Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Keine Internetverbindung- Proxyeinstellung 127.0.0.1.8877 (Windows 7) (https://www.trojaner-board.de/154486-keine-internetverbindung-proxyeinstellung-127-0-0-1-8877-windows-7-a.html)

jackknife 28.05.2014 13:51
Keine Internetverbindung- Proxyeinstellung 127.0.0.1.8877 (Windows 7)
 
Guten Tag!
Bin seit heute neuer User, nachdem ich dieses Forum durch meine Internetrecherche gefunden habe, da offensichtlich ein Kollege hier ein sehr ähnliches Problem hatte wie ich eins zu haben scheine:
ich benütze ein TOSHIBA Portege (ultrabook) mit Windows 7.
seit einiger Zeit kommt die Meldung:
Proxyserver reagiert nicht; Bitte überprüfen Sie Ihre Proxyeinstellung 127.0.0.1.8877
und das im IE und Google Chrome und Firefox.
Wenn unter Einstellungen/Internetoptionen/Verbindungen die Proxy Markierung aufhebe geht alles in Ordnung, jedoch nach dem ich den (egal welchen) Browser schleiße und erneut öffne, kommt dieselbe Meldung wieder.
habe die postings von aneri und marki56 verfolgt, es war wohl sehr kompliziert...
Ich würde mich über Ratschläge und Tipps sehr freuen, da ein "Software Spezialist" nach vier Stunden aufgegeben hatte...

mfg.

schrauber 28.05.2014 18:55
hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


jackknife 29.05.2014 08:22
Guten Morgen!
Vielen Dank für die rasche Antwort!
hier die beiden txt Dateien:
Anhang 67260

Anhang 67261
hoffe, ich habe das richtig gemacht mit dem Anhang? Das habe ich nicht verstanden: " (#-Symbol im Eingabefenster der Webseite anklicken) "

MFG

jackknife 29.05.2014 08:29
FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-05-2014 02
Ran by milie (administrator) on MILIE-ULTRA on 29-05-2014 09:14:41
Running from C:\Users\milie\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
() C:\Windows\System32\DlProtectSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe
() C:\Program Files (x86)\bob internetsoftware\bobInternetsoftware_Service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
() C:\Windows\System32\msimtf64.exe
(Ericsson AB) C:\Program Files (x86)\TOSHIBA\Mobile Broadband Device\WMCore\mini_WMCore.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
() C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TBatmgrTrayicon.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUPWDBank.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Fingerprint Utility\TFPUTaskMonitor.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
() C:\Program Files\TOSHIBA\FlashCards\Hotkey\TCrdKBB.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Dropbox, Inc.) C:\Users\milie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoHook.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
() C:\ProgramData\dlprotect.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPL.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\bob internetsoftware\bobInternetsoftware_Launcher.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Tlapia) C:\Program Files (x86)\sysTPL\sysTPLService.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\widimon\widimon.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_13_0_0_214_ActiveX.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] => [X]
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452968 2012-03-13] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound 3D] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-03-22] (SRS Labs, Inc.)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [595840 2012-03-02] ()
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2012-03-16] (TOSHIBA Corporation)
HKLM\...\Run: [BatteryManager] => C:\Program Files\TOSHIBA\Power Saver\TBatmgrTrayIcon.EXE [286632 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TFPUPWDBankService] => C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUPWDBank.exe [976256 2012-03-16] (TOSHIBA)
HKLM\...\Run: [TFPUService] => C:\Program Files\TOSHIBA\Fingerprint Utility\TFPUTaskMonitor.exe [896384 2012-03-16] (TOSHIBA)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1562032 2012-02-28] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2012-04-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-07-20] (Toshiba Europe GmbH)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-02-28] (Intel Corporation)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-01] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [TOSDCR] => C:\Program Files (x86)\TOSHIBA\PasswordUtility\TOSDCR.exe [169296 2007-08-28] ()
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [253312 2011-11-21] (TOSHIBA)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe [12800 2014-02-05] ()
HKLM-x32\...\Run: [sysTPL] => C:\Program Files (x86)\sysTPL\sysTPL.exe [1244440 2014-01-24] (Tlapia)
HKLM-x32\...\Run: [TAG_bobinternetsoftware_Launcher.exe] => C:\Program Files (x86)\bob internetsoftware\bobinternetsoftware_Launcher.exe [478192 2012-10-23] ()
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2950655177-3534543011-3231271086-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)
HKU\S-1-5-21-2950655177-3534543011-3231271086-1001\...\MountPoints2: {3de2d8d0-bfa6-11e3-afa9-806e6f6e6963} - D:\.\Autorun.exe AUTORUN=1
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => "c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll" File Not Found
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\milie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8877
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WevjMHaeyI2o6mCKulCso0F2iflRmb4lfBK1WtoIQANtnI96dWI8dVuXl2uVCN3Q,&q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WdiIe5t7HJVkTPggB0VpyKeQm75OZ0D2_xQ7Ds0L9KPiFX5155Wsk0s2LhwnLSpY,
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WevjMHaeyI2o6mCKulCso0F2iflRmb4lfBK1WtoIQANtnI96dWI8dVuXl2uVCN3Q,&q={searchTerms}
SearchScopes: HKLM - DefaultScope {A84DB18B-E9A0-4937-8FF9-D2C337AD8F83} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {A84DB18B-E9A0-4937-8FF9-D2C337AD8F83} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WevjMHaeyI2o6mCKulCso0F2iflRmb4lfBK1WtoIQANtnI96dWI8dVuXl2uVCN3M,&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WevjMHaeyI2o6mCKulCso0F2iflRmb4lfBK1WtoIQANtnI96dWI8dVuXl2uVCN3M,&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WevjMHaeyI2o6mCKulCso0F2iflRmb4lfBK1WtoIQANtnI96dWI8dVuXl2uVCN3Q,&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?p=mKO_AwFzXIpYRbQ56KyJJVUG02g_eGRr9RlM9sogXVMrn4AcF0UAE8SyrgMMscLA6pEeeaLKJlF9OTPTxN-PoTE8gkzj0l7kkuDNsbd8iIx8HmkwUDcNPkMftGvSv12Vtrnjs71WevjMHaeyI2o6mCKulCso0F2iflRmb4lfBK1WtoIQANtnI96dWI8dVuXl2uVCN3Q,&q={searchTerms}
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: TOSHIBA Fingerprint Utility Automatic Password Input - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUPWDBankBHO.dll (TOSHIBA)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: ResultsAlpha - {cbab673a-a480-4050-bd2b-5de24a7a0282} - C:\Program Files (x86)\ResultsAlpha\ResultsAlphabho.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - No Name - {05579720-9A2D-40F6-8411-76251A91C484} -  No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 212.186.211.21

FireFox:
========
FF ProfilePath: C:\Users\milie\AppData\Roaming\Mozilla\Firefox\Profiles\ge9q9qw5.default
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF HKLM-x32\...\Firefox\Extensions: [{302BCF7B-E09E-4854-9F2F-8B2DA4EF70F9}] - C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\FirefoxAddin
FF Extension: TOSHIBA Fingerprint Utility Automatic Password Input - C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\FirefoxAddin [2013-12-18]
FF HKLM-x32\...\Firefox\Extensions: [{718043EC-B201-481D-A945-F02FD148E5DD}] - C:\windows\Installer\{1A32DA88-E616-44B7-A0E4-D4244C370BF2}\{718043EC-B201-481D-A945-F02FD148E5DD}.xpi
FF Extension: Download Protect - C:\windows\Installer\{1A32DA88-E616-44B7-A0E4-D4244C370BF2}\{718043EC-B201-481D-A945-F02FD148E5DD}.xpi [2014-05-16]
FF HKLM-x32\...\Firefox\Extensions: [{E84D7C79-D233-40AA-9210-FA6CEEAA4337}] - C:\windows\Installer\{20A864EF-B3AE-477D-A1EA-4A3D30014721}\{E84D7C79-D233-40AA-9210-FA6CEEAA4337}.xpi
FF Extension: Download Protect - C:\windows\Installer\{20A864EF-B3AE-477D-A1EA-4A3D30014721}\{E84D7C79-D233-40AA-9210-FA6CEEAA4337}.xpi [2014-05-29]

