Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   "Avira wird durch eine Gruppenrichtlinie blockiert" (https://www.trojaner-board.de/155725-avira-gruppenrichtlinie-blockiert.html)

Trainie4 25.06.2014 22:10
"Avira wird durch eine Gruppenrichtlinie blockiert"
 
Hallo,

ich hab schon gesehen, dass auch viele andere dieses Problem hatten.
Mein Avira Control Center kann nicht geöffnet werden, da es durch eine "Gruppenrichtlinie" blockiert ist und dadurch kann ich auch keinerlei Videos im Internet öffnen.
Kann mir bitte jemand helfen? Ich kenne mich mit dem ganzen Computer Kram überhaupt nicht aus und bin so verzweifelt :heulen:

deeprybka 25.06.2014 22:14
:hallo:

Mein Name ist Jürgen und ich werde Dir bei Deinem Problem behilflich sein. Zusammen schaffen wir das...:abklatsch:
  • Bitte arbeite alle Schritte der Reihe nach ab.
  • Lese die Anleitungen sorgfältig durch bevor Du beginnst. Wenn es Probleme gibt oder Du etwas nicht verstehst, dann stoppe mit Deiner Ausführung und beschreibe mir das Problem.
  • Führe bitte nur Scans durch, zu denen Du von mir aufgefordert wurdest.
  • Bitte kein Crossposting (posten in mehreren Foren).
  • Installiere oder deinstalliere während der Bereinigung keine Software, außer Du wurdest dazu aufgefordert.
  • Speichere alle unsere Tools auf dem Desktop ab.
  • Poste die Logfiles direkt in Deinen Thread in Code-Tags.
  • Bedenke, dass wir hier alle während unserer Freizeit tätig sind, wenn du innerhalb von 24 Stunden nichts von mir liest, dann schreibe mir bitte eine PM.

Hinweis:
Ich kann Dir niemals eine Garantie geben, dass wir alle schädlichen Dateien finden werden.
Eine Formatierung ist meist der schnellere und immer der sicherste Weg, aber auch nur bei wirklicher Malware empfehlenswert.
Adware & Co. können wir sehr gut entfernen.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis Du mein clean :daumenhoc bekommst.



Los geht's:

Schritt 1
http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)




Lesestoff
Posten in CODE-Tags: So gehts...
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert uns massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://deeprybka.trojaner-board.de/tdss/codetags.gif

Trainie4 25.06.2014 22:26
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-06-2014
Ran by admin (administrator) on ADMIN-PC on 25-06-2014 23:18:34
Running from C:\Users\admin\Downloads
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Cherished Technololgy LIMITED) C:\ProgramData\IePluginServices\PluginService.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(Microsoft Corporation) C:\Program Files\Windows Live\Messenger\msnmsgr.exe
(Sony) C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Logitech, Inc.) C:\Users\admin\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LULnchr.exe
(Logitech, Inc.) C:\Users\admin\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1706096 2010-10-27] (VIA)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM\...\Policies\Explorer\Run: [1692209207] => C:\ProgramData\msooh.exe [178176 2013-08-29] ( ())
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-18] (Microsoft Corporation)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [msnmsgr] => C:\Program Files\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Facebook Update] => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-08-17] (Facebook Inc.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Sony PC Companion] => C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe [466656 2014-05-23] (Sony)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21446272 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [EwpiSvono] => regsvr32.exe "C:\ProgramData\EwpiSvono\EwpiSvono.dat"
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Policies\Explorer: [HideSCAHealth] 0
AppInit_DLLs: c:\progra~1\suptab\search~1.dll => c:\progra~1\suptab\search~1.dll File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x69F67AF84008CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1401571763&from=cor&uid=SAMSUNGXHD250HJ_S189J9DPA00646&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.sweet-page.com/web/?type=ds&ts=1401571763&from=cor&uid=SAMSUNGXHD250HJ_S189J9DPA00646&q={searchTerms}
SearchScopes: HKLM - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1401571763&from=cor&uid=SAMSUNGXHD250HJ_S189J9DPA00646&q={searchTerms}
SearchScopes: HKCU - {31090377-0740-419E-BEFC-A56E50500D5B} URL = hxxp://www.sweet-page.com/web/?type=ds&ts=1401571763&from=cor&uid=SAMSUNGXHD250HJ_S189J9DPA00646&q={searchTerms}
SearchScopes: HKCU - {33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=BDCF6DAE-E76B-45DD-A68C-D329956164D9&apn_sauid=72DB5C68-BBFE-414A-89E2-DA441947410A
SearchScopes: HKCU - {E7DFEC4F-1E56-43FC-879E-21F642BE1D8A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB05
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 28 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default
FF Homepage: hxxp://msn.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\admin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\searchplugins\dvdvideosofttb-customized-web-search.xml
FF SearchPlugin: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\searchplugins\Speedial.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DVDVideoSoftTB  - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5} [2013-11-20]
FF Extension: Speedial - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\{fa95f577-07cb-4470-ac90-e843f5f83c52} [2014-05-31]
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: DVDVideoSoft YouTube MP3 and Video Download - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi [2012-11-22]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-06-11]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]

