Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem
Ein Freund hat einen alten Rechner geschenkt bekommen und mich gebeten, den mal ein bisschen aufzuraeumen.
Betriebssystem Windows Vista 32 bit
Betriebssystem und alle Programme sind in Englisch.
Habe ca. 30 Programme deinstalliert inclusive 2! Antivirenprogramme (Norton Security Scan und Microsoft Security Essentials).
Habe stattdessen Avira installiert und einen Scan laufen lassen. Dabei Virus gefunden: EXP/ASF.GetCodec.Gen - jetzt in Quarantaene. Ausserdem 3 versteckte Dateien.
Anschliessend habe ich Malwarebytes installiert und laufen lassen. Auch hier 2 Funde - siehe Log.
Jetzt habe ich noch folgende Schritte untenommen:
Defogger ist gelaufen.
FRST ist gelaufen.
GMER ist gelaufen.
Alle Logs anbei.
Ich hoffe, ich habe alle Informationen vollstaendig und waere fuer eure Hilfe beim weiteren Vorgehen extrem dankbar!:dankeschoen:
Viele Gruesse
AVIRA Code:
Avira Free Antivirus
Report file date: 10 February 2014 16:54
The program is running as an unrestricted full version.
Online services are available.
Licensee : Avira Antivirus Free
Serial number : 0000149996-AVHOE-0000001
Platform : Windows Vista (TM) Home Premium
Windows version : (Service Pack 2) [6.0.6002]
Boot mode : Normally booted
Username : SYSTEM
Computer name : MY-COMPUTER
Version information:
BUILD.DAT : 14.0.2.286 55547 Bytes 09/12/2013 11:37:00
AVSCAN.EXE : 14.0.2.254 1032760 Bytes 09/12/2013 10:37:19
AVSCANRC.DLL : 14.0.2.180 52280 Bytes 09/12/2013 10:37:19
LUKE.DLL : 14.0.2.234 65592 Bytes 09/12/2013 10:37:20
AVSCPLR.DLL : 14.0.2.254 124472 Bytes 09/12/2013 10:37:19
AVREG.DLL : 14.0.2.212 250424 Bytes 09/12/2013 10:37:19
avlode.dll : 14.0.2.254 540216 Bytes 09/12/2013 10:37:19
avlode.rdf : 13.0.1.70 56974 Bytes 10/02/2014 15:36:42
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04/04/2013 10:37:22
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30/04/2013 10:37:22
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28/05/2013 10:37:22
VBASE003.VDF : 7.11.85.214 2162688 Bytes 21/06/2013 10:37:22
VBASE004.VDF : 7.11.91.176 3903488 Bytes 23/07/2013 10:37:22
VBASE005.VDF : 7.11.98.186 6822912 Bytes 29/08/2013 10:37:22
VBASE006.VDF : 7.11.103.230 2293248 Bytes 24/09/2013 10:37:22
VBASE007.VDF : 7.11.116.38 5485568 Bytes 28/11/2013 10:37:22
VBASE008.VDF : 7.11.126.50 3615744 Bytes 22/01/2014 15:36:36
VBASE009.VDF : 7.11.128.174 2030080 Bytes 03/02/2014 15:36:37
VBASE010.VDF : 7.11.128.175 2048 Bytes 03/02/2014 15:36:37
VBASE011.VDF : 7.11.128.176 2048 Bytes 03/02/2014 15:36:37
VBASE012.VDF : 7.11.128.177 2048 Bytes 03/02/2014 15:36:37
VBASE013.VDF : 7.11.128.178 2048 Bytes 03/02/2014 15:36:37
VBASE014.VDF : 7.11.129.9 211456 Bytes 04/02/2014 15:36:37
VBASE015.VDF : 7.11.129.163 215040 Bytes 06/02/2014 15:36:38
VBASE016.VDF : 7.11.130.21 220672 Bytes 08/02/2014 15:36:38
