C97E8A573380}\offreg.dll
2014-01-03 08:31 . 2013-12-04 03:28        10315576        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{CEFEB290-2D8B-42C2-B687-C97E8A573380}\mpengine.dll
2014-01-01 19:22 . 2013-12-04 03:28        10315576        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-01-01 19:21 . 2014-01-01 19:21        --------        d-----w-        c:\users\karin\AppData\Roaming\eCyber
2014-01-01 19:20 . 2014-01-01 19:20        --------        d-----w-        c:\windows\system32\log
2013-12-20 17:40 . 2013-11-26 08:16        4243968        ----a-w-        c:\windows\SysWow64\jscript9.dll
2013-12-20 17:40 . 2013-11-26 08:35        5769216        ----a-w-        c:\windows\system32\jscript9.dll
2013-12-18 17:52 . 2013-10-14 17:00        28368        ----a-w-        c:\windows\system32\IEUDINIT.EXE
2013-12-12 18:55 . 2013-05-10 04:30        167424        ----a-w-        c:\program files\Windows Media Player\wmplayer.exe
2013-12-12 18:55 . 2013-05-10 03:48        164864        ----a-w-        c:\program files (x86)\Windows Media Player\wmplayer.exe
2013-12-12 18:55 . 2013-05-10 05:56        12625920        ----a-w-        c:\windows\system32\wmploc.DLL
2013-12-12 18:55 . 2013-05-10 04:56        12625408        ----a-w-        c:\windows\SysWow64\wmploc.DLL
2013-12-12 18:55 . 2013-05-10 05:56        14631424        ----a-w-        c:\windows\system32\wmp.dll
2013-12-06 04:52 . 2013-10-19 06:06        965000        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{EC027270-C71A-4644-B99D-88939DA2FF70}\gapaengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-01 19:19 . 2011-02-18 22:40        773800        ----a-w-        c:\windows\SysWow64\msvcr100.dll
2014-01-01 19:19 . 2011-02-19 21:03        421032        ----a-w-        c:\windows\SysWow64\msvcp100.dll
2013-12-15 17:46 . 2010-09-23 05:37        90708896        ----a-w-        c:\windows\system32\MRT.exe
2013-12-11 08:05 . 2012-07-23 21:06        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-12-11 08:05 . 2012-07-23 21:06        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-11-19 10:21 . 2010-09-23 05:19        267936        ------w-        c:\windows\system32\MpSigStub.exe
2013-11-12 09:39 . 2013-11-12 09:41        108968        ----a-w-        c:\windows\system32\WindowsAccessBridge-64.dll
2013-11-12 09:39 . 2013-11-12 09:41        312744        ----a-w-        c:\windows\system32\javaws.exe
2013-11-12 09:39 . 2013-11-12 09:41        189352        ----a-w-        c:\windows\system32\javaw.exe
2013-11-12 09:39 . 2013-11-12 09:41        189352        ----a-w-        c:\windows\system32\java.exe
2013-10-19 06:06 . 2011-03-25 07:42        965000        ------w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-10-12 02:30 . 2013-11-13 14:09        830464        ----a-w-        c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-11-13 14:09        859648        ----a-w-        c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-11-13 14:09        324096        ----a-w-        c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-11-13 14:09        656896        ----a-w-        c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-11-13 14:09        216576        ----a-w-        c:\windows\SysWow64\FWPUCLNT.DLL
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-29 39408]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
"Facebook Update"="c:\users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe" [2012-07-12 138096]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-07-13 17418928]
"LightShot"="c:\users\karin\AppData\Local\Skillbrains\lightshot\LightShot.exe" [2012-02-02 220160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
.
c:\users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Facebook Messenger.lnk - c:\users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe [2013-3-7 248240]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WG111v3 Setup-Assistent.lnk - c:\program files (x86)\NETGEAR\WG111v3\WG111v3.exe [2008-6-13 2109440]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)
"ForceActiveDesktopOn"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 RTL8187B;RTL8187B Drahtlos-802.11b/g-USB 2.0-Netzwerkadapter (54 MBit/s) von Realtek;c:\windows\system32\DRIVERS\RTL8187B.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8187B.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x]
S1 a2injectiondriver;a2injectiondriver;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2dix64.sys [x]
S1 a2util;a-squared Malware-IDS utility driver;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys;c:\program files (x86)\Emsisoft Anti-Malware\a2util64.sys [x]
S2 a2AntiMalware;Emsisoft Anti-Malware 5.0 - Service;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe;c:\program files (x86)\Emsisoft Anti-Malware\a2service.exe [x]
S2 Greg_Service;GRegService;c:\program files (x86)\eMachines\Registration\GregHSRW.exe;c:\program files (x86)\eMachines\Registration\GregHSRW.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 Updater Service;Updater Service;c:\program files\eMachines\eMachines Updater\UpdaterService.exe;c:\program files\eMachines\eMachines Updater\UpdaterService.exe [x]
S3 a2acc;a2acc;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys;c:\program files (x86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [x]
S3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
iissvcs        REG_MULTI_SZ          w3svc was
apphost        REG_MULTI_SZ          apphostsvc
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-23 08:05]
.
2013-12-19 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000Core.job
- c:\users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-06 04:52]
.
2014-01-04 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000UA.job
- c:\users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2011-10-06 04:52]
.
2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-22 21:59]
.
2014-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-22 21:59]
.
2012-11-25 c:\windows\Tasks\update-S-1-5-21-85279687-4208295537-238049305-1000.job
- c:\program files (x86)\Skillbrains\Updater\Updater.exe [2012-10-11 20:09]
.
2012-11-25 c:\windows\Tasks\update-sys.job
- c:\program files (x86)\Skillbrains\Updater\Updater.exe [2012-10-11 20:09]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-20 7981088]
"OOTag"="c:\windows\oobeoffer\oobeoffer\ootag.exe" [2009-09-28 23072]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 1266912]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com
mDefault_Search_URL = hxxp://www.google.com
mDefault_Page_URL = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = hxxp://www.google.com
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to Mp3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
FF - ProfilePath - c:\users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\
FF - ExtSQL: 2013-11-08 18:17; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-04  16:10:44
ComboFix-quarantined-files.txt  2014-01-04 15:10
.
Vor Suchlauf: 14 Verzeichnis(se), 436.828.127.232 Bytes frei
Nach Suchlauf: 18 Verzeichnis(se), 436.293.279.744 Bytes frei
.
- - End Of File - - 1060022A670A7D86BC20BD49B8915332
--- --- ---
70E629B51C16B3C007730C6AE57144C9