Chrome:
=======
CHR StartupUrls: "hxxp://www.sweet-page.com/?type=hppp&ts=1401572147&from=cor&uid=SAMSUNGXHD250HJ_S189J9DPA00646"
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh [2013-09-20]
CHR Extension: (Skype Click to Call) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-03-24]
CHR Extension: (DVDVideoSoft Browser Extension) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2012-09-23]
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20]
CHR Extension: (DVDVideoSoftTB) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo [2012-09-23]
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-02-21]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]
CHR HKLM\...\Chrome\Extension: [plmlpkfpkijnlijgalnjaacllnjmoamo] - C:\Users\admin\AppData\Local\CRE\plmlpkfpkijnlijgalnjaacllnjmoamo.crx [2012-09-20]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Users\admin\AppData\Roaming\DVDVideoSoft\dvsYoutubeDownload.crx [2012-09-20]
CHR HKCU\...\Chrome\Extension: [plmlpkfpkijnlijgalnjaacllnjmoamo] - C:\Users\admin\AppData\Local\CRE\plmlpkfpkijnlijgalnjaacllnjmoamo.crx [2012-09-20]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
S4 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 IePluginServices; C:\ProgramData\IePluginServices\PluginService.exe [704112 2014-05-08] (Cherished Technololgy LIMITED)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]
S3 npggsvc; C:\Windows\system32\GameMon.des [3975544 2012-05-09] (INCA Internet Co., Ltd.) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1740600 2013-08-30] (TuneUp Software)
S2 HPSLPSVC; C:\Users\admin\AppData\Local\Temp\7zS6B90\hpslpsvc32.dll [X]