==================== Services (Whitelisted) =================

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-16] (Microsoft Corporation)
R2 DlProtectSvc; C:\Windows\System32\DlProtectSvc.exe [125440 2014-02-05] ()
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-28] ()
R2 irstrtsv; C:\windows\SysWOW64\irstrtsv.exe [192856 2012-02-24] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-12-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-01-27] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [185792 2014-01-27] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 sysTPLMonitor.exe; C:\Program Files (x86)\sysTPL\sysTPLMonitor.exe [399640 2014-01-24] (Tlapia)
R2 sysTPLService.exe; C:\Program Files (x86)\sysTPL\sysTPLService.exe [400664 2014-01-24] (Tlapia)
R2 TAG_Service; C:\Program Files (x86)\bob internetsoftware\bobinternetsoftware_Service.exe [497648 2012-10-23] ()
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 unloectr; C:\windows\system32\msimtf64.exe [118784 2014-02-05] ()
R2 WMCoreService; C:\Program Files (x86)\TOSHIBA\Mobile Broadband Device\WMCore\mini_WMCore.exe [655912 2011-11-18] (Ericsson AB)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
S3 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]
S2 Update ResultsAlpha; "C:\Program Files (x86)\ResultsAlpha\updateResultsAlpha.exe" [X]
S2 Util ResultsAlpha; "C:\Program Files (x86)\ResultsAlpha\bin\utilResultsAlpha.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70592 2014-01-27] (McAfee, Inc.)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2011-10-05] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [29736 2011-10-05] (Ericsson AB)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-02-22] (Intel Corporation)
S3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [120832 2011-03-04] (TCT International Mobile Ltd)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-10-05] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-10-05] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-10-05] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-10-05] (MCCI Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [180272 2014-01-27] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311600 2014-01-27] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [520696 2014-01-27] (McAfee, Inc.)
R2 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [783864 2014-01-27] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
R2 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344688 2014-01-27] (McAfee, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 t36wgps; C:\Windows\System32\DRIVERS\t36wgps64.sys [102440 2011-10-05] (Ericsson AB)
S3 Tosrfcom; No ImagePath
R3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [282152 2011-12-07] (Ericsson AB)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-29 09:14 - 2014-05-29 09:14 - 00022727 _____ () C:\Users\milie\Desktop\FRST.txt
2014-05-29 09:14 - 2014-05-29 09:14 - 00000000 ____D () C:\FRST
2014-05-29 09:13 - 2014-05-29 09:13 - 02066944 _____ (Farbar) C:\Users\milie\Desktop\FRST64.exe
2014-05-26 11:05 - 2014-05-29 08:50 - 00000000 ___RD () C:\Users\milie\Google Drive
2014-05-26 11:05 - 2014-05-26 11:05 - 00001732 _____ () C:\Users\milie\Desktop\Google Drive.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002053 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002051 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002041 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-23 16:18 - 2014-05-23 16:18 - 00002111 _____ () C:\Users\Public\Desktop\bob internetsoftware.lnk
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bob internetsoftware
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\Program Files (x86)\bob internetsoftware
2014-05-23 16:18 - 2011-03-04 14:42 - 00120832 _____ (TCT International Mobile Ltd) C:\windows\system32\Drivers\jrdusbser.sys
2014-05-23 16:18 - 2010-12-16 14:18 - 00227328 _____ (QUALCOMM Incorporated) C:\windows\system32\Drivers\tctusbwwan.sys
2014-05-23 16:18 - 2010-06-09 22:45 - 00025088 _____ (Windows (R) Codename Longhorn DDK provider) C:\windows\system32\Drivers\AlcatelUsb.sys
2014-05-23 16:18 - 2009-12-10 17:41 - 00138752 _____ (TCT International Mobile Ltd) C:\windows\system32\Drivers\AlcatelOTUsbnet.sys
2014-05-21 14:28 - 2014-05-21 14:28 - 00049152 _____ () C:\Users\milie\Documents\Endabrechnung Get-Up UBIT-läuft! 2013-2014.xls
2014-05-21 14:13 - 2014-05-21 14:17 - 00000000 ____D () C:\Users\milie\Documents\VITO
2014-05-16 20:21 - 2014-05-16 20:29 - 3316574824 _____ () C:\Users\milie\Documents\Thunderbird 24.5.0 (de) - 2014-05-16.pcv
2014-05-16 20:20 - 2014-05-16 20:20 - 00001042 _____ () C:\Users\Public\Desktop\MozBackup.lnk
2014-05-16 20:20 - 2014-05-16 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2014-05-16 17:14 - 2014-05-16 20:28 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-16 17:14 - 2014-05-16 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-16 17:14 - 2014-05-16 17:15 - 00000000 ____D () C:\Users\milie\AppData\Local\Mozilla
2014-05-15 20:04 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-15 20:04 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-15 20:04 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-15 20:04 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-15 20:04 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-15 20:04 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-15 13:17 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-15 13:17 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-15 13:17 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-05-15 13:17 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2014-05-15 13:17 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-05-15 13:17 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2014-05-15 13:17 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2014-05-15 13:17 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2014-05-15 13:17 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2014-05-15 13:17 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-05-15 13:17 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-05-15 13:17 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-15 13:17 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-15 13:17 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-05-15 13:17 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-05-15 13:17 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-05-15 13:17 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-05-15 13:17 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-05-15 13:17 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\windows\SysWOW64\objsel.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\cngprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\windows\SysWOW64\adprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\capiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpapiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\dimsroam.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wincredprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-05-15 13:17 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2014-05-08 09:46 - 2014-05-28 11:18 - 00068096 _____ () C:\Users\milie\Desktop\Buchhaltung 2014.xls
2014-05-07 09:40 - 2014-05-21 14:17 - 00000000 ____D () C:\Users\milie\Documents\SAM
2014-05-06 11:53 - 2014-05-06 11:53 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Aid4Mail
2014-05-06 11:35 - 2014-05-16 20:49 - 00002307 _____ () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-06 11:30 - 2014-05-06 11:30 - 00003170 _____ () C:\windows\System32\Tasks\{4BDBAE90-4C96-4DDF-B95E-85B1C87163AF}
2014-05-06 11:29 - 2014-05-06 11:37 - 00000000 ____D () C:\ProgramData\374311380
2014-05-06 11:28 - 2014-05-06 11:28 - 00000000 ____D () C:\Users\milie\AppData\Local\TNT2
2014-05-06 11:28 - 2014-05-06 11:28 - 00000000 ____D () C:\Program Files (x86)\TNT2
2014-05-06 11:19 - 2014-05-06 11:20 - 00000000 _____ () C:\temphtml.htm
2014-05-06 10:53 - 2014-05-06 10:53 - 00002113 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-06 10:53 - 2014-05-06 10:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-06 10:29 - 2014-05-06 12:55 - 00000000 ____D () C:\Users\milie\AppData\Roaming\CDTPL
2014-05-06 10:28 - 2014-05-06 10:29 - 00000000 ____D () C:\Program Files (x86)\Systools MBOX Viewer
2014-05-06 10:28 - 2014-05-06 10:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Systools MBOX Viewer