VBASE017.VDF : 7.11.130.99 230400 Bytes 10/02/2014 15:36:38
VBASE018.VDF : 7.11.130.100 2048 Bytes 10/02/2014 15:36:38
VBASE019.VDF : 7.11.130.101 2048 Bytes 10/02/2014 15:36:38
VBASE020.VDF : 7.11.130.102 2048 Bytes 10/02/2014 15:36:38
VBASE021.VDF : 7.11.130.103 2048 Bytes 10/02/2014 15:36:38
VBASE022.VDF : 7.11.130.104 2048 Bytes 10/02/2014 15:36:38
VBASE023.VDF : 7.11.130.105 2048 Bytes 10/02/2014 15:36:38
VBASE024.VDF : 7.11.130.106 2048 Bytes 10/02/2014 15:36:38
VBASE025.VDF : 7.11.130.107 2048 Bytes 10/02/2014 15:36:38
VBASE026.VDF : 7.11.130.108 2048 Bytes 10/02/2014 15:36:38
VBASE027.VDF : 7.11.130.109 2048 Bytes 10/02/2014 15:36:38
VBASE028.VDF : 7.11.130.110 2048 Bytes 10/02/2014 15:36:38
VBASE029.VDF : 7.11.130.111 2048 Bytes 10/02/2014 15:36:38
VBASE030.VDF : 7.11.130.112 2048 Bytes 10/02/2014 15:36:38
VBASE031.VDF : 7.11.130.146 163840 Bytes 10/02/2014 15:36:39
Engine version : 8.2.14.2
AEVDF.DLL : 8.1.3.4 102774 Bytes 09/12/2013 10:37:18
AESCRIPT.DLL : 8.1.4.186 520574 Bytes 10/02/2014 15:36:41
AESCN.DLL : 8.1.10.6 131447 Bytes 10/02/2014 15:36:41
AESBX.DLL : 8.2.20.6 1331575 Bytes 10/02/2014 15:36:42
AERDL.DLL : 8.2.0.138 704888 Bytes 09/12/2013 10:37:18
AEPACK.DLL : 8.3.3.12 774521 Bytes 10/02/2014 15:36:41
AEOFFICE.DLL : 8.1.2.76 205181 Bytes 09/12/2013 10:37:18
AEHEUR.DLL : 8.1.4.904 6455674 Bytes 10/02/2014 15:36:41
AEHELP.DLL : 8.1.27.10 266618 Bytes 09/12/2013 10:37:18
AEGEN.DLL : 8.1.7.22 446839 Bytes 10/02/2014 15:36:39
AEEXP.DLL : 8.4.1.202 434552 Bytes 10/02/2014 15:36:42
AEEMU.DLL : 8.1.3.2 393587 Bytes 09/12/2013 10:37:18
AECORE.DLL : 8.1.34.0 229753 Bytes 10/02/2014 15:36:39
AEBB.DLL : 8.1.1.4 53619 Bytes 09/12/2013 10:37:18
AVWINLL.DLL : 14.0.2.180 23608 Bytes 09/12/2013 10:37:19
AVPREF.DLL : 14.0.2.180 48696 Bytes 09/12/2013 10:37:19
AVREP.DLL : 14.0.2.180 175672 Bytes 09/12/2013 10:37:19
AVARKT.DLL : 14.0.2.254 256056 Bytes 09/12/2013 10:37:18
AVEVTLOG.DLL : 14.0.2.180 165944 Bytes 09/12/2013 10:37:18
SQLITE3.DLL : 3.7.0.1 394808 Bytes 09/12/2013 10:37:21
AVSMTP.DLL : 14.0.2.180 60472 Bytes 09/12/2013 10:37:19
NETNT.DLL : 14.0.2.180 13368 Bytes 09/12/2013 10:37:20
RCIMAGE.DLL : 14.0.2.180 4788792 Bytes 09/12/2013 10:37:21
RCTEXT.DLL : 14.0.2.236 72760 Bytes 09/12/2013 10:37:21
Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\program files\avira\antivir desktop\sysscan.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: extended
Start of the scan: 10 February 2014 16:54
Start scanning boot sectors:
Boot sector 'HDD0(C:, D:)'
[INFO] No virus was found!
Starting search for hidden objects.
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
[NOTE] The registry entry is invisible.
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0MRUListEx
[NOTE] The registry entry is invisible.
Hidden driver
[NOTE] A memory modification has been detected, which could potentially be used to hide file access attempts.