==================== Drivers (Whitelisted) ====================

R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2006-11-02] (Microsoft Corporation)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-23] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1149552 2010-10-25] (VIA Technologies, Inc.)
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-25 23:18 - 2014-06-25 23:19 - 00021738 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 23:18 - 2014-06-25 23:18 - 00000000 ____D () C:\FRST
2014-06-25 22:43 - 2014-06-25 22:44 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:14 - 2014-06-25 22:20 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 12:36 - 2014-06-25 12:36 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-25 11:40 - 2014-06-25 11:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:07 - 2014-06-25 17:09 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-23 20:48 - 2014-06-24 00:08 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 11:44 - 2014-06-22 23:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:49 - 2014-06-16 11:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:20 - 2014-06-23 20:49 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-13 19:07 - 2014-06-17 20:50 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-13 19:07 - 2014-06-13 19:08 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:43 - 2014-06-13 15:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 12:18 - 2014-06-12 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-11 18:58 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 18:58 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 18:58 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 18:58 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 18:58 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 18:58 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 18:58 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 18:58 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 18:58 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 18:58 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 18:58 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 18:58 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 18:58 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 18:58 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 18:58 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 18:58 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 18:58 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 18:58 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 18:58 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 18:58 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 18:58 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 18:58 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 18:58 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 18:58 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 18:58 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 18:58 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 18:58 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 18:58 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 18:57 - 2014-05-08 11:06 - 00919040 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 18:57 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 18:57 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 18:57 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 18:57 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 18:57 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 11:22 - 2014-06-10 23:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:24 - 2014-06-09 20:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:24 - 2014-06-09 00:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:32 - 2014-06-07 20:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:17 - 2014-06-05 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-03 12:14 - 2014-06-04 00:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:12 - 2014-06-02 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 11:52 - 2014-06-01 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-06-01 00:08 - 2014-06-01 00:08 - 00000000 ____D () C:\ProgramData\2308189059
2014-05-31 23:54 - 2014-05-31 23:55 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-05-31 23:52 - 2014-06-01 00:04 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:51 - 2014-06-01 00:08 - 00000000 ____D () C:\Users\admin\AppData\Local\PriceMeter
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:35 - 2014-06-01 00:05 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Systweak
2014-05-31 23:35 - 2014-04-25 14:49 - 00018776 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot.exe
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\Users\admin\Documents\Optimizer Pro
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 23:29 - 2014-06-01 00:14 - 00000000 ____D () C:\Users\admin\AppData\Roaming\sweet-page
2014-05-31 23:29 - 2014-06-01 00:14 - 00000000 ____D () C:\Program Files\SupTab
2014-05-31 23:29 - 2014-06-01 00:07 - 00000000 ____D () C:\ProgramData\WPM
2014-05-31 23:29 - 2014-05-31 23:30 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-30 12:50 - 2014-05-31 00:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-29 12:48 - 2014-05-30 00:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:40 - 2014-06-04 20:38 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-05-28 20:20 - 2014-05-28 20:21 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:19 - 2014-05-28 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}
2014-05-27 12:18 - 2014-05-27 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{248FC10F-4936-4B0B-9DBE-FF1E957DD692}
2014-05-26 12:13 - 2014-05-27 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{93E7D62A-2DDD-4946-AC45-78B125FFAD72}
2014-05-26 00:12 - 2014-05-26 00:12 - 00000000 ____D () C:\Users\admin\AppData\Local\{4B2C0E83-FB54-4CF5-88BD-CA0359473783}