AdwCleaner Logfile:
Code:
# AdwCleaner v3.016 - Bericht erstellt am 04/01/2014 um 15:31:28
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : karin - KARIN-PC
# Gestartet von : C:\Users\karin\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\ProgramData\TubeDimmer
Ordner Gelöscht : C:\ProgramData\WPM
Ordner Gelöscht : C:\Program Files (x86)\Desk 365
Ordner Gelöscht : C:\Program Files (x86)\Mobogenie
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\WinZipper
Ordner Gelöscht : C:\Program Files\Babylon
Ordner Gelöscht : C:\Users\karin\AppData\Local\lollipop
Ordner Gelöscht : C:\Users\karin\AppData\Local\Temp\Desk365
Ordner Gelöscht : C:\Users\karin\AppData\Roaming\Desk 365
Ordner Gelöscht : C:\Users\karin\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\karin\AppData\Roaming\iSafe
Ordner Gelöscht : C:\Users\karin\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\karin\AppData\Roaming\WinZipper
Datei Gelöscht : C:\END
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\37ar9sup.default\searchplugins\Askcom.xml
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\nationzoom.xml
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\0xhuy8au.karin\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\37ar9sup.default\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\e2vhrc57.karin\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\egpnofqw.diana\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\ilfogvhx.diana\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\k9q0g6l3.349_neu\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\pmahgrwm.Diana\user.js
Datei Gelöscht : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\tp9dri3f.karin\user.js
Datei Gelöscht : C:\Windows\System32\Tasks\Desk 365 RunAsStdUser

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Public\Desktop\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox (2).lnk
Verknüpfung Desinfiziert : C:\Users\karin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKCU\Software\Classes\Applications\lollipop.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\BabylonHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Babylon_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BabylonTC_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Mobogenie.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\DeskSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cdburnerxp-pro_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_cdburnerxp-pro_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6536801B-F50C-449B-9476-093DFD3789E3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\lollipop
Schlüssel Gelöscht : HKCU\Software\SearchProtectINT
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DynConIE
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKLM\Software\Desksvc
Schlüssel Gelöscht : HKLM\Software\dt soft\daemon tools toolbar
Schlüssel Gelöscht : HKLM\Software\hdcode
Schlüssel Gelöscht : HKLM\Software\nationzoomSoftware
Schlüssel Gelöscht : HKLM\Software\supWPM
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\winzipersvc

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.16428

Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Search_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Search Page]

-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\0xhuy8au.karin\prefs.js ]

Zeile gelöscht : user_pref("greasemonkey.scriptvals.PDX/KoC Power - Multilang.KsOptions_349", "{\"AttackRunning\":false,\"NewTab\":false,\"KsTab\":true,\"NewTabURL\":\"hxxp://koc.god-like.org/chat\",\"NewTabName\":\"C[...]

[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\37ar9sup.default\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultengine", "Ask.com");
Zeile gelöscht : user_pref("browser.search.defaultenginename", "Ask.com");
Zeile gelöscht : user_pref("browser.search.order.1", "Ask.com");

[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\prefs.js ]

Zeile gelöscht : user_pref("browser.search.defaultenginename", "nationzoom");

[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\e2vhrc57.karin\prefs.js ]


[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\egpnofqw.diana\prefs.js ]


[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\ilfogvhx.diana\prefs.js ]


[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\k9q0g6l3.349_neu\prefs.js ]


[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\pmahgrwm.Diana\prefs.js ]


[ Datei : C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\tp9dri3f.karin\prefs.js ]

Zeile gelöscht : user_pref("greasemonkey.scriptvals.PDX/KoC Power - Multilang.KsOptions_159", "{\"AttackRunning\":false,\"NewTab\":false,\"KsTab\":true,\"NewTabURL\":\"hxxp://koc.god-like.org/chat\",\"NewTabName\":\"C[...]
Zeile gelöscht : user_pref("greasemonkey.scriptvals.PDX/KoC Power - Multilang.KsOptions_349", "{\"AttackRunning\":false,\"NewTab\":false,\"KsTab\":true,\"NewTabURL\":\"hxxp://koc.god-like.org/chat\",\"NewTabName\":\"C[...]