The scan of running processes will be started:
Scan process 'DllHost.exe' - '22' Module(s) have been scanned
Scan process 'SearchFilterHost.exe' - '33' Module(s) have been scanned
Scan process 'SearchProtocolHost.exe' - '62' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '62' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'vssvc.exe' - '49' Module(s) have been scanned
Scan process 'avscan.exe' - '106' Module(s) have been scanned
Scan process 'avscan.exe' - '47' Module(s) have been scanned
Scan process 'avcenter.exe' - '86' Module(s) have been scanned
Scan process 'armsvc.exe' - '24' Module(s) have been scanned
Scan process 'svchost.exe' - '21' Module(s) have been scanned
Scan process 'conime.exe' - '16' Module(s) have been scanned
Scan process 'Apntex.exe' - '21' Module(s) have been scanned
Scan process 'HidFind.exe' - '23' Module(s) have been scanned
Scan process 'ApMsgFwd.exe' - '16' Module(s) have been scanned
Scan process 'taskeng.exe' - '49' Module(s) have been scanned
Scan process 'avshadow.exe' - '33' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '34' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '25' Module(s) have been scanned
Scan process 'pwsafe.exe' - '45' Module(s) have been scanned
Scan process 'ONENOTEM.EXE' - '18' Module(s) have been scanned
Scan process 'quickset.exe' - '80' Module(s) have been scanned
Scan process 'DLG.exe' - '22' Module(s) have been scanned
Scan process 'BTTray.exe' - '54' Module(s) have been scanned
Scan process 'daemon.exe' - '47' Module(s) have been scanned
Scan process 'ehmsas.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '26' Module(s) have been scanned
Scan process 'xaudio.exe' - '14' Module(s) have been scanned
Scan process 'avgnt.exe' - '77' Module(s) have been scanned
Scan process 'svchost.exe' - '25' Module(s) have been scanned
Scan process 'svchost.exe' - '44' Module(s) have been scanned
Scan process 'STacSV.exe' - '35' Module(s) have been scanned
Scan process 'SeaPort.exe' - '56' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '42' Module(s) have been scanned
Scan process 'Iaantmon.exe' - '36' Module(s) have been scanned
Scan process 'sttray.exe' - '36' Module(s) have been scanned
Scan process 'hpwuschd2.exe' - '16' Module(s) have been scanned
Scan process 'PCMService.exe' - '55' Module(s) have been scanned
Scan process 'IAAnotif.exe' - '38' Module(s) have been scanned
Scan process 'igfxpers.exe' - '20' Module(s) have been scanned
Scan process 'hkcmd.exe' - '23' Module(s) have been scanned
Scan process 'OEM02Mon.exe' - '30' Module(s) have been scanned
Scan process 'Apoint.exe' - '33' Module(s) have been scanned
Scan process 'EvtEng.exe' - '88' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'avguard.exe' - '94' Module(s) have been scanned
Scan process 'aestsrv.exe' - '5' Module(s) have been scanned
Scan process 'svchost.exe' - '58' Module(s) have been scanned
Scan process 'sched.exe' - '59' Module(s) have been scanned
Scan process 'taskeng.exe' - '83' Module(s) have been scanned
Scan process 'spoolsv.exe' - '90' Module(s) have been scanned
Scan process 'WLANExt.exe' - '92' Module(s) have been scanned
Scan process 'Explorer.EXE' - '136' Module(s) have been scanned
Scan process 'svchost.exe' - '94' Module(s) have been scanned
Scan process 'Dwm.exe' - '31' Module(s) have been scanned
Scan process 'svchost.exe' - '80' Module(s) have been scanned
Scan process 'SLsvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '37' Module(s) have been scanned
Scan process 'svchost.exe' - '154' Module(s) have been scanned
Scan process 'svchost.exe' - '114' Module(s) have been scanned
Scan process 'svchost.exe' - '70' Module(s) have been scanned
Scan process 'svchost.exe' - '35' Module(s) have been scanned
Scan process 'svchost.exe' - '40' Module(s) have been scanned
Scan process 'winlogon.exe' - '30' Module(s) have been scanned
Scan process 'lsm.exe' - '22' Module(s) have been scanned
Scan process 'lsass.exe' - '60' Module(s) have been scanned
Scan process 'services.exe' - '33' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'wininit.exe' - '26' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned
Starting to scan executable files (registry):
The registry was scanned ( '1595' files ).
Starting the file scan:
Begin scan in 'C:\' <OS>
C:\Users\Leah\Videos\12 Years a Slave (2013) BRRip XviD-SV\12 Years a Slave (2013) BRRip XviD-SV.avi
[DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
Begin scan in 'D:\' <RECOVERY>
Beginning disinfection:
C:\Users\Leah\Videos\12 Years a Slave (2013) BRRip XviD-SV\12 Years a Slave (2013) BRRip XviD-SV.avi
[DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
[NOTE] The file was moved to the quarantine directory under the name '5c3baf53.qua'!