==================== One Month Modified Files and Folders =======

2014-06-25 23:19 - 2014-06-25 23:18 - 00021738 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 23:18 - 2014-06-25 23:18 - 00000000 ____D () C:\FRST
2014-06-25 23:12 - 2012-05-12 13:55 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-25 23:07 - 2012-04-10 22:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-25 22:59 - 2012-09-08 00:14 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-25 22:58 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-25 22:58 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-25 22:53 - 2012-03-09 20:53 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-25 22:50 - 2012-03-25 22:03 - 00000000 ____D () C:\Users\admin\AppData\Local\CrashDumps
2014-06-25 22:49 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-25 22:49 - 2009-07-14 06:39 - 00092549 _____ () C:\Windows\setupact.log
2014-06-25 22:44 - 2014-06-25 22:43 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:32 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-25 22:20 - 2014-06-25 22:14 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 22:18 - 2012-03-09 20:39 - 00000000 ____D () C:\Users\admin
2014-06-25 22:17 - 2012-03-13 22:36 - 00000000 ____D () C:\Users\admin\Desktop\HUONG
2014-06-25 21:41 - 2012-03-09 20:29 - 01881336 _____ () C:\Windows\WindowsUpdate.log
2014-06-25 17:09 - 2014-06-24 00:07 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-25 14:12 - 2012-05-12 13:55 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-25 12:36 - 2014-06-25 12:36 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-25 11:41 - 2014-06-25 11:40 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 22:09 - 2012-08-08 13:39 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Skype
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 17:59 - 2012-09-08 00:14 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-24 16:22 - 2012-07-05 23:19 - 00498794 _____ () C:\Windows\DPINST.LOG
2014-06-24 16:22 - 2012-07-05 23:19 - 00001972 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-06-24 16:22 - 2012-07-05 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-06-24 16:22 - 2012-03-10 17:22 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:08 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 20:49 - 2014-06-13 19:20 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-23 20:49 - 2012-09-08 12:57 - 00071680 ____H () C:\Users\admin\Desktop\photothumb.db
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 23:46 - 2014-06-22 11:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:08 - 2012-03-13 19:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 20:50 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 21:06 - 2012-03-10 17:35 - 00624216 _____ () C:\Windows\PFRO.log
2014-06-16 11:50 - 2014-06-16 11:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 21:02 - 2012-09-08 00:15 - 00002322 _____ () C:\Users\admin\Desktop\Google Chrome.lnk
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:08 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:44 - 2014-06-13 15:43 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 19:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-06-12 12:19 - 2014-06-12 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-12 12:15 - 2012-04-26 19:00 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-12 01:16 - 2013-08-14 23:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 01:15 - 2012-07-07 20:26 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 23:23 - 2014-06-10 11:22 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:25 - 2014-06-09 20:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:25 - 2014-06-09 00:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:33 - 2014-06-07 20:32 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:18 - 2014-06-05 12:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 20:38 - 2014-05-28 20:40 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-06-04 13:40 - 2013-08-24 12:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 13:40 - 2013-08-24 12:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-04 00:16 - 2014-06-03 12:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:13 - 2014-06-02 12:12 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 23:53 - 2014-06-01 11:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-06-01 00:14 - 2014-05-31 23:29 - 00000000 ____D () C:\Users\admin\AppData\Roaming\sweet-page
2014-06-01 00:14 - 2014-05-31 23:29 - 00000000 ____D () C:\Program Files\SupTab
2014-06-01 00:08 - 2014-06-01 00:08 - 00000000 ____D () C:\ProgramData\2308189059
2014-06-01 00:08 - 2014-05-31 23:51 - 00000000 ____D () C:\Users\admin\AppData\Local\PriceMeter
2014-06-01 00:07 - 2014-05-31 23:29 - 00000000 ____D () C:\ProgramData\WPM
2014-06-01 00:05 - 2014-05-31 23:35 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Systweak
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-06-01 00:04 - 2014-05-31 23:52 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:55 - 2014-05-31 23:54 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:54 - 2012-09-21 23:02 - 00000000 _____ () C:\END
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\Users\admin\Documents\Optimizer Pro
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 23:33 - 2012-04-03 18:46 - 00000000 ____D () C:\Users\admin\AppData\Local\Microsoft Games
2014-05-31 23:30 - 2014-05-31 23:29 - 00000000 ____D () C:\ProgramData\IePluginServices
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-31 00:52 - 2014-05-30 12:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ___RD () C:\Program Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ____D () C:\ProgramData\Skype
2014-05-30 11:18 - 2014-06-11 18:58 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-11 18:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-11 18:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-11 18:58 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-11 18:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-11 18:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 18:58 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-11 18:58 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 18:58 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-11 18:58 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-11 18:58 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-11 18:58 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-11 18:58 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-11 18:58 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-11 18:58 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 18:58 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 18:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-11 18:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 18:58 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-11 18:58 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-11 18:58 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-11 18:58 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 18:58 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 18:58 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-11 18:58 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-11 18:58 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-11 18:58 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-11 18:58 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 00:49 - 2014-05-29 12:48 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:21 - 2014-05-28 20:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:20 - 2014-05-28 00:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}
2014-05-27 12:19 - 2014-05-27 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{248FC10F-4936-4B0B-9DBE-FF1E957DD692}
2014-05-27 00:14 - 2014-05-26 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{93E7D62A-2DDD-4946-AC45-78B125FFAD72}
2014-05-26 00:12 - 2014-05-26 00:12 - 00000000 ____D () C:\Users\admin\AppData\Local\{4B2C0E83-FB54-4CF5-88BD-CA0359473783}

Files to move or delete:
====================
C:\ProgramData\msooh.exe


Some content of TEMP:
====================
C:\Users\admin\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 22:19

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:25-06-2014
Ran by admin at 2014-06-25 23:20:03
Running from C:\Users\admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