*************************

AdwCleaner[R0].txt - [13213 octets] - [04/01/2014 15:29:47]
AdwCleaner[S0].txt - [10853 octets] - [04/01/2014 15:31:28]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [10914 octets] ##########
--- --- ---


FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by karin (administrator) on KARIN-PC on 04-01-2014 16:15:14
Running from C:\Users\karin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Emsi Software GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
(Acer) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [OOTag] - C:\Windows\OOBEOffer\OOBEOffer\OOTag.exe [23072 2009-09-28] (Microsoft)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-10-29] (Google Inc.)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Facebook Update] - C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [17418928 2012-07-13] (Skype Technologies S.A.)
HKCU\...\Run: [LightShot] - C:\Users\karin\AppData\Local\Skillbrains\lightshot\LightShot.exe [220160 2012-02-02] ()
Startup: C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW_deDE398
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW_deDE398
SearchScopes: HKCU - {E627DC4B-8C04-4234-A2D4-1D634EE01C41} URL = hxxp://fastestwebsearch.com/search?q={searchterms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.110 80.69.100.214

FireFox:
========
FF ProfilePath: C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\karin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fastestwebsearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Greasemonkey - C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\karin\AppData\Roaming\5031
FF Extension: Java String Helper - C:\Users\karin\AppData\Roaming\5031

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2978720 2011-06-07] (Emsi Software GmbH)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [625184 2009-04-19] ()
R2 Greg_Service; C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [207904 2009-04-19] ()
R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [240160 2009-07-04] (Acer)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [85800 2011-02-24] (Emsi Software GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [48216 2010-09-05] (Emsi Software GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [14720 2010-05-05] (Emsi Software GmbH)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [416768 2009-06-10] (Realtek Semiconductor Corporation                          )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-09-23] ()
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2010-09-22] (Symantec Corporation)
U3 a8hsmxe1; C:\Windows\System32\Drivers\a8hsmxe1.sys [0 ] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-04 16:10 - 2014-01-04 16:10 - 00012614 _____ C:\ComboFix.txt
2014-01-04 15:45 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-04 15:45 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-04 15:45 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-04 15:43 - 2014-01-04 16:11 - 00000000 ____D C:\Qoobox
2014-01-04 15:42 - 2014-01-04 16:06 - 00000000 ____D C:\Windows\erdnt
2014-01-04 15:41 - 2014-01-04 15:41 - 05160001 ____R (Swearware) C:\Users\karin\Downloads\ComboFix.exe
2014-01-04 15:29 - 2014-01-04 15:32 - 00000000 ____D C:\AdwCleaner
2014-01-04 15:28 - 2014-01-04 15:28 - 01233962 _____ C:\Users\karin\Downloads\adwcleaner.exe
2014-01-04 14:32 - 2014-01-04 14:33 - 00022552 _____ C:\Users\karin\Downloads\Addition.txt
2014-01-04 14:26 - 2014-01-04 16:15 - 00011451 _____ C:\Users\karin\Downloads\FRST.txt
2014-01-04 14:26 - 2014-01-04 14:26 - 00000000 ____D C:\FRST
2014-01-04 14:25 - 2014-01-04 14:26 - 01931368 _____ (Farbar) C:\Users\karin\Downloads\FRST64.exe
2014-01-04 13:52 - 2014-01-04 13:52 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-04 13:51 - 2014-01-04 15:33 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-04 13:51 - 2014-01-04 14:48 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-04 13:47 - 2014-01-04 13:48 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25(1).exe
2014-01-04 13:45 - 2014-01-04 13:46 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25.exe
2014-01-02 08:51 - 2014-01-04 15:38 - 00000672 _____ C:\Windows\setupact.log
2014-01-02 08:51 - 2014-01-04 15:33 - 00005826 _____ C:\Windows\PFRO.log
2014-01-02 08:51 - 2014-01-02 08:51 - 00000000 _____ C:\Windows\setuperr.log
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-01 21:15 - 2014-01-01 21:15 - 00337960 _____ (Amônétízé Ltd) C:\Users\karin\Downloads\MozFir24__4812_il1314.exe
2014-01-01 20:37 - 2014-01-01 20:38 - 00755792 _____ C:\Users\karin\Downloads\Firefox_Setup.exe
2014-01-01 20:31 - 2014-01-01 20:32 - 00109144 _____ () C:\Users\karin\Downloads\Setup.exe
2014-01-01 20:21 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\eCyber
2014-01-01 20:20 - 2014-01-01 20:20 - 00000000 ____D C:\Windows\system32\log
2013-12-20 18:41 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-20 18:41 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-20 18:41 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-20 18:41 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-20 18:41 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-20 18:41 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-20 18:41 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-20 18:41 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-20 18:41 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-20 18:41 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-20 18:41 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-20 18:41 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-20 18:41 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-20 18:41 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-20 18:41 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-20 18:41 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-20 18:41 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-20 18:41 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-20 18:41 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-20 18:41 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-20 18:41 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-20 18:41 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-20 18:41 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-20 18:41 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-20 18:41 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-20 18:41 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-20 18:41 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-20 18:40 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-20 18:40 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-20 18:40 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-20 18:40 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-20 08:56 - 2013-12-20 08:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 18:52 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-18 18:46 - 2013-12-18 18:46 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-12 19:55 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 19:55 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 19:55 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 19:55 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 07:08 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 07:08 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 07:08 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 07:08 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 07:08 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 07:08 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 07:08 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 07:08 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 07:08 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 07:08 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 07:08 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 07:08 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 07:08 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 07:08 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 07:08 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 07:08 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 07:08 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 07:08 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 07:08 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