End of the scan: 10 February 2014 18:41
Used time: 1:41:36 Hour(s)
The scan has been done completely.
30791 Scanned directories
370259 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 Files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
370258 Files not concerned
3986 Archives were scanned
0 Warnings
4 Notes
659128 Objects were scanned with rootkit scan
3 Hidden objects were found
MALWAREBYTES Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2014.02.10.04
Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Leah :: MY-COMPUTER [administrator]
10/02/2014 18:48:07
14-02-10_Malwarebytes.txt
Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 393156
Time elapsed: 1 hour(s), 50 minute(s), 53 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 1
HKCU\dark (Trojan.Banker) -> No action taken.
Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows Explorer (Backdoor.Bot) -> Data: c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\\explorer.exe -> No action taken.
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
FRST Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-02-2014 01
Ran by Leah (administrator) on MY-COMPUTER on 11-02-2014 09:29:09
Running from C:\Users\Leah\Downloads
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal
The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(SourceForge.net) C:\Program Files\Password Safe\pwsafe.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Don HO don.h@free.fr) C:\Program Files\Notepad++\notepad++.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [ECenter] - C:\Dell\E-Center\EULALauncher.exe [17920 2007-05-25] ( )
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [189736 2007-11-01] (CyberLink Corp.)
HKLM\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [Windows Explorer] - c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\\explorer.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [Google Update] - C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [133104 2009-04-22] (Google Inc.)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: G - G:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: H - H:\LaunchU3.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {0e7e00eb-7e3f-11dd-9c33-001e4ce0d111} - H:\LaunchU3.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {9354534d-866d-11dd-a618-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {93545352-866d-11dd-a618-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {b9c2bde6-08e9-11e3-bebe-001d093e98c4} - F:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {ba24b8ea-82b5-11e2-aa43-001d093e98c4} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {bf0648d4-7749-11dd-9c5a-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {bfd30cf4-7aae-11dd-a31d-806e6f6e6963} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {c5a5d575-e94d-11dc-afe6-001e4ce0d111} - F:\LaunchU3.exe -a
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)
==================== Internet (Whitelisted) ====================
ProxyServer: proxy.dcu.ie:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=BT5&o=15443&src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=GX&apn_dtid=YYYYYYB3IE&apn_uid=7B29C92D-8B36-4E4E-BBF9-03BF71713D7E&apn_sauid=83B80E4B-912D-4A0A-86A0-579A31F81DC8
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
FireFox:
========
FF ProfilePath: C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default
FF DefaultSearchEngine: Bing
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing
FF SelectedSearchEngine: Bing
FF Homepage: https://www.google.de/?gws_rd=cr&ei=Vd34UrDfMIOktAbEhoD4Cg
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF NetworkProxy: "ftp", "proxy.dcu.ie"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "gopher", "proxy.dcu.ie"
FF NetworkProxy: "gopher_port", 8080
FF NetworkProxy: "http", "proxy.dcu.ie"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localho,t,127.0.0.1,*.local"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "proxy.dcu.ie"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "proxy.dcu.ie"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazon-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\chambers-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-en-GB.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-10]
FF Extension: Adblock Plus - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
Chrome:
=======
CHR HomePage: hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=en-IE&q={searchTerms}
CHR DefaultNewTabURL:
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll No File
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\Leah\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Facebook Plugin) - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-02-06]
CHR Extension: (Poppit) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-02-06]