32 Bit HP CIO Components Installer (Version: 6.1.1 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe AIR (Version: 1.0.8.4990 - Adobe Systems Inc.) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 2.00.0001 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.898.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{C4100721-2D71-CC80-8877-0A7855B6EEFB}) (Version: 3.0.868.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.70214.2220 - Advanced Micro Devices, Inc.) Hidden
ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version:  - ASRock Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
CameraHelperMsi (Version: 13.31.1038.0 - Logitech) Hidden
Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (Version: 2012.0214.2218.39913 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
ccc-utility (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
Copy (Version: 130.0.428.000 - Hewlett-Packard) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden
DJ_AIO_03_F4200_Software_Min (Version: 130.0.365.000 - Hewlett-Packard) Hidden
Elsword_DE (HKLM\...\Elsword_DE_is1) (Version:  - )
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
F4200 (Version: 130.0.365.000 - Hewlett-Packard) Hidden
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Free Audio CD Burner version 1.4.8 (HKLM\...\Free Audio CD Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free YouTube Download version 3.1.37.918 (HKLM\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.13.925 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.13.925 - DVDVideoSoft Ltd.)
Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Deskjet F4200 All-In-One Driver Software 13.0 Rel. 3 (HKLM\...\{A00C9114-40E6-4C70-A619-7DF264B23485}) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Java Auto Updater (Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 5 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217005FF}) (Version: 7.0.50 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Logitech Vid HD (HKLM\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam-Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.31 - Logitech Inc.)
LWS Facebook (Version: 13.31.1038.0 - Logitech) Hidden
LWS Gallery (Version: 13.31.1038.0 - Logitech) Hidden
LWS Help_main (Version: 13.31.1044.0 - Logitech) Hidden
LWS Launcher (Version: 13.31.1038.0 - Logitech) Hidden
LWS Motion Detection (Version: 13.30.1395.0 - Logitech) Hidden
LWS Pictures And Video (Version: 13.31.1038.0 - Logitech) Hidden
LWS Twitter (Version: 13.30.1346.0 - Logitech) Hidden
LWS Video Mask Maker (Version: 13.30.1379.0 - Logitech) Hidden
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
LWS Webcam Software (Version: 13.31.1038.0 - Logitech) Hidden
LWS WLM Plugin (Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (Version: 13.31.1038.0 - Logitech) Hidden
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Media Go (HKLM\...\{362AB21A-E2C4-40CE-81C2-8C4D62B0635A}) (Version: 2.4.256 - Sony)
Media Go Video Playback Engine 1.116.109.02030 (HKLM\...\{54215B8A-6212-8DB8-39B4-98EE2BB98BD1}) (Version: 1.116.109.02030 - Sony)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PhotoScape (HKLM\...\PhotoScape) (Version:  - )
Platform (Version: 1.34 - VIA Technologies, Inc.) Hidden
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Click to Call (HKLM\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Sony Ericsson Update Engine (HKLM\...\Update Engine) (Version: 2.13.6.201305161305 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.211 (HKLM\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.211 - Sony)
Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.89 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities 2014) (Version: 14.0.1000.89 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.89 - TuneUp Software) Hidden
Uninstall 1.0.0.1 (HKLM\...\Uninstall_is1) (Version:  - )
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
VIA Plattform-Geräte-Manager (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