2014-05-06 07:55 - 2014-05-16 09:19 - 00000000 ___SD () C:\windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-05-29 09:14 - 2014-05-29 09:14 - 00022727 _____ () C:\Users\milie\Desktop\FRST.txt
2014-05-29 09:14 - 2014-05-29 09:14 - 00000000 ____D () C:\FRST
2014-05-29 09:13 - 2014-05-29 09:13 - 02066944 _____ (Farbar) C:\Users\milie\Desktop\FRST64.exe
2014-05-29 09:01 - 2014-04-23 10:37 - 00005148 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for milie-ultra-milie milie-ultra
2014-05-29 08:59 - 2013-12-18 15:27 - 02089289 _____ () C:\windows\WindowsUpdate.log
2014-05-29 08:50 - 2014-05-26 11:05 - 00000000 ___RD () C:\Users\milie\Google Drive
2014-05-29 08:50 - 2014-04-18 11:24 - 00000000 ___RD () C:\Users\milie\Dropbox
2014-05-29 08:50 - 2014-04-18 11:23 - 00000000 ____D () C:\Users\milie\AppData\Roaming\DropboxMaster
2014-05-29 08:50 - 2014-04-18 11:21 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Dropbox
2014-05-29 08:50 - 2014-01-28 12:51 - 00001104 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-29 08:50 - 2013-12-18 15:27 - 00000828 _____ () C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2014-05-29 08:18 - 2014-01-28 12:51 - 00001108 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-29 08:18 - 2012-07-20 03:41 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-05-29 07:40 - 2009-07-14 06:45 - 00027568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-29 07:40 - 2009-07-14 06:45 - 00027568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-29 07:37 - 2011-02-11 11:56 - 00717756 _____ () C:\windows\system32\perfh007.dat
2014-05-29 07:37 - 2011-02-11 11:56 - 00155252 _____ () C:\windows\system32\perfc007.dat
2014-05-29 07:37 - 2009-07-14 07:13 - 01656808 _____ () C:\windows\system32\PerfStringBackup.INI
2014-05-29 07:35 - 2014-03-30 13:21 - 00000728 __RSH () C:\ProgramData\ntuser.pol
2014-05-29 07:33 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-05-29 07:33 - 2009-07-14 06:51 - 00043202 _____ () C:\windows\setupact.log
2014-05-28 14:15 - 2010-01-09 21:30 - 00000000 __RSD () C:\Users\milie\Documents\My Stationery
2014-05-28 12:06 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\NDF
2014-05-28 11:18 - 2014-05-08 09:46 - 00068096 _____ () C:\Users\milie\Desktop\Buchhaltung 2014.xls
2014-05-28 10:24 - 2014-02-03 14:37 - 00000000 ____D () C:\Users\milie\Documents\Benutzerdefinierte Office-Vorlagen
2014-05-28 10:20 - 2013-12-18 15:27 - 00000830 _____ () C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2014-05-27 19:49 - 2014-02-06 16:21 - 00000000 ____D () C:\Program Files (x86)\sysTPL
2014-05-26 20:17 - 2014-04-28 10:41 - 00000000 ____D () C:\Users\milie\mozilla sicherung
2014-05-26 11:06 - 2012-07-20 03:41 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-05-26 11:05 - 2014-05-26 11:05 - 00001732 _____ () C:\Users\milie\Desktop\Google Drive.lnk
2014-05-26 11:05 - 2014-01-28 12:17 - 00000000 ____D () C:\Users\milie
2014-05-26 11:05 - 2012-07-20 03:41 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-26 11:05 - 2012-07-20 03:41 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-26 11:04 - 2014-05-26 11:04 - 00002053 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002051 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002041 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-26 11:04 - 2014-01-28 12:51 - 00000000 ____D () C:\Users\milie\AppData\Local\Google
2014-05-26 11:04 - 2014-01-28 12:51 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-26 10:42 - 2014-04-04 18:48 - 00000000 ____D () C:\Users\milie\AppData\Roaming\TAG
2014-05-26 07:09 - 2009-07-14 07:08 - 00032550 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-05-25 09:01 - 2014-01-28 12:17 - 00000000 ___RD () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-25 09:00 - 2014-04-18 11:23 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-25 08:41 - 2010-11-21 05:47 - 00048596 _____ () C:\windows\PFRO.log
2014-05-24 11:01 - 2014-01-28 13:03 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-05-23 16:18 - 2014-05-23 16:18 - 00002111 _____ () C:\Users\Public\Desktop\bob internetsoftware.lnk
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bob internetsoftware
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\Program Files (x86)\bob internetsoftware
2014-05-21 14:28 - 2014-05-21 14:28 - 00049152 _____ () C:\Users\milie\Documents\Endabrechnung Get-Up UBIT-läuft! 2013-2014.xls
2014-05-21 14:20 - 2014-04-06 14:33 - 00000000 ____D () C:\Users\milie\AppData\Local\Microsoft Help
2014-05-21 14:17 - 2014-05-21 14:13 - 00000000 ____D () C:\Users\milie\Documents\VITO
2014-05-21 14:17 - 2014-05-07 09:40 - 00000000 ____D () C:\Users\milie\Documents\SAM
2014-05-19 16:08 - 2012-07-20 03:40 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-19 16:05 - 2013-12-18 15:44 - 00000000 ____D () C:\ProgramData\Toshiba
2014-05-17 10:03 - 2014-02-06 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-17 10:03 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-05-16 20:49 - 2014-05-06 11:35 - 00002307 _____ () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-16 20:29 - 2014-05-16 20:21 - 3316574824 _____ () C:\Users\milie\Documents\Thunderbird 24.5.0 (de) - 2014-05-16.pcv
2014-05-16 20:28 - 2014-05-16 17:14 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-16 20:28 - 2014-05-16 17:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-16 20:20 - 2014-05-16 20:20 - 00001042 _____ () C:\Users\Public\Desktop\MozBackup.lnk
2014-05-16 20:20 - 2014-05-16 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2014-05-16 20:20 - 2014-02-05 20:02 - 00000000 ____D () C:\Program Files (x86)\MozBackup
2014-05-16 17:15 - 2014-05-16 17:14 - 00000000 ____D () C:\Users\milie\AppData\Local\Mozilla
2014-05-16 17:14 - 2014-02-06 16:55 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Mozilla
2014-05-16 14:25 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-05-16 13:55 - 2014-02-01 13:41 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Skype
2014-05-16 09:36 - 2014-01-28 12:20 - 00000000 ___RD () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 09:19 - 2014-05-06 07:55 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-16 09:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-05-15 20:04 - 2014-02-28 10:06 - 00000000 ____D () C:\windows\system32\MRT
2014-05-15 20:03 - 2014-02-28 10:06 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-10 19:13 - 2014-01-28 12:51 - 00004104 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-10 19:13 - 2014-01-28 12:51 - 00003852 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-09 08:14 - 2014-05-15 13:17 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 13:17 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-06 12:55 - 2014-05-06 10:29 - 00000000 ____D () C:\Users\milie\AppData\Roaming\CDTPL
2014-05-06 12:02 - 2014-04-17 09:13 - 00000000 ____D () C:\WorkArea
2014-05-06 11:53 - 2014-05-06 11:53 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Aid4Mail
2014-05-06 11:37 - 2014-05-06 11:29 - 00000000 ____D () C:\ProgramData\374311380
2014-05-06 11:30 - 2014-05-06 11:30 - 00003170 _____ () C:\windows\System32\Tasks\{4BDBAE90-4C96-4DDF-B95E-85B1C87163AF}
2014-05-06 11:28 - 2014-05-06 11:28 - 00000000 ____D () C:\Users\milie\AppData\Local\TNT2
2014-05-06 11:28 - 2014-05-06 11:28 - 00000000 ____D () C:\Program Files (x86)\TNT2
2014-05-06 11:28 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\Resources
2014-05-06 11:20 - 2014-05-06 11:19 - 00000000 _____ () C:\temphtml.htm
2014-05-06 11:20 - 2014-02-28 10:04 - 01648226 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2014-05-06 10:53 - 2014-05-06 10:53 - 00002113 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-06 10:53 - 2014-05-06 10:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-06 10:53 - 2014-02-03 13:31 - 00000000 ____D () C:\Users\milie\AppData\Local\Thunderbird
2014-05-06 10:29 - 2014-05-06 10:28 - 00000000 ____D () C:\Program Files (x86)\Systools MBOX Viewer
2014-05-06 10:28 - 2014-05-06 10:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Systools MBOX Viewer
2014-05-06 06:40 - 2014-05-15 20:04 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 20:04 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 20:04 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 20:04 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 20:04 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 20:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\milie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpstsn9s.dll