CHR Extension: (Google Wallet) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR StartMenuInternet: Google Chrome - C:\Users\Leah\AppData\Local\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [X]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [67584 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-06-25] (Huawei Technologies Co., Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2012-01-09] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PcdrNdisuio; system32\DRIVERS\pcdrndisuio.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [X]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2014-02-11 09:29 - 2014-02-11 09:29 - 00019649 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:28 - 2014-02-11 09:29 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-11 09:28 - 01139712 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:33 - 2014-02-10 17:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:33 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-10 17:30 - 2014-02-10 17:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:23 - 2014-02-10 17:24 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:34 - 2013-12-09 11:37 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
==================== One Month Modified Files and Folders =======
2014-02-11 09:29 - 2014-02-11 09:29 - 00019649 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:29 - 2014-02-11 09:28 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-11 09:28 - 01139712 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:27 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-11 09:27 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-11 09:26 - 2006-11-02 11:33 - 00703516 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-11 09:24 - 2008-02-24 10:32 - 01851787 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 09:21 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\AppData\Local\PasswordSafe
2014-02-11 09:20 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:19 - 2012-08-14 20:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-11 09:19 - 2008-03-03 01:26 - 00000000 ____D () C:\Users\Leah
2014-02-11 09:19 - 2008-02-24 10:33 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-11 09:19 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 20:44 - 2009-07-01 19:24 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:31 - 2014-02-10 17:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:24 - 2014-02-10 17:23 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:50 - 2013-12-30 13:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-02-10 16:48 - 2008-07-10 15:51 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Skype
2014-02-10 16:45 - 2008-02-24 10:55 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-10 16:44 - 2008-02-24 11:04 - 00218752 _____ () C:\Windows\PFRO.log
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Norton
2014-02-10 16:29 - 2011-03-19 11:51 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-10 16:22 - 2008-03-03 19:51 - 00154112 _____ () C:\Users\Leah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-10 16:02 - 2008-03-21 15:13 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Adobe
2014-02-10 16:01 - 2008-08-16 11:41 - 00000000 ____D () C:\Users\Leah\Documents\My Received Files
2014-02-10 15:58 - 2008-08-16 11:30 - 00000000 ____D () C:\Program Files\Windows Live
2014-02-10 15:57 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-10 15:56 - 2008-08-16 11:41 - 00049152 _____ () C:\Windows\DPINST.LOG
2014-02-10 15:43 - 2008-03-03 01:27 - 00060248 _____ () C:\Users\Leah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-10 15:42 - 2008-02-24 10:55 - 00000000 ____D () C:\Program Files\Google
2014-02-10 15:42 - 2006-11-02 13:47 - 00270608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-10 15:37 - 2009-11-18 15:04 - 00000000 ____D () C:\ProgramData\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Program Files\Real
2014-02-10 15:36 - 2013-08-08 19:39 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Leah\Desktop\Notepad++.lnk
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Guest\Desktop\Notepad++.lnk
2014-02-10 15:26 - 2008-02-24 10:41 - 00000000 ____D () C:\Program Files\Java
2014-02-10 15:22 - 2013-01-19 13:52 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-10 15:22 - 2008-06-12 23:00 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-10 15:16 - 2013-08-18 10:49 - 00000000 ____D () C:\Program Files\HP
2014-02-10 15:15 - 2012-06-07 16:01 - 00000000 ____D () C:\Program Files\Citrix
2014-02-10 15:15 - 2009-04-22 11:03 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Mozilla
2014-02-10 15:15 - 2008-03-03 01:27 - 00000000 ____D () C:\Users\Leah\AppData\Local\Google
2014-02-10 15:14 - 2009-05-26 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-10 15:09 - 2006-11-02 11:23 - 00000144 _____ () C:\Windows\win.ini
2014-02-10 15:06 - 2008-02-24 10:43 - 00000000 ____D () C:\Program Files\Dell
2014-02-10 14:54 - 2009-07-01 19:24 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
2014-02-07 14:20 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\Documents\My Safes