11-06-2014 23:14:35 Windows Update
18-06-2014 15:11:39 Sony PC Companion

==================== Hosts content: ==========================

2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {018230F2-5D11-43A1-9A51-76FA8FF48BC0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {0A179964-1EF9-4B62-AED2-85E8B451F2EF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-17] (Facebook Inc.)
Task: {2FA9F294-38CC-460D-B185-D1712D4ECB41} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-08] (Google Inc.)
Task: {61C9533C-A5A8-4C69-856F-827F9C3507D1} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08] (Hewlett-Packard)
Task: {82C778DE-26A7-4C0D-9BF6-2494C569478B} - System32\Tasks\Google Updater and Installer => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-08] (Google Inc.)
Task: {83264D8B-8132-4C15-AEA6-90F200DCC147} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-17] (Facebook Inc.)
Task: {DE300EED-CB94-400C-B0B7-6EBE6CA68E3B} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-17] (Sun Microsystems, Inc.)
Task: {E12AD530-7E84-4CF7-BA94-53CB2AB82F8F} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2013-08-30] (TuneUp Software)
Task: {EB2C763D-C12D-42BD-BDAA-3ADEFE8C25BB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-08] (Google Inc.)
Task: {FCBF433A-16B6-42B7-AD83-48B23BC97863} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-08-30 09:51 - 2013-08-30 09:51 - 00501560 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2012-03-10 17:30 - 2010-10-27 08:56 - 00080496 ____R () C:\Program Files\VIA\VIAudioi\VDeck\QsApoApi.dll
2012-03-10 17:30 - 2010-10-27 08:56 - 00113264 ____R () C:\Program Files\VIA\VIAudioi\VDeck\Dts2ApoApi.dll
2012-03-10 17:30 - 2010-10-27 08:57 - 00100976 ____R () C:\Program Files\VIA\VIAudioi\VDeck\VMicApi.dll
2012-03-10 17:30 - 2010-10-27 08:57 - 64663664 ____R () C:\Program Files\VIA\VIAudioi\VDeck\Skin.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 02145304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 07956504 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00342552 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00029208 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00128536 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-07-05 23:19 - 2012-04-30 11:57 - 00039936 _____ () C:\Program Files\Sony\Sony PC Companion\TMonitorAPI.dll
2012-07-05 23:19 - 2013-09-13 11:02 - 00208896 _____ () C:\Program Files\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 15:54 - 2011-07-07 15:54 - 00233984 _____ () C:\Program Files\Sony\Sony PC Companion\Report.dll
2013-01-09 14:11 - 2013-01-09 14:11 - 00599040 _____ () C:\Program Files\Sony\Sony PC Companion\PhoneUpdate.dll
2011-11-11 14:07 - 2011-11-11 14:07 - 00265240 _____ () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2011-11-11 14:09 - 2011-11-11 14:09 - 00336408 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2012-07-05 23:19 - 2013-10-31 12:35 - 00070880 _____ () C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
2011-08-12 12:19 - 2011-08-12 12:19 - 00680984 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
2014-06-11 18:33 - 2014-06-11 18:33 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-05-14 21:07 - 2014-05-14 21:07 - 16361136 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll
2012-02-14 23:13 - 2012-02-14 23:13 - 00369152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/25/2014 10:49:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: msooh.exe, Version: 0.0.0.0, Zeitstempel: 0x539ef790
Name des fehlerhaften Moduls: msooh.exe, Version: 0.0.0.0, Zeitstempel: 0x539ef790
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00007602
ID des fehlerhaften Prozesses: 0xdf8
Startzeit der fehlerhaften Anwendung: 0xmsooh.exe0
Pfad der fehlerhaften Anwendung: msooh.exe1
Pfad des fehlerhaften Moduls: msooh.exe2
Berichtskennung: msooh.exe3

Error: (06/25/2014 10:26:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x14a4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/24/2014 07:58:39 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/24/2014 07:56:32 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/21/2014 07:52:06 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/21/2014 07:50:46 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/18/2014 10:21:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/18/2014 10:20:09 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/16/2014 10:18:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/16/2014 10:17:16 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (06/25/2014 10:51:43 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 10:50:11 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 10:50:11 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {10DA4F3C-CC99-4190-BE4D-58330754E882}

Error: (06/25/2014 10:49:41 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 09:26:49 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 09:25:17 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 09:25:17 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {10DA4F3C-CC99-4190-BE4D-58330754E882}

Error: (06/25/2014 09:24:47 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 11:42:43 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/25/2014 11:41:16 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126


Microsoft Office Sessions:
=========================
Error: (06/25/2014 10:49:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: msooh.exe0.0.0.0539ef790msooh.exe0.0.0.0539ef790c000000500007602df801cf90b703cb1e14C:\ProgramData\msooh.exeC:\ProgramData\msooh.exe42530246-fcaa-11e3-aa4e-bc5ff40be9f8

Error: (06/25/2014 10:26:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b14a401cf90ab4a22b22aC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll06b2d934-fca7-11e3-b901-bc5ff40be9f8

Error: (06/24/2014 07:58:39 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/24/2014 07:56:32 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/21/2014 07:52:06 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/21/2014 07:50:46 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/18/2014 10:21:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/18/2014 10:20:09 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/16/2014 10:18:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/16/2014 10:17:16 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3


==================== Memory info ===========================

Percentage of memory in use: 53%
Total physical RAM: 3255.05 MB
Available physical RAM: 1528.42 MB
Total Pagefile: 6506.34 MB
Available Pagefile: 4224.53 MB
Total Virtual: 2047.88 MB
Available Virtual: 1884.67 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:49.3 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: F648F648)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================
So? :/
Danke für die schnelle Nachricht!

deeprybka 25.06.2014 22:31
Zitat:
Zitat von Trainie4 (Beitrag 1321828)
So? :/
Danke für die schnelle Nachricht!
Ja, genau so! :D
Gerne!

Passwörter für alle sensiblen Logins würde ich von einem anderen PC aus ändern. Mit diesem hier bis zum >clean< bitte keine sensiblen Logins (Bank, paypal etc.) vornehmen.

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.