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 07:51

==================== End Of Log ============================
--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-05-2014 02
Ran by milie at 2014-05-29 09:15:04
Running from C:\Users\milie\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Microsoft Security Essentials (Enabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AV: McAfee  Anti-Virus und Anti-Spyware (Disabled - Up to date) {86355677-4064-3EA7-ABB3-1B136EB04637}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: McAfee  Anti-Virus und Anti-Spyware (Disabled - Up to date) {3D54B793-665E-3129-9103-206115370C8A}
AS: Microsoft Security Essentials (Enabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
FW: McAfee  Firewall (Disabled) {BE0ED752-0A0B-3FFF-80EC-B2269063014C}

==================== Installed Programs ======================

Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
AuthenTec WinBio FingerPrint Software (HKLM\...\{3CEE4431-D0DA-49AA-A78D-5D3B559446DF}) (Version: 3.2.3.1157 - AuthenTec, Inc.)
Bluetooth Stack for Windows by Toshiba (HKLM\...\{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}) (Version: v9.00.03(T) - TOSHIBA CORPORATION)
bob internetsoftware (HKLM-x32\...\TAG) (Version: 2.0 - A1 Telekom Austria AG)
Download Protect (HKCU\...\{132401a7-2006-4342-b43c-ccf5f02c2b01}) (Version:  - Download Protect)
Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.)
Google Drive (HKLM-x32\...\{418BAAD1-754D-48B4-B078-46EF4F25AF42}) (Version: 1.15.6556.8063 - Google, Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
High-Definition Video Playback (x32 Version: 11.1.10500.2.65 - Nero AG) Hidden
Intel PROSet Wireless (Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Manageability Engine Firmware Recovery Agent (HKLM-x32\...\{A6C48A9F-694A-4234-B3AA-62590B668927}) (Version: 1.0.0.35342 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.3.1427 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 16.8 - Intel)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2712 - Intel Corporation)
Intel(R) Rapid Start Technology (HKLM-x32\...\3D073343-CEEB-4ce7-85AC-A69A7631B5D6) (Version: 1.0.0.1022 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.220 - Intel Corporation)
Intel(R) WiDi (HKLM-x32\...\{7FCB8D5D-9396-4D17-8CFA-349D6D49CD32}) (Version: 3.0.13.0 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Intel® PROSet/Wireless WiFi-Software (HKLM\...\{E2D0B67F-8032-4E11-87C6-C8C721D331B3}) (Version: 15.01.0500.0875 - Intel Corporation)
Intel® Trusted Connect Service Client (HKLM\...\{09536BA1-E498-4CC3-B834-D884A67D7E34}) (Version: 1.23.605.1 - Intel Corporation)
Java Auto Updater (x32 Version: 2.0.6.1 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 30 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216030FF}) (Version: 6.0.300 - Oracle)
MBOX Viewer v1.0 (HKLM-x32\...\{cb088543-4ede-4351-a680-2b43fc3cb80e}_is1) (Version:  - Core Data Tree)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4615.1002 - Microsoft Corporation)
Microsoft Office Home and Student 2013 - de-de (HKLM\...\HomeStudentRetail - de-de) (Version: 15.0.4615.1002 - Microsoft Corporation)
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4023.1211 - Microsoft Corporation)
Microsoft Security Client (Version: 4.5.0216.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.5.216.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MozBackup 1.5.1 (HKLM-x32\...\MozBackup) (Version:  - Pavel Cvrcek)
Mozilla Firefox 29.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 de)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mozilla Thunderbird 24.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.5.0 (x86 de)) (Version: 24.5.0 - Mozilla)
Nero 11 Essentials (HKLM-x32\...\{F8635CF8-B797-4EFD-80BC-DE2D26C65D4F}) (Version: 11.0.00300 - Nero AG)
Nero 11 Kwik Themes Basic (x32 Version: 11.0.11200.12.0 - Nero AG) Hidden
Nero BackItUp 11 (x32 Version: 6.0.18000.19.100 - Nero AG) Hidden
Nero BackItUp 11 Help (CHM) (x32 Version: 11.0.10200 - Nero AG) Hidden
Nero Backup Drivers (HKLM\...\{D600D357-5CB9-4DE9-8FD4-14E208BD1970}) (Version: 1.0.11100.8.0 - Nero AG)
Nero BurnRights 11 (x32 Version: 5.0.10300.4.100 - Nero AG) Hidden
Nero BurnRights 11 Help (CHM) (x32 Version: 11.0.10100 - Nero AG) Hidden
Nero ControlCenter 11 (x32 Version: 11.0.12700.0.27 - Nero AG) Hidden
Nero ControlCenter 11 Help (CHM) (x32 Version: 11.0.10300 - Nero AG) Hidden
Nero Core Components 11 (x32 Version: 11.0.15500.1.16 - Nero AG) Hidden
Nero Express 11 (x32 Version: 11.0.11900.24.100 - Nero AG) Hidden
Nero Express 11 Help (CHM) (x32 Version: 11.0.10300 - Nero AG) Hidden
Nero Kwik Media (x32 Version: 1.10.24800.146.100 - Nero AG) Hidden
Nero Kwik Media Help (CHM) (x32 Version: 11.0.10200 - Nero AG) Hidden
Nero RescueAgent 11 (x32 Version: 4.0.10600.10.100 - Nero AG) Hidden
Nero RescueAgent 11 Help (CHM) (x32 Version: 11.0.10400 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11400.27.0 - Nero AG) Hidden
nero.prerequisites.msi (x32 Version: 11.0.20008 - Nero AG) Hidden
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4615.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4615.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4615.1002 - Microsoft Corporation) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6591 - Realtek Semiconductor Corp.)
ResultsAlpha (HKLM\...\ResultsAlpha) (Version: 2014.02.04.044224 - ResultsAlpha)
RICOH Media Driver v2.15.17.02 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.15.17.02 - RICOH)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
SRS Premium Sound Control Panel (HKLM\...\{3007FF9F-5B2C-41FF-8BFC-08BF25DB2681}) (Version: 1.12.1800 - SRS Labs, Inc.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.27.1 - Synaptics Incorporated)
sysTPL (HKLM-x32\...\{4B74BC31-B353-4B8F-8CBE-DAB4FF326FF1}) (Version: 1.4.1.2 - Tlapia)
TOSHIBA Assist (HKLM-x32\...\{C2A276E3-154E-44DC-AAF1-FFDD7FD30E35}) (Version: 4.2.3.1 - TOSHIBA CORPORATION)
TOSHIBA eco Utility (HKLM\...\{F5AFF327-9B52-4E96-B5A0-BD2488A8EEC9}) (Version: 1.3.21.64 - TOSHIBA Corporation)
TOSHIBA Fingerprint Utility (HKLM\...\{62BBF381-D208-4EF0-B502-6CB6E5B9A161}) (Version: 2.0.0.6409 - TOSHIBA Corporation)
TOSHIBA HDD/SSD Alert (HKLM\...\{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.64.14 - TOSHIBA Corporation)
TOSHIBA Manuals (HKLM-x32\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.05 - TOSHIBA)
TOSHIBA Media Controller (HKLM-x32\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.87.5 - TOSHIBA CORPORATION)
TOSHIBA Media Controller Plug-in (HKLM-x32\...\{F26FDF57-483E-42C8-A9C9-EEE1EDB256E0}) (Version: 1.0.7.7 - TOSHIBA CORPORATION)
TOSHIBA Mobile Broadband Device (HKLM-x32\...\{B7191DD7-E7B4-4658-9025-487916EC21C8}) (Version: 7.1.0.3 - TOSHIBA Corporation)
TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.7.17.64 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator (HKLM-x32\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.7.52020010 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator Reminder (HKLM-x32\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.1.0.0 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (x32 Version: 1.1.0.0 - TOSHIBA) Hidden
TOSHIBA Resolution+ Plug-in for Windows Media Player (HKLM-x32\...\{6CB76C9D-80C2-4CB3-A4CD-D96B239E3F94}) (Version: 1.1.4.01 - TOSHIBA Corporation)
TOSHIBA Security Assist (HKLM-x32\...\{1E63ACB5-D45E-4856-8FC9-78F4B0D7BB80}) (Version: 2.0.9 - TOSHIBA)
TOSHIBA Service Station (HKLM-x32\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.13 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM-x32\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.0024.000101 - TOSHIBA Corporation)
TOSHIBA TEMPRO (HKLM-x32\...\{F082CB11-4794-4259-99A1-D91BA762AD15}) (Version: 3.35 - Toshiba Europe GmbH)
TOSHIBA Value Added Package (HKLM-x32\...\InstallShield_{066CFFF8-12BF-4390-A673-75F95EFF188E}) (Version: 1.6.0027.640202 - TOSHIBA Corporation)
TOSHIBA Value Added Package (Version: 1.6.0027.640202 - TOSHIBA Corporation) Hidden
TOSHIBA Value Added Package (x32 Version: 1.6.0027.640202 - TOSHIBA Corporation) Hidden
TOSHIBA Web Camera Application (HKLM-x32\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 2.0.3.33 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (x32 Version: 2.0.3.33 - TOSHIBA Corporation) Hidden
TOSHIBA Wireless Display Monitor (HKLM-x32\...\{617773AE-ADBA-4479-BB04-65FE7758B35C}) (Version: 1.0.1 - TOSHIBA CORPORATION)
TOSHIBA Wireless Manager (HKLM-x32\...\{6A631D31-1FD6-46B5-9337-3485C3CBB002}) (Version: 7.1.0.2 - TOSHIBA Corporation)
welcome (x32 Version: 11.0.22500.0.0 - Nero AG) Hidden

==================== Restore Points  =========================

27-05-2014 05:29:18 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0AA7E0CB-69EE-4F0B-B18F-4E0C4C267478} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {4CC4E8F2-6ABA-41FB-8740-7C4B76476585} - System32\Tasks\TOSHIBA Wireless Display Monitor => C:\Program Files (x86)\TOSHIBA\widimon\widimon.exe [2010-12-25] (TOSHIBA CORPORATION)
Task: {4EF8A26C-28CB-48A9-B213-5D6177D79C99} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-05-24] (Microsoft Corporation)
Task: {54E441E0-C820-4495-AEB8-FF67023B462A} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {A75C756F-2760-4DD6-B58F-619863323072} - System32\Tasks\Microsoft Office 15 Sync Maintenance for milie-ultra-milie milie-ultra => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-05-24] (Microsoft Corporation)
Task: {B0349184-A091-4393-B4DB-68B9A4CC737E} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-28] (Google Inc.)
Task: {B1CFFDCF-D511-462A-B80B-7667E84BAF14} - System32\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25] (Intel Corporation)
Task: {B40C4F76-CBDD-4B4D-9758-584AD36486B8} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-04-15] (Microsoft Corporation)
Task: {EB3F6DCA-49B1-4E22-B8DE-BFD5FBBB94EB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-01-28] (Google Inc.)
Task: {FE175109-B71E-42BB-B64B-1427B4C13C69} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-26] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe
Task: C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job => C:\Program Files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe

==================== Loaded Modules (whitelisted) =============

2014-03-31 14:35 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-01-28 13:03 - 2014-04-15 03:39 - 00630952 _____ () C:\Program Files\Microsoft Office 15\ClientX64\StreamServer.dll
2014-02-05 20:01 - 2014-02-05 20:01 - 00125440 _____ () C:\Windows\System32\DlProtectSvc.exe
2013-12-18 15:27 - 2012-02-28 18:20 - 00128280 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
2014-05-23 16:18 - 2012-10-23 13:27 - 00497648 _____ () C:\Program Files (x86)\bob internetsoftware\bobinternetsoftware_Service.exe
2014-02-05 20:01 - 2014-02-05 20:01 - 00118784 _____ () C:\windows\system32\msimtf64.exe
2012-02-28 20:00 - 2012-02-28 20:00 - 00594368 _____ () C:\Program Files\TOSHIBA\TECO\TecoPower.dll
2012-03-26 18:33 - 2012-03-26 18:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-03-02 17:08 - 2012-03-02 17:08 - 00595840 _____ () C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
2011-08-22 16:19 - 2011-08-22 16:19 - 11204992 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll
2010-11-30 11:37 - 2010-11-30 11:37 - 00048504 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll
2010-03-03 15:15 - 2010-03-03 15:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF10.dll
2010-03-03 15:15 - 2010-03-03 15:15 - 00019256 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnF11.dll
2012-03-16 11:25 - 2012-03-16 11:25 - 00476544 _____ () C:\Program Files\TOSHIBA\Fingerprint Utility\TFPUCommon.dll
2010-12-15 16:19 - 2010-12-15 16:19 - 00124320 _____ () C:\Program Files\TOSHIBA\TECO\MUIHelp.dll
2011-08-12 15:57 - 2011-08-12 15:57 - 00437632 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe
2014-02-05 20:01 - 2014-02-05 20:01 - 00012800 _____ () C:\ProgramData\dlprotect.exe
2014-05-23 16:18 - 2012-10-23 13:27 - 00478192 _____ () C:\Program Files (x86)\bob internetsoftware\bobInternetsoftware_Launcher.exe
2012-04-11 18:05 - 2012-04-11 18:05 - 00079784 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll
2013-12-18 15:39 - 2011-07-13 11:10 - 00065576 ____R () C:\Program Files (x86)\TOSHIBA\Mobile Broadband Device\WMCore\MBMDebug.dll
2013-12-18 15:26 - 2012-02-21 13:09 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-03-16 11:28 - 2012-03-16 11:28 - 00372608 _____ () C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUCommon.dll
2012-03-16 11:28 - 2012-03-16 11:28 - 00415104 _____ () C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUBrowserAddinRc.dll
2014-05-29 08:50 - 2014-05-29 08:50 - 00043008 _____ () c:\users\milie\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpstsn9s.dll
2013-08-23 21:01 - 2013-08-23 21:01 - 25100288 _____ () C:\Users\milie\AppData\Roaming\Dropbox\bin\libcef.dll
2014-05-23 16:18 - 2012-10-23 13:26 - 00256512 _____ () C:\Program Files (x86)\bob internetsoftware\WtgMobileBroadband7.dll
2014-05-29 08:50 - 2014-05-29 08:50 - 00098816 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32api.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00110080 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\pywintypes27.dll
2014-05-29 08:50 - 2014-05-29 08:50 - 00364544 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\pythoncom27.dll
2014-05-29 08:50 - 2014-05-29 08:50 - 00045568 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\_socket.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 01159680 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\_ssl.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00320512 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32com.shell.shell.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00713216 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\_hashlib.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 01175040 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._core_.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00805888 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._gdi_.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00811008 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._windows_.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 01062400 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._controls_.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00735232 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._misc_.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00128512 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\_elementtree.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00127488 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\pyexpat.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00557056 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\pysqlite2._sqlite.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00087552 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\_ctypes.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00119808 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32file.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00108544 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32security.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00018432 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32event.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00038912 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32inet.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00070656 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._html2.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00167936 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32gui.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00011264 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32crypt.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00027136 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\_multiprocessing.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00122368 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._wizard.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00010240 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\select.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00024064 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32pipe.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00686080 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\unicodedata.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00025600 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32pdh.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00525640 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\windows._lib_cacheinvalidation.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00035840 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32process.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00017408 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32profile.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00022528 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\win32ts.pyd
2014-05-29 08:50 - 2014-05-29 08:50 - 00078336 _____ () C:\Users\milie\AppData\Local\Temp\_MEI54162\wx._animate.pyd