2014-02-07 12:41 - 2012-08-14 20:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-07 12:41 - 2012-08-14 20:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 17:10 - 2010-12-14 00:50 - 00002082 _____ () C:\Users\Leah\Desktop\Google Chrome.lnk
2014-02-05 16:19 - 2012-05-22 11:44 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-05 15:58 - 2008-09-09 08:18 - 00005648 _____ () C:\Users\Leah\AppData\Local\d3d9caps.dat
2014-02-03 21:34 - 2010-12-13 23:13 - 00000000 ____D () C:\ProgramData\PCDr
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
2014-02-03 20:44 - 2006-11-02 13:52 - 00235301 _____ () C:\Windows\setupact.log
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ___RD () C:\Program Files\Skype
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ____D () C:\ProgramData\Skype
2014-01-19 08:32 - 2010-02-01 11:08 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-17 18:59 - 2008-02-24 10:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-17 18:58 - 2013-08-15 11:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-17 18:55 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
Some content of TEMP:
====================
C:\Users\Guest\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Leah\AppData\Local\Temp\.gbas.dll
C:\Users\Leah\AppData\Local\Temp\AdobeUpdater12345.exe
C:\Users\Leah\AppData\Local\Temp\AskInstallChecker.exe
C:\Users\Leah\AppData\Local\Temp\avgnt.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u19-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\lowproc.exe
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{5D15CCF0-4C97-4a47-BCF5-08A11A9CD40D}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{9BFE0D57-FD50-4a53-A826-91EA55449E63}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{A4CDF389-D003-47d1-AC47-2DBFBF94C119}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{A7808FEE-F897-49f6-BB6C-FE4BD5DAA9BD}.dll
C:\Users\Leah\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Leah\AppData\Local\Temp\MSN623D.exe
C:\Users\Leah\AppData\Local\Temp\NEventMessages.dll
C:\Users\Leah\AppData\Local\Temp\npp.6.5.2.Installer.exe
C:\Users\Leah\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Leah\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Leah\AppData\Local\Temp\stubhelper.dll
C:\Users\Leah\AppData\Local\Temp\swt-awt-win32-3346.dll
C:\Users\Leah\AppData\Local\Temp\swt-win32-3346.dll
C:\Users\Leah\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\Leah\AppData\Local\Temp\xmlUpdater.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2014-02-11 09:26
==================== End Of Log ============================
FRST_Addition Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 10-02-2014 01
Ran by Leah at 2014-02-11 09:29:38
Running from C:\Users\Leah\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958) (Version: - Microsoft)
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) (Version: 10.1.9 - Adobe Systems Incorporated)
Advanced Audio FX Engine (Version: - )
Advanced Video FX Engine (Version: - )
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Conexant HDA D330 MDC V.92 Modem (Version: - )
Dell Getting Started Guide (Version: 1.00.0000 - Dell Inc.)
Dell Touchpad (Version: 7.1.103.4 - Alps Electric)
Dell Webcam Center (Version: - )
Dell Webcam Manager (Version: - )
Digital Line Detect (Version: 1.21 - BVRP Software, Inc)
Google Chrome (HKCU Version: 32.0.1700.107 - Google Inc.)
Highlight Viewer (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
HP Update (Version: 5.003.003.001 - Hewlett-Packard)
Intel(R) Matrix Storage Manager (Version: - )
Intel(R) PROSet/Wireless Software (Version: 11.01.0000 - Intel Corporation)
Iomega Product Registration (Version: 7.24.0000 - Iomega Corporation)
Laptop Integrated Webcam Driver (1.04.01.1011) (Version: - )
Live! Cam Avatar Creator (Version: 4.6.0817.1 - Creative Technology Ltd.)
Live! Cam Avatar v1.0 (Version: 1.0 - Creative Technology Ltd.)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
mCore (Version: 9.24.0000 - Intel Corporation) Hidden
MediaDirect (Version: 3.5 - Dell)
mHelp (Version: 9.24.0000 - Intel) Hidden
Microsoft .NET Framework 3.5 SP1 (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Search Enhancement Pack (Version: 3.0.133.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
mMHouse (Version: 9.24.0000 - Intel Corporation) Hidden
Modem Diagnostic Tool (Version: 1.0.20.0 - Dell)
Mozilla Firefox 26.0 (x86 en-GB) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
mPfMgr (Version: 9.24.0000 - Intel Corporation) Hidden
MSVC80_x86 (Version: 1.0.1.0 - Nokia) Hidden
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
mWMI (Version: 9.24.0000 - Intel Corporation) Hidden
My Dell (Version: 3.4.6422.14 - PC-Doctor, Inc.)
NetWaiting (Version: 2.5.44 - BVRP Software, Inc)
Notepad++ (Version: 6.5.2 - Notepad++ Team)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OutlookAddinSetup (Version: 1.0.0 - CyberLink)
Password Safe (Version: - )
PC Connectivity Solution (Version: 10.18.0.0 - Nokia)
QuickSet (Version: 8.2.17 - Dell Inc.)