==================== One Month Modified Files and Folders =======

2014-01-04 16:15 - 2014-01-04 14:26 - 00011451 _____ C:\Users\karin\Downloads\FRST.txt
2014-01-04 16:11 - 2014-01-04 15:43 - 00000000 ____D C:\Qoobox
2014-01-04 16:10 - 2014-01-04 16:10 - 00012614 _____ C:\ComboFix.txt
2014-01-04 16:10 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-04 16:06 - 2014-01-04 15:42 - 00000000 ____D C:\Windows\erdnt
2014-01-04 16:04 - 2012-07-23 22:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-04 16:04 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-04 15:57 - 2011-10-06 19:03 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000UA.job
2014-01-04 15:48 - 2010-09-22 22:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-04 15:47 - 2013-07-13 07:15 - 02006501 _____ C:\Windows\WindowsUpdate.log
2014-01-04 15:46 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-04 15:46 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-04 15:44 - 2010-09-23 06:28 - 23270816 _____ C:\Windows\system32\perfh007.dat
2014-01-04 15:44 - 2010-09-23 06:28 - 07274776 _____ C:\Windows\system32\perfc007.dat
2014-01-04 15:44 - 2009-07-14 06:13 - 00006354 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-04 15:41 - 2014-01-04 15:41 - 05160001 ____R (Swearware) C:\Users\karin\Downloads\ComboFix.exe
2014-01-04 15:38 - 2014-01-02 08:51 - 00000672 _____ C:\Windows\setupact.log
2014-01-04 15:38 - 2010-09-22 22:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-04 15:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-04 15:33 - 2014-01-04 13:51 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-04 15:33 - 2014-01-02 08:51 - 00005826 _____ C:\Windows\PFRO.log
2014-01-04 15:32 - 2014-01-04 15:29 - 00000000 ____D C:\AdwCleaner
2014-01-04 15:31 - 2011-03-11 17:04 - 00001054 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-04 15:31 - 2010-09-22 20:50 - 00001004 _____ C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-04 15:28 - 2014-01-04 15:28 - 01233962 _____ C:\Users\karin\Downloads\adwcleaner.exe
2014-01-04 14:48 - 2014-01-04 13:51 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-04 14:48 - 2011-09-04 11:14 - 00000137 _____ C:\Windows\wininit.ini
2014-01-04 14:33 - 2014-01-04 14:32 - 00022552 _____ C:\Users\karin\Downloads\Addition.txt
2014-01-04 14:26 - 2014-01-04 14:26 - 00000000 ____D C:\FRST
2014-01-04 14:26 - 2014-01-04 14:25 - 01931368 _____ (Farbar) C:\Users\karin\Downloads\FRST64.exe
2014-01-04 13:52 - 2014-01-04 13:52 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-04 13:48 - 2014-01-04 13:47 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25(1).exe
2014-01-04 13:46 - 2014-01-04 13:45 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25.exe
2014-01-02 08:51 - 2014-01-02 08:51 - 00000000 _____ C:\Windows\setuperr.log
2014-01-01 21:57 - 2010-09-25 14:41 - 00000000 ____D C:\Windows\Minidump
2014-01-01 21:57 - 2009-10-29 04:52 - 00000000 ____D C:\Windows\Panther
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-01 21:15 - 2014-01-01 21:15 - 00337960 _____ (Amônétízé Ltd) C:\Users\karin\Downloads\MozFir24__4812_il1314.exe
2014-01-01 21:08 - 2010-09-22 20:50 - 00000000 ___RD C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-01 20:38 - 2014-01-01 20:37 - 00755792 _____ C:\Users\karin\Downloads\Firefox_Setup.exe
2014-01-01 20:32 - 2014-01-01 20:31 - 00109144 _____ () C:\Users\karin\Downloads\Setup.exe
2014-01-01 20:21 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\eCyber
2014-01-01 20:20 - 2014-01-01 20:20 - 00000000 ____D C:\Windows\system32\log
2014-01-01 20:19 - 2011-02-19 22:03 - 00421032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2014-01-01 20:19 - 2011-02-18 23:40 - 00773800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2014-01-01 20:13 - 2011-01-06 22:04 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2013-12-31 11:43 - 2010-09-22 20:45 - 00000000 ____D C:\Users\karin
2013-12-28 14:56 - 2011-04-20 11:18 - 00000000 ____D C:\Users\karin\AppData\Roaming\Skype
2013-12-24 07:59 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-20 08:57 - 2013-12-20 08:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 09:40 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-19 06:57 - 2011-10-06 19:03 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000Core.job
2013-12-19 06:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-18 18:46 - 2013-12-18 18:46 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-15 18:48 - 2013-07-16 17:27 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 18:46 - 2010-09-23 06:37 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 06:44 - 2009-07-14 05:45 - 00308000 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 09:05 - 2012-07-23 22:06 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 09:05 - 2012-07-23 22:06 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 09:05 - 2012-07-23 22:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-30 12:22

==================== End Of Log ============================
--- --- ---

--- --- ---

aharonov 04.01.2014 16:42
Hi,

wie läuft der Rechner jetzt? Bestehen noch Probleme?


Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
SearchScopes: HKCU - {E627DC4B-8C04-4234-A2D4-1D634EE01C41} URL = hxxp://fastestwebsearch.com/search?q={searchterms}
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\karin\AppData\Roaming\5031
FF Extension: Java String Helper - C:\Users\karin\AppData\Roaming\5031
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fastestwebsearch.xml

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Schritt 2

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




Schritt 3


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset




Schritt 4

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.



Bitte poste in deiner nächsten Antwort:
  • Fixlog von FRST
  • Log von MBAM
  • Log von ESET
  • Log von FRST

omaka52 04.01.2014 17:31
sorry, dauert noch was bin noch nicht fertig

aharonov 04.01.2014 17:38
Kein Problem. Der ESET-Scan kann sehr lange dauern, das ist normal.

omaka52 04.01.2014 18:23
ich denke, den schritt 3 brauch ich nicht, ich besitze keinen usb stick etc. den rest hab ich :-)Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.04.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
karin :: KARIN-PC [Administrator]

Schutz: Aktiviert

04.01.2014 17:25:00
mbam-log-2014-01-04 (17-25-00).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 264502
Laufzeit: 7 Minute(n), 3 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\karin\Downloads\Firefox_Setup.exe (PUP.Optional.InstallCore.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\karin\Downloads\MozFir24__4812_il1314.exe (PUP.Optional.InstallMonetizer) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by karin (administrator) on KARIN-PC on 04-01-2014 18:05:34
Running from C:\Users\karin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Emsi Software GmbH) C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Acer Incorporated) C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe
(Acer) C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(DT Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\NETGEAR\WG111v3\WG111v3.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7981088 2009-07-20] (Realtek Semiconductor)
HKLM\...\Run: [OOTag] - C:\Windows\OOBEOffer\OOBEOffer\OOTag.exe [23072 2009-09-28] (Microsoft)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - rundll32.exe "C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll",ProcessCleanupScript [1127496 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-10-29] (Google Inc.)
HKCU\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd)
HKCU\...\Run: [Facebook Update] - C:\Users\karin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [17418928 2012-07-13] (Skype Technologies S.A.)
HKCU\...\Run: [LightShot] - C:\Users\karin\AppData\Local\Skillbrains\lightshot\LightShot.exe [220160 2012-02-02] ()
Startup: C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (Facebook)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL =
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW_deDE398
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACEW_deDE398
SearchScopes: HKCU - {E627DC4B-8C04-4234-A2D4-1D634EE01C41} URL = hxxp://fastestwebsearch.com/search?q={searchterms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework//microsoft/wrc32.ocx
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\System32\urlmon.dll (Microsoft Corporation)
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 80.69.100.110 80.69.100.214

FireFox:
========
FF ProfilePath: C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @java.com/DTPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1205146.dll (Adobe Systems, Inc.)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\karin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\karin\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fastestwebsearch.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Greasemonkey - C:\Users\karin\AppData\Roaming\Mozilla\Firefox\Profiles\5uatq56c.default-1376652176663\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\karin\AppData\Roaming\5031
FF Extension: Java String Helper - C:\Users\karin\AppData\Roaming\5031