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\Users\milie\Desktop\sig neu.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefire => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfefirek.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfehidk.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mfevtp => ""="Driver"

==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (05/29/2014 07:35:46 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 1

Error: (05/29/2014 07:33:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 07:50:05 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 1

Error: (05/28/2014 07:48:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 08:31:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 07:20:58 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 1

Error: (05/27/2014 07:18:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2014 07:19:17 AM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: Die Sicherung wurde aufgrund eines Fehlers beim Schreiben am Sicherungsspeicherort "D:\" nicht abgeschlossen. Fehler: "Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)"

Error: (05/26/2014 07:11:17 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 1

Error: (05/26/2014 07:09:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (05/29/2014 07:33:45 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (05/29/2014 07:33:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/29/2014 07:33:42 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/28/2014 09:39:48 AM) (Source: Schannel) (EventID: 4120) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 40. Der interne Fehlerstatus lautet: 252.

Error: (05/28/2014 07:48:05 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (05/28/2014 07:48:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/28/2014 07:48:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/27/2014 08:31:31 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom

Error: (05/27/2014 08:31:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Util ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (05/27/2014 08:31:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Update ResultsAlpha" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2


Microsoft Office Sessions:
=========================
Error: (05/29/2014 07:35:46 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1

Error: (05/29/2014 07:33:42 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 07:50:05 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1

Error: (05/28/2014 07:48:01 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 08:31:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 07:20:58 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1

Error: (05/27/2014 07:18:53 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2014 07:19:17 AM) (Source: Windows Backup) (EventID: 4103) (User: )
Description: D:\Der Sicherungsort wurde nicht gefunden oder ist ungültig. Überprüfen Sie die Sicherungseinstellungen und den Sicherungsort. (0x81000006)

Error: (05/26/2014 07:11:17 AM) (Source: McLogEvent) (EventID: 5022) (User: NT-AUTORITÄT)
Description: 1

Error: (05/26/2014 07:09:12 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 50%
Total physical RAM: 3974.17 MB
Available physical RAM: 1973.16 MB
Total Pagefile: 7946.52 MB
Available Pagefile: 5520.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (TI30946900B) (Fixed) (Total:102.99 GB) (Free:4.21 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 119 GB) (Disk ID: CE263B03)
Partition 1: (Active) - (Size=1 GB) - (Type=27)
Partition 2: (Not Active) - (Size=103 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=4 GB) - (Type=84)
Partition 4: (Not Active) - (Size=11 GB) - (Type=17)

==================== End Of Log ============================
Hi!
Ist das so besser? Statt dem Attachment meine ich.
Mfg.

schrauber 30.05.2014 09:36
PRogramm sysTPL deinstallieren.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8877

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

jackknife 30.05.2014 14:07
Hallo!

hier die fixlog:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-05-2014 02
Ran by milie at 2014-05-30 14:58:51 Run:1
Running from C:\Users\milie\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8877
*****************

C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable => Value deleted successfully.
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer => Value not found.


The system needed a reboot.

==== End of Fixlog ====
Den Rest mache ich gleich.
Schöne Grüße aus Wien!

schrauber 31.05.2014 10:41
ok :)

jackknife 01.06.2014 12:29
Guten Tag!
hier die Datei von AdwCleaner:
Code:
# AdwCleaner v3.211 - Bericht erstellt am 01/06/2014 um 12:37:22
# Aktualisiert 26/05/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : milie - MILIE-ULTRA
# Gestartet von : C:\Users\milie\Desktop\adwcleaner_3.211.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : Util ResultsAlpha

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\milie\AppData\Local\DownloadGuide
Datei Gelöscht : C:\END

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software
Schlüssel Gelöscht : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gelöscht : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Schlüssel Gelöscht : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Schlüssel Gelöscht : HKLM\Software\SearchProtect
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ResultsAlpha
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v29.0.1 (de)

[ Datei : C:\Users\milie\AppData\Roaming\Mozilla\Firefox\Profiles\ge9q9qw5.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [3051 octets] - [01/06/2014 12:36:33]
AdwCleaner[S0].txt - [2731 octets] - [01/06/2014 12:37:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2791 octets] ##########
Ich habe noch etwas bemerkt: wenn ich am Wochenende am Land bin und dort mit einem externen Internetmodem surfe, passiert das nicht, dass der Proxyserver sich meldet...

Und jetzt mache ich den dritten Schritt laut Deiner Anweisung.
LG und danke für die bisherige Unterstützung!