Roxio Creator Audio (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Copy (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Data (Version: 3.7.0 - Roxio) Hidden
Roxio Creator DE (Version: 10.1 - )
Roxio Creator DE (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Tools (Version: 3.7.0 - Roxio) Hidden
Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden
Roxio Update Manager (Version: 6.0.0 - Roxio) Hidden
Skype Toolbars (Version: 5.0.4137 - Skype Technologies S.A.)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Smart Menus (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (Version: - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version: - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (Version: - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (Version: - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (Version: - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (Version: - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (Version: - Microsoft)
User's Guides (Version: - )
WIDCOMM Bluetooth Software 6.0.1.3100 (Version: 6.0.1.3100 - Dell)
Windows Live Toolbar Extension (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)
==================== Restore Points =========================
05-01-2014 14:54:02 Windows Update
08-01-2014 11:36:51 Scheduled Checkpoint
17-01-2014 12:23:01 Windows Update
17-01-2014 17:54:44 Windows Update
19-01-2014 15:42:00 Removed HP Deskjet 1000 J110 series Basic Device Software
26-01-2014 17:15:22 Windows Update
27-01-2014 19:34:24 Scheduled Checkpoint
31-01-2014 13:01:03 Windows Update
01-02-2014 18:05:14 Scheduled Checkpoint
03-02-2014 17:31:29 Windows Update
05-02-2014 15:28:25 Scheduled Checkpoint
07-02-2014 11:53:32 Windows Update
10-02-2014 13:53:20 Removed Apple Application Support
10-02-2014 13:55:23 Removed Apple Mobile Device Support
10-02-2014 13:56:46 Removed Apple Software Update
10-02-2014 13:58:39 Removed Bonjour
10-02-2014 14:01:19 Windows Update
10-02-2014 14:06:09 Removed Browser Address Error Redirector.
10-02-2014 14:06:24 Removed Bonjour
10-02-2014 14:12:27 Removed Feedback Tool
10-02-2014 14:15:01 Removed Google Talk Plugin
10-02-2014 14:15:49 Removed HP Deskjet 1000 J110 series Basic Device Software
10-02-2014 14:17:13 Removed HP Deskjet 1000 J110 series Help
10-02-2014 14:18:30 Removed iTunes
10-02-2014 14:22:22 Removed Java 7 Update 45
10-02-2014 14:23:47 Removed Java(TM) 6 Update 35
10-02-2014 14:25:04 Removed Java(TM) SE Runtime Environment 6
10-02-2014 14:26:46 Removido Miniaurélio
10-02-2014 14:34:13 Removed QuickTime
10-02-2014 14:38:10 Removed Retrospect 7.5
10-02-2014 14:40:09 Removed Skype Toolbars
10-02-2014 14:47:17 Removed Feedback Tool
10-02-2014 14:48:33 Removed Skype Toolbars
10-02-2014 14:53:22 Removed Spelling Dictionaries Support For Adobe Reader 8
10-02-2014 14:56:51 Windows Live Essentials
10-02-2014 14:58:28 Removed Windows Live Favorites for Windows Live Toolbar
==================== Hosts content: ==========================
2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {06DBA3A5-144B-4A03-9521-7CC720DE6165} - System32\Tasks\{E72283E4-1774-42B8-B8FF-304A4E5DA9B8} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0C003265-4905-48AB-BEDC-510CC00AF517} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {0EE9C2FC-7C71-4D55-8B83-429FBF2A5AE3} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-12-07] (PC-Doctor, Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E80B85F-473D-4157-BDD5-21ED0AD186A7} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {2D63378D-EE90-4DE4-BE6C-52705345E0AC} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {2FF92470-CDA0-4AE6-9506-AA6CE98C6EFD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {44F1C48E-75D3-409A-B6DC-78643828A7C4} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {5FD0005F-67BE-4377-993A-3164E355E880} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Leah => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {62ED58DC-65F8-4EB2-AB4B-8D55875A1A93} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {77F6DEAA-077F-4A8E-A989-710146F9603F} - System32\Tasks\{86F4E43F-1BBB-4F2B-A302-E694F21AC20E} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {B43B4946-2DF2-424B-978F-09723934A10A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C0E06D20-DE13-4D4E-A4C8-B5AE08EA3332} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {D5B7A726-E835-4C53-8922-443BBADAF95B} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {D68D82DB-ED91-44FE-8A48-7B95C5CB7BCA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-06] (PC-Doctor, Inc.)
Task: {DF32DA4A-B92B-4F92-9A9A-FC9D603347B9} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-06-18 16:24 - 2012-06-18 16:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll
2006-11-03 18:46 - 2006-11-03 18:46 - 00126976 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2008-02-24 18:26 - 2007-12-15 04:54 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2006-11-03 18:25 - 2006-11-03 18:25 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2013-12-30 13:46 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2011-07-18 22:07 - 2011-07-18 22:07 - 00014336 _____ () C:\Program Files\Notepad++\plugins\NppExport.dll
2011-09-21 21:46 - 2011-09-21 21:46 - 01673728 _____ () C:\Program Files\Notepad++\plugins\NppFTP.dll
==================== Alternate Data Streams (whitelisted) =========
==================== Safe Mode (whitelisted) ===================
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"
==================== Disabled items from MSCONFIG ==============
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (02/10/2014 04:27:36 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS\FAVORITES> in the hash map cannot be updated.