Dein Avira "geht" jetzt wieder. Bitte deaktiviere den Echtzeitschutz vor dem nächsten Schritt.

Schritt 2
Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Trainie4 25.06.2014 22:42
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:25-06-2014
Ran by admin at 2014-06-25 23:39:28 Run:1
Running from C:\Users\admin\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
       
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.

==== End of Fixlog ====


wie deaktiviere ich den Echtzeitschutz und meine Antivirensoftware?

deeprybka 25.06.2014 22:52
Auf "Aus" stellen... ;)


http://s7.directupload.net/images/140625/4wez3des.png

Trainie4 25.06.2014 23:28
wie doof ich bin..haha danke

Code:
ComboFix 14-06-24.01 - admin 26.06.2014  0:00.1.4 - x86
Microsoft Windows 7 Ultimate  6.1.7601.1.1252.49.1031.18.3255.1306 [GMT 2:00]
ausgeführt von:: c:\users\admin\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\END
c:\program files\Java\jre7\bin\jp2ssv.dll
c:\programdata\2308189059
c:\programdata\2308189059\BITDF56.tmp
c:\programdata\msooh.exe
c:\users\admin\AppData\Roaming\Help\coredb\storage
c:\windows\system32\roboot.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2014-05-25 bis 2014-06-25  ))))))))))))))))))))))))))))))
.
.
2014-06-25 21:18 . 2014-06-25 21:39        --------        d-----w-        C:\FRST
2014-06-25 10:36 . 2014-06-25 10:36        --------        d-----w-        c:\programdata\EwpiSvono
2014-06-13 17:07 . 2014-06-17 18:50        --------        d-----w-        c:\users\admin\AppData\Roaming\Windows Live Writer
2014-06-13 17:07 . 2014-06-13 17:08        --------        d-----w-        c:\users\admin\AppData\Local\Windows Live Writer
2014-06-11 16:57 . 2014-03-26 14:27        1389056        ----a-w-        c:\windows\system32\msxml6.dll
2014-06-11 16:57 . 2014-03-26 14:27        1237504        ----a-w-        c:\windows\system32\msxml3.dll
2014-06-11 16:57 . 2014-03-26 14:25        2048        ----a-w-        c:\windows\system32\msxml6r.dll
2014-06-11 16:57 . 2014-03-26 14:25        2048        ----a-w-        c:\windows\system32\msxml3r.dll
2014-06-11 16:57 . 2014-04-05 02:25        1294272        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2014-06-11 16:57 . 2014-04-05 02:24        187840        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS
2014-06-11 16:57 . 2014-04-25 02:06        626688        ----a-w-        c:\windows\system32\usp10.dll
2014-06-11 16:57 . 2014-05-08 09:06        919040        ----a-w-        c:\windows\system32\rdpcorets.dll
2014-05-31 21:53 . 2014-05-31 22:04        --------        d-----w-        c:\users\admin\AppData\Local\Opera Software
2014-05-31 21:53 . 2014-05-31 22:04        --------        d-----w-        c:\users\admin\AppData\Roaming\Opera Software
2014-05-31 21:52 . 2014-05-31 22:04        --------        d-----w-        c:\program files\Opera
2014-05-31 21:51 . 2014-05-31 22:08        --------        d-----w-        c:\users\admin\AppData\Local\PriceMeter
2014-05-31 21:35 . 2014-05-31 22:05        --------        d-----w-        c:\users\admin\AppData\Roaming\Systweak
2014-05-31 21:29 . 2014-05-31 21:30        --------        d-----w-        c:\programdata\IePluginServices
2014-05-31 21:29 . 2014-05-31 22:14        --------        d-----w-        c:\program files\SupTab
2014-05-31 21:29 . 2014-05-31 22:07        --------        d-----w-        c:\programdata\WPM
2014-05-31 21:29 . 2014-05-31 22:14        --------        d-----w-        c:\users\admin\AppData\Roaming\sweet-page
2014-05-30 09:56 . 2014-05-30 09:56        --------        d-----w-        c:\users\admin\AppData\Local\Skype
2014-05-30 09:56 . 2014-05-30 09:56        --------        d-----w-        c:\program files\Common Files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-04 11:40 . 2013-08-24 10:16        93528        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2014-06-04 11:40 . 2013-08-24 10:16        136216        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2014-05-14 19:07 . 2012-04-10 20:04        692400        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2014-05-14 19:07 . 2012-03-13 16:36        70832        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-09 07:06 . 2014-05-14 17:49        369664        ----a-w-        c:\windows\system32\aepdu.dll
2014-05-09 07:04 . 2014-05-14 17:49        302592        ----a-w-        c:\windows\system32\aeinv.dll
2014-04-12 02:15 . 2014-05-14 17:49        67520        ----a-w-        c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:15 . 2014-05-14 17:49        136640        ----a-w-        c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:12 . 2014-05-14 17:49        100352        ----a-w-        c:\windows\system32\sspicli.dll
2014-04-12 02:12 . 2014-05-14 17:49        15872        ----a-w-        c:\windows\system32\sspisrv.dll