Hallo Schrauber!
Hier die JRT file:
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Professional x64
Ran by milie on 01.06.2014 at 12:49:04,50
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\windows\syswow64\ai_recyclebin"



~~~ FireFox

Successfully deleted: [File] C:\Users\milie\AppData\Roaming\mozilla\firefox\profiles\ge9q9qw5.default\user.js



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.06.2014 at 12:55:59,63
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Und hier die Aktuelle Fixlog:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-06-2014
Ran by milie (administrator) on MILIE-ULTRA on 01-06-2014 13:26:58
Running from C:\Users\milie\Desktop
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Windows\System32\mfevtps.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\bob internetsoftware\bobInternetsoftware_Service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
() C:\Windows\System32\msimtf64.exe
(Ericsson AB) C:\Program Files (x86)\TOSHIBA\Mobile Broadband Device\WMCore\mini_WMCore.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mfefire.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
() C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TBatmgrTrayicon.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUPWDBank.exe
(TOSHIBA) C:\Program Files\TOSHIBA\Fingerprint Utility\TFPUTaskMonitor.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Dropbox, Inc.) C:\Users\milie\AppData\Roaming\Dropbox\bin\Dropbox.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoHook.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
() C:\ProgramData\dlprotect.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
() C:\Program Files (x86)\bob internetsoftware\bobInternetsoftware_Launcher.exe
() C:\Program Files\TOSHIBA\FlashCards\Hotkey\TCrdKBB.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\widimon\widimon.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(WebToGo Gmbh) C:\Program Files (x86)\bob internetsoftware\bobInternetsoftware.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(McAfee, Inc.) C:\Program Files\Common Files\mcafee\systemcore\mcshield.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] => [X]
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12452968 2012-03-13] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound 3D] => C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2165120 2012-03-22] (SRS Labs, Inc.)
HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [595840 2012-03-02] ()
HKLM\...\Run: [TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [989056 2012-03-16] (TOSHIBA Corporation)
HKLM\...\Run: [BatteryManager] => C:\Program Files\TOSHIBA\Power Saver\TBatmgrTrayIcon.EXE [286632 2011-11-24] (TOSHIBA Corporation)
HKLM\...\Run: [TFPUPWDBankService] => C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUPWDBank.exe [976256 2012-03-16] (TOSHIBA)
HKLM\...\Run: [TFPUService] => C:\Program Files\TOSHIBA\Fingerprint Utility\TFPUTaskMonitor.exe [896384 2012-03-16] (TOSHIBA)
HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1562032 2012-02-28] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [712096 2011-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2012-04-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] => C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [Toshiba Registration] => C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe [150992 2012-07-20] (Toshiba Europe GmbH)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NBAgent] => C:\Program Files (x86)\Nero\Nero 11\Nero BackItUp\NBAgent.exe [1492264 2011-11-18] (Nero AG)
HKLM-x32\...\Run: [mcui_exe] => "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-02-28] (Intel Corporation)
HKLM-x32\...\Run: [ITSecMng] => C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [80840 2011-04-01] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [TOSDCR] => C:\Program Files (x86)\TOSHIBA\PasswordUtility\TOSDCR.exe [169296 2007-08-28] ()
HKLM-x32\...\Run: [ToshibaServiceStation] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1298816 2011-07-11] (TOSHIBA Corporation)
HKLM-x32\...\Run: [TSleepSrv] => C:\Program Files (x86)\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe [253312 2011-11-21] (TOSHIBA)
HKLM-x32\...\Run: [Download Protect] => C:\ProgramData\dlprotect.exe [12800 2014-02-05] ()
HKLM-x32\...\Run: [TAG_bobinternetsoftware_Launcher.exe] => C:\Program Files (x86)\bob internetsoftware\bobinternetsoftware_Launcher.exe [478192 2012-10-23] ()
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-2950655177-3534543011-3231271086-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [22415552 2014-04-25] (Google)
HKU\S-1-5-21-2950655177-3534543011-3231271086-1001\...\MountPoints2: {3de2d8d0-bfa6-11e3-afa9-806e6f6e6963} - D:\.\Autorun.exe AUTORUN=1
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\milie\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
SearchScopes: HKLM - DefaultScope {A84DB18B-E9A0-4937-8FF9-D2C337AD8F83} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {A84DB18B-E9A0-4937-8FF9-D2C337AD8F83} URL = hxxp://www.google.de/search?q={searchTerms}&hl=de&gl=de&rls=com.microsoft:{language}:{referrer:source}&ie={inputEncoding?}&oe={outputEncoding?}
SearchScopes: HKCU - DefaultScope {A84DB18B-E9A0-4937-8FF9-D2C337AD8F83} URL =
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
BHO-x32: TOSHIBA Fingerprint Utility Automatic Password Input - {030AC7B6-E7EC-40F1-8FB2-C0FD344DE0B9} - C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\TFPUPWDBankBHO.dll (TOSHIBA)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>)
Toolbar: HKCU - No Name - {05579720-9A2D-40F6-8411-76251A91C484} -  No File
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\..\Interfaces\{E858BA9C-64AF-41FB-B484-60A4CE85B6C7}: [NameServer]194.48.139.254 194.48.128.199

FireFox:
========
FF ProfilePath: C:\Users\milie\AppData\Roaming\Mozilla\Firefox\Profiles\ge9q9qw5.default
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\windows\Installer\{06B8630D-1C2D-4A44-8971-6EC112BD25B6}\{A9EE4847-4113-4DB3-8EAB-9F2F91CC65C6}.xpi []
FF HKLM-x32\...\Firefox\Extensions: [{302BCF7B-E09E-4854-9F2F-8B2DA4EF70F9}] - C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\FirefoxAddin
FF Extension: TOSHIBA Fingerprint Utility Automatic Password Input - C:\Program Files\TOSHIBA\Fingerprint Utility\BrowserAddin\FirefoxAddin [2013-12-18]
FF HKLM-x32\...\Firefox\Extensions: [{718043EC-B201-481D-A945-F02FD148E5DD}] - C:\windows\Installer\{1A32DA88-E616-44B7-A0E4-D4244C370BF2}\{718043EC-B201-481D-A945-F02FD148E5DD}.xpi
FF Extension: Download Protect - C:\windows\Installer\{1A32DA88-E616-44B7-A0E4-D4244C370BF2}\{718043EC-B201-481D-A945-F02FD148E5DD}.xpi [2014-05-16]
FF HKLM-x32\...\Firefox\Extensions: [{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}] - C:\windows\Installer\{5B7155C7-E2E4-4ADE-B556-4609F9ED2D07}\{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}.xpi
FF Extension: Download Protect - C:\windows\Installer\{5B7155C7-E2E4-4ADE-B556-4609F9ED2D07}\{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}.xpi [2014-05-30]

==================== Services (Whitelisted) =================

R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2266296 2014-05-16] (Microsoft Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [128280 2012-02-28] ()
R2 irstrtsv; C:\windows\SysWOW64\irstrtsv.exe [192856 2012-02-24] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-12-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [219752 2014-01-27] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [185792 2014-01-27] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)
R2 TAG_Service; C:\Program Files (x86)\bob internetsoftware\bobinternetsoftware_Service.exe [497648 2012-10-23] ()
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 unloectr; C:\windows\system32\msimtf64.exe [118784 2014-02-05] ()
R2 WMCoreService; C:\Program Files (x86)\TOSHIBA\Mobile Broadband Device\WMCore\mini_WMCore.exe [655912 2011-11-18] (Ericsson AB)
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)
S3 MozillaMaintenance; "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe" [X]

==================== Drivers (Whitelisted) ====================

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70592 2014-01-27] (McAfee, Inc.)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2011-10-05] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [29736 2011-10-05] (Ericsson AB)
R3 irstrtdv; C:\Windows\System32\DRIVERS\irstrtdv.sys [26504 2012-02-22] (Intel Corporation)
R3 jrdusbser; C:\Windows\System32\DRIVERS\jrdusbser.sys [120832 2011-03-04] (TCT International Mobile Ltd)
R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-01] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-10-05] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-10-05] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-10-05] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-10-05] (MCCI Corporation)
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [180272 2014-01-27] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [311600 2014-01-27] (McAfee, Inc.)
U3 mfeavfk01; No ImagePath
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [520696 2014-01-27] (McAfee, Inc.)
R2 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [783864 2014-01-27] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
R2 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [344688 2014-01-27] (McAfee, Inc.)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)
R3 t36wgps; C:\Windows\System32\DRIVERS\t36wgps64.sys [102440 2011-10-05] (Ericsson AB)
S3 Tosrfcom; No ImagePath
R3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [282152 2011-12-07] (Ericsson AB)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-01 13:25 - 2014-06-01 13:25 - 00000000 ____D () C:\Users\milie\Desktop\FRST-OlderVersion
2014-06-01 12:55 - 2014-06-01 12:55 - 00000827 _____ () C:\Users\milie\Desktop\JRT.txt
2014-06-01 12:49 - 2014-06-01 12:49 - 00000000 ____D () C:\windows\ERUNT
2014-06-01 12:48 - 2014-06-01 12:48 - 01016261 _____ (Thisisu) C:\Users\milie\Desktop\JRT.exe
2014-06-01 12:35 - 2014-06-01 12:37 - 00000000 ____D () C:\AdwCleaner
2014-06-01 12:34 - 2014-06-01 12:34 - 01327971 _____ () C:\Users\milie\Desktop\adwcleaner_3.211.exe
2014-06-01 12:33 - 2014-06-01 12:33 - 00019759 _____ () C:\Users\milie\Desktop\mbam.txt
2014-05-30 18:43 - 2014-06-01 12:38 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-30 18:42 - 2014-05-30 18:42 - 00001117 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-30 18:42 - 2014-05-30 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-30 18:42 - 2014-05-30 18:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-30 18:42 - 2014-05-30 18:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-30 18:42 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-05-30 18:42 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-05-30 18:42 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-05-30 15:08 - 2014-05-30 15:09 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\milie\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-29 09:15 - 2014-05-29 09:15 - 00030280 _____ () C:\Users\milie\Desktop\Addition.txt
2014-05-29 09:14 - 2014-06-01 13:27 - 00000000 ____D () C:\FRST