==================== Services (Whitelisted) =================

R2 a2AntiMalware; C:\Program Files (x86)\Emsisoft Anti-Malware\a2service.exe [2978720 2011-06-07] (Emsi Software GmbH)
R2 ForceWare Intelligent Application Manager (IAM); C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe [625184 2009-04-19] ()
R2 Greg_Service; C:\Program Files (x86)\eMachines\Registration\GregHSRW.exe [1150496 2009-08-28] (Acer Incorporated)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
R2 nSvcIp; C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe [207904 2009-04-19] ()
R2 Updater Service; C:\Program Files\eMachines\eMachines Updater\UpdaterService.exe [240160 2009-07-04] (Acer)
R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R3 a2acc; C:\PROGRAM FILES (X86)\EMSISOFT ANTI-MALWARE\a2accx64.sys [85800 2011-02-24] (Emsi Software GmbH)
R1 a2injectiondriver; C:\Program Files (x86)\Emsisoft Anti-Malware\a2dix64.sys [48216 2010-09-05] (Emsi Software GmbH)
R1 a2util; C:\Program Files (x86)\Emsisoft Anti-Malware\a2util64.sys [14720 2010-05-05] (Emsi Software GmbH)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 RTL8187B; C:\Windows\System32\DRIVERS\RTL8187B.sys [416768 2009-06-10] (Realtek Semiconductor Corporation                          )
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-09-23] ()
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [172592 2010-09-22] (Symantec Corporation)
U3 a8hsmxe1; C:\Windows\System32\Drivers\a8hsmxe1.sys [0 ] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-04 17:46 - 2014-01-04 17:46 - 02347384 _____ (ESET) C:\Users\karin\Downloads\esetsmartinstaller_enu(1).exe
2014-01-04 17:42 - 2014-01-04 17:42 - 02347384 _____ (ESET) C:\Users\karin\Downloads\esetsmartinstaller_enu.exe
2014-01-04 17:42 - 2014-01-04 17:42 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-04 17:22 - 2014-01-04 17:22 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-04 17:22 - 2014-01-04 17:22 - 00000000 ____D C:\Users\karin\AppData\Roaming\Malwarebytes
2014-01-04 17:22 - 2014-01-04 17:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-04 17:22 - 2014-01-04 17:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-04 17:22 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-01-04 17:21 - 2014-01-04 17:21 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\karin\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-04 17:21 - 2014-01-04 17:21 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\karin\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-01-04 17:00 - 2014-01-04 17:15 - 00000400 _____ C:\Users\karin\Downloads\Search.txt
2014-01-04 16:10 - 2014-01-04 16:10 - 00012614 _____ C:\ComboFix.txt
2014-01-04 15:45 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2014-01-04 15:45 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2014-01-04 15:45 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2014-01-04 15:45 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2014-01-04 15:43 - 2014-01-04 16:11 - 00000000 ____D C:\Qoobox
2014-01-04 15:42 - 2014-01-04 16:06 - 00000000 ____D C:\Windows\erdnt
2014-01-04 15:41 - 2014-01-04 15:41 - 05160001 ____R (Swearware) C:\Users\karin\Downloads\ComboFix.exe
2014-01-04 15:29 - 2014-01-04 15:32 - 00000000 ____D C:\AdwCleaner
2014-01-04 15:28 - 2014-01-04 15:28 - 01233962 _____ C:\Users\karin\Downloads\adwcleaner.exe
2014-01-04 14:32 - 2014-01-04 14:33 - 00022552 _____ C:\Users\karin\Downloads\Addition.txt
2014-01-04 14:26 - 2014-01-04 18:05 - 00012490 _____ C:\Users\karin\Downloads\FRST.txt
2014-01-04 14:26 - 2014-01-04 14:26 - 00000000 ____D C:\FRST
2014-01-04 14:25 - 2014-01-04 14:26 - 01931368 _____ (Farbar) C:\Users\karin\Downloads\FRST64.exe
2014-01-04 13:52 - 2014-01-04 13:52 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-04 13:51 - 2014-01-04 15:33 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-04 13:51 - 2014-01-04 14:48 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-04 13:47 - 2014-01-04 13:48 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25(1).exe
2014-01-04 13:45 - 2014-01-04 13:46 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25.exe
2014-01-02 08:51 - 2014-01-04 15:38 - 00000672 _____ C:\Windows\setupact.log
2014-01-02 08:51 - 2014-01-04 15:33 - 00005826 _____ C:\Windows\PFRO.log
2014-01-02 08:51 - 2014-01-02 08:51 - 00000000 _____ C:\Windows\setuperr.log
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-01 20:31 - 2014-01-01 20:32 - 00109144 _____ () C:\Users\karin\Downloads\Setup.exe
2014-01-01 20:21 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\eCyber
2014-01-01 20:20 - 2014-01-01 20:20 - 00000000 ____D C:\Windows\system32\log
2013-12-20 18:41 - 2013-11-26 12:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-12-20 18:41 - 2013-11-26 11:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-12-20 18:41 - 2013-11-26 11:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2013-12-20 18:41 - 2013-11-26 10:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-12-20 18:41 - 2013-11-26 10:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2013-12-20 18:41 - 2013-11-26 10:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-12-20 18:41 - 2013-11-26 10:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-12-20 18:41 - 2013-11-26 10:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-12-20 18:41 - 2013-11-26 10:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-12-20 18:41 - 2013-11-26 10:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-12-20 18:41 - 2013-11-26 10:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-12-20 18:41 - 2013-11-26 10:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2013-12-20 18:41 - 2013-11-26 10:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2013-12-20 18:41 - 2013-11-26 09:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-12-20 18:41 - 2013-11-26 09:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-12-20 18:41 - 2013-11-26 09:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-12-20 18:41 - 2013-11-26 09:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-12-20 18:41 - 2013-11-26 09:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2013-12-20 18:41 - 2013-11-26 09:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-12-20 18:41 - 2013-11-26 08:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-12-20 18:41 - 2013-11-26 08:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-12-20 18:41 - 2013-11-26 08:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-12-20 18:41 - 2013-11-26 07:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-12-20 18:41 - 2013-11-26 07:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2013-12-20 18:41 - 2013-11-26 07:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-12-20 18:41 - 2013-11-26 07:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-12-20 18:41 - 2013-11-26 07:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-12-20 18:40 - 2013-11-26 11:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-12-20 18:40 - 2013-11-26 09:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-12-20 18:40 - 2013-11-26 09:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-12-20 18:40 - 2013-11-26 08:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-12-20 08:56 - 2013-12-20 08:57 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-18 18:52 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE
2013-12-18 18:46 - 2013-12-18 18:46 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-12 19:55 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2013-12-12 19:55 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2013-12-12 19:55 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2013-12-12 19:55 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2013-12-11 07:08 - 2013-11-23 19:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-12-11 07:08 - 2013-11-23 18:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2013-12-11 07:08 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-12-11 07:08 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-12-11 07:08 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll
2013-12-11 07:08 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll
2013-12-11 07:08 - 2013-10-30 02:24 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-12-11 07:08 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2013-12-11 07:08 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2013-12-11 07:08 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2013-12-11 07:08 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2013-12-11 07:08 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2013-12-11 07:08 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2013-12-11 07:08 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2013-12-11 07:08 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2013-12-11 07:08 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2013-12-11 07:08 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2013-12-11 07:08 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2013-12-11 07:08 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys

==================== One Month Modified Files and Folders =======

2014-01-04 18:05 - 2014-01-04 14:26 - 00012490 _____ C:\Users\karin\Downloads\FRST.txt
2014-01-04 18:04 - 2012-07-23 22:06 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-04 17:49 - 2010-09-22 22:59 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-04 17:46 - 2014-01-04 17:46 - 02347384 _____ (ESET) C:\Users\karin\Downloads\esetsmartinstaller_enu(1).exe
2014-01-04 17:42 - 2014-01-04 17:42 - 02347384 _____ (ESET) C:\Users\karin\Downloads\esetsmartinstaller_enu.exe
2014-01-04 17:42 - 2014-01-04 17:42 - 00000000 ____D C:\Program Files (x86)\ESET
2014-01-04 17:22 - 2014-01-04 17:22 - 00001114 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-01-04 17:22 - 2014-01-04 17:22 - 00000000 ____D C:\Users\karin\AppData\Roaming\Malwarebytes
2014-01-04 17:22 - 2014-01-04 17:22 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-04 17:22 - 2014-01-04 17:22 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-04 17:21 - 2014-01-04 17:21 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\karin\Downloads\mbam-setup-1.75.0.1300.exe
2014-01-04 17:21 - 2014-01-04 17:21 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\karin\Downloads\mbam-setup-1.75.0.1300(1).exe
2014-01-04 17:15 - 2014-01-04 17:00 - 00000400 _____ C:\Users\karin\Downloads\Search.txt
2014-01-04 17:13 - 2013-07-13 07:15 - 02008831 _____ C:\Windows\WindowsUpdate.log
2014-01-04 16:11 - 2014-01-04 15:43 - 00000000 ____D C:\Qoobox
2014-01-04 16:10 - 2014-01-04 16:10 - 00012614 _____ C:\ComboFix.txt
2014-01-04 16:10 - 2009-07-14 04:20 - 00000000 __RHD C:\Users\Default
2014-01-04 16:06 - 2014-01-04 15:42 - 00000000 ____D C:\Windows\erdnt
2014-01-04 16:04 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2014-01-04 15:57 - 2011-10-06 19:03 - 00001138 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000UA.job
2014-01-04 15:46 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-04 15:46 - 2009-07-14 05:45 - 00009696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-04 15:44 - 2010-09-23 06:28 - 23270816 _____ C:\Windows\system32\perfh007.dat
2014-01-04 15:44 - 2010-09-23 06:28 - 07274776 _____ C:\Windows\system32\perfc007.dat
2014-01-04 15:44 - 2009-07-14 06:13 - 00006354 _____ C:\Windows\system32\PerfStringBackup.INI
2014-01-04 15:41 - 2014-01-04 15:41 - 05160001 ____R (Swearware) C:\Users\karin\Downloads\ComboFix.exe
2014-01-04 15:38 - 2014-01-02 08:51 - 00000672 _____ C:\Windows\setupact.log
2014-01-04 15:38 - 2010-09-22 22:59 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-04 15:38 - 2009-07-14 06:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-04 15:33 - 2014-01-04 13:51 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-04 15:33 - 2014-01-02 08:51 - 00005826 _____ C:\Windows\PFRO.log
2014-01-04 15:32 - 2014-01-04 15:29 - 00000000 ____D C:\AdwCleaner
2014-01-04 15:31 - 2011-03-11 17:04 - 00001054 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-01-04 15:31 - 2010-09-22 20:50 - 00001004 _____ C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-01-04 15:28 - 2014-01-04 15:28 - 01233962 _____ C:\Users\karin\Downloads\adwcleaner.exe
2014-01-04 14:48 - 2014-01-04 13:51 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-04 14:48 - 2011-09-04 11:14 - 00000137 _____ C:\Windows\wininit.ini
2014-01-04 14:33 - 2014-01-04 14:32 - 00022552 _____ C:\Users\karin\Downloads\Addition.txt
2014-01-04 14:26 - 2014-01-04 14:26 - 00000000 ____D C:\FRST
2014-01-04 14:26 - 2014-01-04 14:25 - 01931368 _____ (Farbar) C:\Users\karin\Downloads\FRST64.exe
2014-01-04 13:52 - 2014-01-04 13:52 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-04 13:48 - 2014-01-04 13:47 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25(1).exe
2014-01-04 13:46 - 2014-01-04 13:45 - 40658208 _____ (Safer-Networking Ltd.                                      ) C:\Users\karin\Downloads\spybot-2.2.25.exe
2014-01-02 08:51 - 2014-01-02 08:51 - 00000000 _____ C:\Windows\setuperr.log
2014-01-01 21:57 - 2010-09-25 14:41 - 00000000 ____D C:\Windows\Minidump
2014-01-01 21:57 - 2009-10-29 04:52 - 00000000 ____D C:\Windows\Panther
2014-01-01 21:17 - 2014-01-01 21:17 - 00000000 ____D C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Start Lollipop
2014-01-01 21:08 - 2010-09-22 20:50 - 00000000 ___RD C:\Users\karin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-01-01 20:32 - 2014-01-01 20:31 - 00109144 _____ () C:\Users\karin\Downloads\Setup.exe
2014-01-01 20:21 - 2014-01-01 20:21 - 00000000 ____D C:\Users\karin\AppData\Roaming\eCyber
2014-01-01 20:20 - 2014-01-01 20:20 - 00000000 ____D C:\Windows\system32\log
2014-01-01 20:19 - 2011-02-19 22:03 - 00421032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp100.dll
2014-01-01 20:19 - 2011-02-18 23:40 - 00773800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr100.dll
2014-01-01 20:13 - 2011-01-06 22:04 - 00000000 ____D C:\Program Files (x86)\Emsisoft Anti-Malware
2013-12-31 11:43 - 2010-09-22 20:45 - 00000000 ____D C:\Users\karin
2013-12-28 14:56 - 2011-04-20 11:18 - 00000000 ____D C:\Users\karin\AppData\Roaming\Skype
2013-12-24 07:59 - 2009-07-14 06:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-12-20 08:57 - 2013-12-20 08:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-12-19 09:40 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\rescache
2013-12-19 06:57 - 2011-10-06 19:03 - 00001116 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-85279687-4208295537-238049305-1000Core.job
2013-12-19 06:31 - 2009-07-14 04:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-12-18 18:46 - 2013-12-18 18:46 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2013-12-18 18:46 - 2013-12-18 18:46 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-12-18 18:46 - 2013-12-18 18:46 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-12-18 18:46 - 2013-12-18 18:46 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-12-18 18:46 - 2013-12-18 18:46 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2013-12-18 18:46 - 2013-12-18 18:46 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-12-15 18:48 - 2013-07-16 17:27 - 00000000 ____D C:\Windows\system32\MRT
2013-12-15 18:46 - 2010-09-23 06:37 - 90708896 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-12-13 06:44 - 2009-07-14 05:45 - 00308000 _____ C:\Windows\system32\FNTCACHE.DAT
2013-12-11 09:05 - 2012-07-23 22:06 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-12-11 09:05 - 2012-07-23 22:06 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-12-11 09:05 - 2012-07-23 22:06 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-30 12:22