Context: Application, SystemIndex Catalog
Details:
A device attached to the system is not functioning. (0x8007001f)
Error: (02/10/2014 04:27:36 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS\FAVORITES> in the hash map cannot be updated.
Context: Application, SystemIndex Catalog
Details:
A device attached to the system is not functioning. (0x8007001f)
Error: (02/10/2014 04:27:35 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS> in the hash map cannot be updated.
Context: Application, SystemIndex Catalog
Details:
A device attached to the system is not functioning. (0x8007001f)
Error: (02/10/2014 04:27:35 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS> in the hash map cannot be updated.
Context: Application, SystemIndex Catalog
Details:
A device attached to the system is not functioning. (0x8007001f)
Error: (02/10/2014 03:56:50 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.
Operation:
Gathering Writer Data
Context:
Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
Writer Name: System Writer
Writer Instance ID: {dd9e3a75-a637-4f9d-b74c-502f538b2fed}
Error: (02/10/2014 03:49:29 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Skype Toolbars -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. The arguments are: , ,
Error: (02/10/2014 03:40:22 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Skype Toolbars -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. The arguments are: , ,
Error: (02/10/2014 03:39:40 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Roxio Update Manager -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: DWUS_Unregister.C3A146F5_4B48_11D5_A819_00B0D0428C0C, location: C:\Program Files\Common Files\InstallShield\UpdateService\, command: C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe /u{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Error: (02/10/2014 03:39:23 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Roxio Update Manager -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: DWUS_Unregister.C3A146F5_4B48_11D5_A819_00B0D0428C0C, location: C:\Program Files\Common Files\InstallShield\UpdateService\, command: C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe /u{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Error: (02/10/2014 03:37:58 PM) (Source: Microsoft-Windows-RestartManager) (User: My-Computer)
Description: 0rndlresolversvc.exeRealNetworks Downloader Resolver Service03026217828200
System errors:
=============
Error: (02/11/2014 09:21:49 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2
Error: (02/11/2014 09:21:49 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/11/2014 08:50:33 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2
Error: (02/11/2014 08:50:33 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/10/2014 04:50:10 PM) (Source: Service Control Manager) (User: )
Description: Windows Search%%1053
Error: (02/10/2014 04:50:10 PM) (Source: Service Control Manager) (User: )
Description: 30000Windows Search
Error: (02/10/2014 04:50:10 PM) (Source: DCOM) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Error: (02/10/2014 04:45:35 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2
Error: (02/10/2014 04:45:35 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058
Error: (02/10/2014 03:57:04 PM) (Source: Service Control Manager) (User: )
Description: Windows Search%%1053
Microsoft Office Sessions:
=========================
Error: (12/05/2009 04:42:08 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time. This session ended with a crash.
Error: (08/10/2009 07:20:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7308 seconds with 4920 seconds of active time. This session ended with a crash.
Error: (07/25/2009 05:46:00 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15612 seconds with 7080 seconds of active time. This session ended with a crash.
Error: (07/09/2009 09:45:54 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4397 seconds with 1500 seconds of active time. This session ended with a crash.
Error: (06/22/2009 00:51:51 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31569 seconds with 3540 seconds of active time. This session ended with a crash.
CodeIntegrity Errors:
===================================
Date: 2014-02-10 20:38:33.825
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:38:33.544
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:38:33.248
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:38:32.967
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:38:32.671
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:38:32.374
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:35:32.585
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:35:32.304
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:35:31.992
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.
Date: 2014-02-10 20:35:31.711
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.
==================== Memory info ===========================
Percentage of memory in use: 44%
Total physical RAM: 3061.31 MB
Available physical RAM: 1698.58 MB
Total Pagefile: 6326.89 MB
Available Pagefile: 4830.39 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.41 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:220.29 GB) (Free:110.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.39 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 88000000)
Partition 1: (Not Active) - (Size=94 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=220 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=OF Extended)
==================== End Of Log ============================
GMER
Das Log ist so umfangreich, dass ich es hier nicht gepostet kriege. Soll ich es als File anhaengen? |
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