2014-05-29 09:14 - 2014-06-01 13:26 - 00020123 _____ () C:\Users\milie\Desktop\FRST.txt
2014-05-29 09:13 - 2014-06-01 13:25 - 02067456 _____ (Farbar) C:\Users\milie\Desktop\FRST64.exe
2014-05-26 11:05 - 2014-06-01 12:42 - 00000000 ___RD () C:\Users\milie\Google Drive
2014-05-26 11:05 - 2014-05-26 11:05 - 00001732 _____ () C:\Users\milie\Desktop\Google Drive.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002053 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002051 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002041 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-23 16:18 - 2014-05-23 16:18 - 00002111 _____ () C:\Users\Public\Desktop\bob internetsoftware.lnk
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bob internetsoftware
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\Program Files (x86)\bob internetsoftware
2014-05-23 16:18 - 2011-03-04 14:42 - 00120832 _____ (TCT International Mobile Ltd) C:\windows\system32\Drivers\jrdusbser.sys
2014-05-23 16:18 - 2010-12-16 14:18 - 00227328 _____ (QUALCOMM Incorporated) C:\windows\system32\Drivers\tctusbwwan.sys
2014-05-23 16:18 - 2010-06-09 22:45 - 00025088 _____ (Windows (R) Codename Longhorn DDK provider) C:\windows\system32\Drivers\AlcatelUsb.sys
2014-05-23 16:18 - 2009-12-10 17:41 - 00138752 _____ (TCT International Mobile Ltd) C:\windows\system32\Drivers\AlcatelOTUsbnet.sys
2014-05-21 14:28 - 2014-05-21 14:28 - 00049152 _____ () C:\Users\milie\Documents\Endabrechnung Get-Up UBIT-läuft! 2013-2014.xls
2014-05-21 14:13 - 2014-05-31 11:01 - 00000000 ____D () C:\Users\milie\Documents\VITO
2014-05-16 20:21 - 2014-05-16 20:29 - 3316574824 _____ () C:\Users\milie\Documents\Thunderbird 24.5.0 (de) - 2014-05-16.pcv
2014-05-16 20:20 - 2014-05-16 20:20 - 00001042 _____ () C:\Users\Public\Desktop\MozBackup.lnk
2014-05-16 20:20 - 2014-05-16 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2014-05-16 17:14 - 2014-05-16 20:28 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-16 17:14 - 2014-05-16 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-16 17:14 - 2014-05-16 17:15 - 00000000 ____D () C:\Users\milie\AppData\Local\Mozilla
2014-05-15 20:04 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-15 20:04 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-15 20:04 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-15 20:04 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-15 20:04 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-15 20:04 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-05-15 13:17 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-15 13:17 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-15 13:17 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-05-15 13:17 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2014-05-15 13:17 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-05-15 13:17 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2014-05-15 13:17 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2014-05-15 13:17 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2014-05-15 13:17 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2014-05-15 13:17 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-05-15 13:17 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-05-15 13:17 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2014-05-15 13:17 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2014-05-15 13:17 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2014-05-15 13:17 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\windows\system32\objsel.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-05-15 13:17 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\wincredprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\winlogon.exe
2014-05-15 13:17 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\windows\system32\cngprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\windows\system32\adprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\capiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\windows\system32\dpapiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\windows\system32\dimsroam.dll
2014-05-15 13:17 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-05-15 13:17 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2014-05-15 13:17 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2014-05-15 13:17 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\windows\SysWOW64\objsel.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\cngprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\windows\SysWOW64\adprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\windows\SysWOW64\capiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpapiprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\dimsroam.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wincredprovider.dll
2014-05-15 13:17 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-05-15 13:17 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2014-05-08 09:46 - 2014-05-29 17:32 - 00068096 _____ () C:\Users\milie\Desktop\Buchhaltung 2014.xls
2014-05-07 09:40 - 2014-05-21 14:17 - 00000000 ____D () C:\Users\milie\Documents\SAM
2014-05-06 11:53 - 2014-05-06 11:53 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Aid4Mail
2014-05-06 11:35 - 2014-05-16 20:49 - 00002307 _____ () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-06 11:30 - 2014-05-06 11:30 - 00003170 _____ () C:\windows\System32\Tasks\{4BDBAE90-4C96-4DDF-B95E-85B1C87163AF}
2014-05-06 11:19 - 2014-05-06 11:20 - 00000000 _____ () C:\temphtml.htm
2014-05-06 11:19 - 2014-05-06 11:19 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-06 10:53 - 2014-05-06 10:53 - 00002113 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-06 10:53 - 2014-05-06 10:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-06 10:29 - 2014-05-06 12:55 - 00000000 ____D () C:\Users\milie\AppData\Roaming\CDTPL
2014-05-06 10:28 - 2014-05-06 10:29 - 00000000 ____D () C:\Program Files (x86)\Systools MBOX Viewer
2014-05-06 10:28 - 2014-05-06 10:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Systools MBOX Viewer
2014-05-06 07:55 - 2014-05-16 09:19 - 00000000 ___SD () C:\windows\system32\CompatTel

==================== One Month Modified Files and Folders =======

2014-06-01 13:27 - 2014-05-29 09:14 - 00020123 _____ () C:\Users\milie\Desktop\FRST.txt
2014-06-01 13:27 - 2014-05-29 09:14 - 00000000 ____D () C:\FRST
2014-06-01 13:27 - 2014-01-28 12:17 - 00000000 ____D () C:\Users\milie\AppData\Local\Temp
2014-06-01 13:25 - 2014-06-01 13:25 - 00000000 ____D () C:\Users\milie\Desktop\FRST-OlderVersion
2014-06-01 13:25 - 2014-05-29 09:13 - 02067456 _____ (Farbar) C:\Users\milie\Desktop\FRST64.exe
2014-06-01 13:21 - 2013-12-18 15:27 - 01188833 _____ () C:\windows\WindowsUpdate.log
2014-06-01 13:18 - 2014-01-28 12:51 - 00001108 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-01 13:18 - 2012-07-20 03:41 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-06-01 13:01 - 2014-04-23 10:37 - 00005146 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for milie-ultra-milie milie-ultra
2014-06-01 12:55 - 2014-06-01 12:55 - 00000827 _____ () C:\Users\milie\Desktop\JRT.txt
2014-06-01 12:49 - 2014-06-01 12:49 - 00000000 ____D () C:\windows\ERUNT
2014-06-01 12:48 - 2014-06-01 12:48 - 01016261 _____ (Thisisu) C:\Users\milie\Desktop\JRT.exe
2014-06-01 12:45 - 2009-07-14 06:45 - 00027568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-01 12:45 - 2009-07-14 06:45 - 00027568 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-01 12:43 - 2011-02-11 11:56 - 00717756 _____ () C:\windows\system32\perfh007.dat
2014-06-01 12:43 - 2011-02-11 11:56 - 00155252 _____ () C:\windows\system32\perfc007.dat
2014-06-01 12:43 - 2009-07-14 07:13 - 01656808 _____ () C:\windows\system32\PerfStringBackup.INI
2014-06-01 12:42 - 2014-05-26 11:05 - 00000000 ___RD () C:\Users\milie\Google Drive
2014-06-01 12:41 - 2014-04-18 11:24 - 00000000 ___RD () C:\Users\milie\Dropbox
2014-06-01 12:41 - 2014-04-18 11:23 - 00000000 ____D () C:\Users\milie\AppData\Roaming\DropboxMaster
2014-06-01 12:41 - 2014-04-18 11:21 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Dropbox
2014-06-01 12:39 - 2014-01-28 12:51 - 00001104 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-01 12:39 - 2013-12-18 15:27 - 00000828 _____ () C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job
2014-06-01 12:38 - 2014-05-30 18:43 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-01 12:38 - 2010-11-21 05:47 - 00067932 _____ () C:\windows\PFRO.log
2014-06-01 12:38 - 2009-07-14 07:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-06-01 12:38 - 2009-07-14 06:51 - 00043594 _____ () C:\windows\setupact.log
2014-06-01 12:37 - 2014-06-01 12:35 - 00000000 ____D () C:\AdwCleaner
2014-06-01 12:34 - 2014-06-01 12:34 - 01327971 _____ () C:\Users\milie\Desktop\adwcleaner_3.211.exe
2014-06-01 12:33 - 2014-06-01 12:33 - 00019759 _____ () C:\Users\milie\Desktop\mbam.txt
2014-05-31 11:01 - 2014-05-21 14:13 - 00000000 ____D () C:\Users\milie\Documents\VITO
2014-05-31 10:20 - 2013-12-18 15:27 - 00000830 _____ () C:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job
2014-05-30 18:49 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\tracing
2014-05-30 18:42 - 2014-05-30 18:42 - 00001117 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-05-30 18:42 - 2014-05-30 18:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-05-30 18:42 - 2014-05-30 18:42 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-05-30 18:42 - 2014-05-30 18:42 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-05-30 15:09 - 2014-05-30 15:08 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\milie\Downloads\mbam-setup-2.0.2.1012.exe
2014-05-30 15:02 - 2014-03-30 13:21 - 00000728 __RSH () C:\ProgramData\ntuser.pol
2014-05-30 15:02 - 2009-07-14 05:20 - 00000000 ___HD () C:\windows\system32\GroupPolicy
2014-05-30 12:54 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\system32\NDF
2014-05-29 17:32 - 2014-05-08 09:46 - 00068096 _____ () C:\Users\milie\Desktop\Buchhaltung 2014.xls
2014-05-29 09:15 - 2014-05-29 09:15 - 00030280 _____ () C:\Users\milie\Desktop\Addition.txt
2014-05-28 14:15 - 2010-01-09 21:30 - 00000000 __RSD () C:\Users\milie\Documents\My Stationery
2014-05-28 10:24 - 2014-02-03 14:37 - 00000000 ____D () C:\Users\milie\Documents\Benutzerdefinierte Office-Vorlagen
2014-05-26 20:17 - 2014-04-28 10:41 - 00000000 ____D () C:\Users\milie\mozilla sicherung
2014-05-26 11:06 - 2012-07-20 03:41 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-05-26 11:05 - 2014-05-26 11:05 - 00001732 _____ () C:\Users\milie\Desktop\Google Drive.lnk
2014-05-26 11:05 - 2014-01-28 12:17 - 00000000 ____D () C:\Users\milie
2014-05-26 11:05 - 2012-07-20 03:41 - 00692400 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-05-26 11:05 - 2012-07-20 03:41 - 00070832 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-26 11:04 - 2014-05-26 11:04 - 00002053 _____ () C:\Users\Public\Desktop\Google Slides.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002051 _____ () C:\Users\Public\Desktop\Google Sheets.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00002041 _____ () C:\Users\Public\Desktop\Google Docs.lnk