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-01-2014
Ran by karin at 2014-01-04 18:17:35 Run:1
Running from C:\Users\karin\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKCU - {E627DC4B-8C04-4234-A2D4-1D634EE01C41} URL = hxxp://fastestwebsearch.com/search?q={searchterms}
FF HKCU\...\Firefox\Extensions: [{184AA5E6-741D-464a-820E-94B3ABC2F3B4}] - C:\Users\karin\AppData\Roaming\5031
FF Extension: Java String Helper - C:\Users\karin\AppData\Roaming\5031
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\fastestwebsearch.xml
*****************

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E627DC4B-8C04-4234-A2D4-1D634EE01C41} => Key deleted successfully.
HKCR\CLSID\{E627DC4B-8C04-4234-A2D4-1D634EE01C41} => Key not found.
HKCU\Software\Mozilla\Firefox\Extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4} => Value deleted successfully.
C:\Users\karin\AppData\Roaming\5031 => Moved successfully.
C:\Program Files (x86)\mozilla firefox\searchplugins\fastestwebsearch.xml => Moved successfully.

==== End of Fixlog ====

aharonov 04.01.2014 19:22
Zitat:
ich denke, den schritt 3 brauch ich nicht, ich besitze keinen usb stick etc. den rest hab ich :-)
Doch, den würd ich noch machen. Es geht dabei nicht um USB-Sticks, das wäre nur eine Zugabe.

omaka52 04.01.2014 19:36
ok, ich mach ihn, sorry, aber ich dachte es würde um externe geräte gehen, ich bin echt volllaie.

aharonov 04.01.2014 20:24
Vor allem wird nochmals die ganze Festplatte durchwühlt, ob noch irgendwo was zum Vorschein kommt. Der Scan könnte deshalb auch etwas länger dauern.

omaka52 05.01.2014 12:53
hi sorry, dass ich mich jetzt erst melde, aber bei dem scan ist mir der rechner bei 81% und nach 12 Std. abgestürzt. er läuft nun wieder aber es wird wohl noch dauern, ist gerade bei 49%. melde mich sobald alles ok ist

aharonov 05.01.2014 13:25
Ok, alles klar.

omaka52 05.01.2014 18:48
hi, ich muss nochmal nerven, der eset scan läuft jetzt über 10 std. und steht wieder bei 81% und da steht er schon seit stunden. ich sehe, dass es läuft, aber kann das solange dauern. ok er hat mittlerweile noch 3 trojaner gefunden.


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:17 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55