2014-05-26 11:04 - 2014-05-26 11:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
2014-05-26 11:04 - 2014-01-28 12:51 - 00000000 ____D () C:\Users\milie\AppData\Local\Google
2014-05-26 11:04 - 2014-01-28 12:51 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-26 10:42 - 2014-04-04 18:48 - 00000000 ____D () C:\Users\milie\AppData\Roaming\TAG
2014-05-26 07:09 - 2009-07-14 07:08 - 00032550 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-05-25 09:01 - 2014-01-28 12:17 - 00000000 ___RD () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-25 09:00 - 2014-04-18 11:23 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-24 11:01 - 2014-01-28 13:03 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-05-23 16:18 - 2014-05-23 16:18 - 00002111 _____ () C:\Users\Public\Desktop\bob internetsoftware.lnk
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\bob internetsoftware
2014-05-23 16:18 - 2014-05-23 16:18 - 00000000 ____D () C:\Program Files (x86)\bob internetsoftware
2014-05-21 14:28 - 2014-05-21 14:28 - 00049152 _____ () C:\Users\milie\Documents\Endabrechnung Get-Up UBIT-läuft! 2013-2014.xls
2014-05-21 14:20 - 2014-04-06 14:33 - 00000000 ____D () C:\Users\milie\AppData\Local\Microsoft Help
2014-05-21 14:17 - 2014-05-07 09:40 - 00000000 ____D () C:\Users\milie\Documents\SAM
2014-05-19 16:08 - 2012-07-20 03:40 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-05-19 16:05 - 2013-12-18 15:44 - 00000000 ____D () C:\ProgramData\Toshiba
2014-05-17 10:03 - 2014-02-06 16:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-05-17 10:03 - 2009-07-14 07:09 - 00000000 ____D () C:\windows\System32\Tasks\WPD
2014-05-16 20:49 - 2014-05-06 11:35 - 00002307 _____ () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2014-05-16 20:29 - 2014-05-16 20:21 - 3316574824 _____ () C:\Users\milie\Documents\Thunderbird 24.5.0 (de) - 2014-05-16.pcv
2014-05-16 20:28 - 2014-05-16 17:14 - 00001174 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-05-16 20:28 - 2014-05-16 17:14 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-16 20:20 - 2014-05-16 20:20 - 00001042 _____ () C:\Users\Public\Desktop\MozBackup.lnk
2014-05-16 20:20 - 2014-05-16 20:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MozBackup
2014-05-16 20:20 - 2014-02-05 20:02 - 00000000 ____D () C:\Program Files (x86)\MozBackup
2014-05-16 17:15 - 2014-05-16 17:14 - 00000000 ____D () C:\Users\milie\AppData\Local\Mozilla
2014-05-16 17:14 - 2014-02-06 16:55 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Mozilla
2014-05-16 14:25 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\rescache
2014-05-16 13:55 - 2014-02-01 13:41 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Skype
2014-05-16 09:36 - 2014-01-28 12:20 - 00000000 ___RD () C:\Users\milie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 09:19 - 2014-05-06 07:55 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-05-16 09:19 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\PolicyDefinitions
2014-05-15 20:04 - 2014-02-28 10:06 - 00000000 ____D () C:\windows\system32\MRT
2014-05-15 20:03 - 2014-02-28 10:06 - 93223848 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-05-12 07:26 - 2014-05-30 18:42 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys
2014-05-12 07:26 - 2014-05-30 18:42 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys
2014-05-12 07:25 - 2014-05-30 18:42 - 00025816 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2014-05-10 19:13 - 2014-01-28 12:51 - 00004104 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-10 19:13 - 2014-01-28 12:51 - 00003852 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-09 08:14 - 2014-05-15 13:17 - 00477184 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 13:17 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-05-06 12:55 - 2014-05-06 10:29 - 00000000 ____D () C:\Users\milie\AppData\Roaming\CDTPL
2014-05-06 12:02 - 2014-04-17 09:13 - 00000000 ____D () C:\WorkArea
2014-05-06 11:53 - 2014-05-06 11:53 - 00000000 ____D () C:\Users\milie\AppData\Roaming\Aid4Mail
2014-05-06 11:30 - 2014-05-06 11:30 - 00003170 _____ () C:\windows\System32\Tasks\{4BDBAE90-4C96-4DDF-B95E-85B1C87163AF}
2014-05-06 11:28 - 2009-07-14 05:20 - 00000000 ____D () C:\windows\Resources
2014-05-06 11:20 - 2014-05-06 11:19 - 00000000 _____ () C:\temphtml.htm
2014-05-06 11:20 - 2014-02-28 10:04 - 01648226 _____ () C:\windows\SysWOW64\PerfStringBackup.INI
2014-05-06 11:19 - 2014-05-06 11:19 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-06 10:53 - 2014-05-06 10:53 - 00002113 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Thunderbird.lnk
2014-05-06 10:53 - 2014-05-06 10:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-05-06 10:53 - 2014-02-03 13:31 - 00000000 ____D () C:\Users\milie\AppData\Local\Thunderbird
2014-05-06 10:29 - 2014-05-06 10:28 - 00000000 ____D () C:\Program Files (x86)\Systools MBOX Viewer
2014-05-06 10:28 - 2014-05-06 10:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Systools MBOX Viewer
2014-05-06 06:40 - 2014-05-15 20:04 - 23544320 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 20:04 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 20:04 - 17382912 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 20:04 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 20:04 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 20:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

Files to move or delete:
====================
C:\ProgramData\dlprotect.exe


Some content of TEMP:
====================
C:\Users\milie\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpha1qkv.dll
C:\Users\milie\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 07:51

==================== End Of Log ============================
--- --- ---

--- --- ---


Mfg.

schrauber 02.06.2014 12:01

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

jackknife 03.06.2014 16:33
guten Tag,
habe gerade den eset online scanner durchgeführt, hier die log.txt:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=605523cefffbcc49b69cd86dd546ad97
# engine=18537
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-03 03:23:21
# local_time=2014-06-03 05:23:21 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Microsoft Security Essentials'
# compatibility_mode=5895 16777213 100 100 4087152 24792995 0 0
# scanned=146046
# found=4
# cleaned=0
# scan_time=931
sh=11D5EE05ADD03CE3107715CD59EF350BC5084E9F ft=1 fh=825b9b0785a89e52 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\milie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\36KGLQ3O\SPSetup[1].exe"
sh=82ADFD520C7A885796FAA0503F113F6806AFC82C ft=1 fh=7e8b570617b4c90b vn="Variante von Win32/BrowseFox.F evtl. unerwünschte Anwendung" ac=I fn="C:\Users\milie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62SG5HHH\Setup[1].exe"
sh=780B558BAFED2423FB54F8D9B05599018E80AF87 ft=1 fh=845e21fd0df02840 vn="Win32/Conduit.SearchProtect.Q evtl. unerwünschte Anwendung" ac=I fn="C:\Users\milie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FNMKHM32\SPIdentifierImpl[1].exe"
sh=4691C7A8857888C049C46C147C6C66E4F25A4EBF ft=1 fh=02d3e1f077d9a807 vn="Win32/Conduit.SearchProtect.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\milie\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYQ669ZP\spstub[1].exe"
... und hier noch die gewünschte checkup Datei:
Code:
Results of screen317's Security Check version 0.99.83 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 11 
``````````````Antivirus/Firewall Check:``````````````
Microsoft Security Essentials       
McAfee  Anti-Virus und Anti-Spyware 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Java(TM) 6 Update 30 
 Java version out of Date!
 Adobe Reader 10.1.10 Adobe Reader out of Date! 
 Mozilla Firefox (29.0.1)
 Mozilla Thunderbird (24.5.0)
````````Process Check: objlist.exe by Laurent```````` 
 Microsoft Security Essentials MSMpEng.exe
 Microsoft Security Essentials msseces.exe
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbam.exe 
 Malwarebytes Anti-Malware mbamscheduler.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````
bis jetzt funktioniert alles einwandfrei, muss ich noch etwas löschen?
LG!

schrauber 04.06.2014 12:13
Java udn Adobe updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\ProgramData\dlprotect.exe
FF Extension: Download Protect - C:\windows\Installer\{5B7155C7-E2E4-4ADE-B556-4609F9ED2D07}\{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}.xpi [2014-05-30]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.






Fertig :)

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.



Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun :)

Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

jackknife 09.06.2014 12:13
Hallo nach München!


habe Javaupdate gemacht, beim Adobe bin ich nicht sicher: jetzt lade ich der Reader runter, soll ich ebenfalls den Player updaten? sonst habe ich nichts (glaube ich von Adobe).
wenn das Update fertig ist, werde ich den zweiten Schritt machen:
Zitat:
Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:Alles auswählenAufklappen
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\ProgramData\dlprotect.exe
FF Extension: Download Protect - C:\windows\Installer\{5B7155C7-E2E4-4ADE-B556-4609F9ED2D07}\{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}.xpi [2014-05-30]

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Starte nun FRST erneut und klicke den Fix Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.
dann werde ich den restlichen "clean up machen"
aber wie es scheint hast Du mir schon das Problem gelöst, werde nach dem das System bereinigt ist, alles noch mal zusammen fassen.
Eine neue Sache ist leider inzwischen aufgetaucht:
Obwohl ich beim Mozilla Thunderbird nichts gemacht habe, lassen sich keine Hyperlinks öffnen in einer mail, auch nicht mit rechtem Mausklick! Es passiert gar nichts. Ich kann nur den Link in die Zwischenablage kopieren und dann ins Browserfenster einfügen...
habe schon im Thunderbird Forum herumgesucht, aber noch nichts gefunden.
aber ich arte mal alle Schritte ab, die Du mir empfohlen hast und werde auch die Software installieren, die in den "nützlichen" Tipps angeführt ist.
Mit sonnigen Grüßen,

Hallo!
Hier die neue Fixlog:
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 09-06-2014 01
Ran by milie at 2014-06-09 13:04:55 Run:2
Running from C:\Users\milie\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION
C:\ProgramData\dlprotect.exe
FF Extension: Download Protect - C:\windows\Installer\{5B7155C7-E2E4-4ADE-B556-4609F9ED2D07}\{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}.xpi [2014-05-30]
       
*****************

C:\windows\system32\GroupPolicy\Machine => Moved successfully.
C:\windows\system32\GroupPolicy\GPT.ini => Moved successfully.
C:\ProgramData\dlprotect.exe => Moved successfully.
C:\windows\Installer\{5B7155C7-E2E4-4ADE-B556-4609F9ED2D07}\{1F7AE7E3-8A3B-453A-A8F7-F10A5ADAC893}.xpi not found.


The system needed a reboot.

==== End of Fixlog ====
jetzt werde ich wie gesagt, die weiteren Schritte vornehmen und melde mich dann !

schrauber 09.06.2014 16:22
Setz den FF auch mal zurück:

https://support.mozilla.org/de/kb/fi...einfach-loesen


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:21 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19