2014-04-12 02:12 . 2014-05-14 17:49        22016        ----a-w-        c:\windows\system32\secur32.dll
2014-04-12 02:11 . 2014-05-14 17:49        1059840        ----a-w-        c:\windows\system32\lsasrv.dll
2014-04-12 02:11 . 2014-05-14 17:49        22528        ----a-w-        c:\windows\system32\lsass.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}]
2014-02-13 05:22        12240        ----a-w-        c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{41564952-412D-5637-00A7-7A786E7484D7}"= "c:\program files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll" [2014-02-13 12240]
.
[HKEY_CLASSES_ROOT\clsid\{41564952-412d-5637-00a7-7a786e7484d7}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony PC Companion"="c:\program files\Sony\Sony PC Companion\PCCompanion.exe" [2014-05-23 466656]
"GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57"="c:\users\admin\AppData\Local\Google\Chrome\Application\chrome.exe" [2014-06-05 860488]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2014-05-08 21446272]
"EwpiSvono"="c:\programdata\EwpiSvono\EwpiSvono.dat" [2014-06-25 365192]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2010-10-27 1706096]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2012-02-14 636032]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2011-11-11 205336]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-22 150528]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2014-06-04 737872]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-05-17 280576]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AML Device Install.lnk - c:\program files\AMD AVT\bin\kdbsync.exe aml [2012-1-31 10752]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
"HideSCAHealth"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"TaskbarNoNotification"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.drv
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Google Update"="c:\users\admin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
.
R3 EagleXNt;EagleXNt;c:\windows\system32\drivers\EagleXNt.sys [x]
R3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\DRIVERS\ggflt.sys [2012-07-05 12400]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-05-30 108032]
R3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des [2012-05-09 3975544]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2010-11-20 15872]
R3 Sony PC Companion;Sony PC Companion;c:\program files\Sony\Sony PC Companion\PCCService.exe [2013-02-04 155824]
R3 ss_bbus;SAMSUNG USB Mobile Device (WDM);c:\windows\system32\DRIVERS\ss_bbus.sys [2009-09-19 98432]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R4 APNMCP;Ask Aktualisierungsdienst;c:\program files\AskPartnerNetwork\Toolbar\apnmcp.exe [2014-02-13 166352]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2010-06-11 13832]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-11-25 37352]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2012-02-15 163328]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2014-06-04 430160]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2014-06-04 1039440]
S2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-04-11 1390720]
S2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-04-11 1764992]
S2 IePluginServices;IePlugin Services;c:\programdata\IePluginServices\PluginService.exe [2014-05-08 704112]
S2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [2013-08-30 1740600]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2011-12-05 86032]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-08-20 189440]
S3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [2013-08-21 12320]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2010-10-25 1149552]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPService        REG_MULTI_SZ          HPSLPSVC
HPZ12        REG_MULTI_SZ          Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-10 19:07]
.
2014-06-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
- c:\users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-12 12:06]
.
2014-06-25 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
- c:\users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-05-12 12:06]
.
2014-06-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
- c:\users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-07 22:14]
.
2014-06-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
- c:\users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-07 22:14]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
mStart Page = about:blank
uInternet Settings,ProxyOverride = <-loopback>
IE: Free YouTube Download - c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\users\admin\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\
FF - prefs.js: browser.startup.homepage - hxxp://msn.de/
FF - ExtSQL: !HIDDEN! 2013-02-09 17:47; smartwebprinting@hp.com; c:\program files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Explorer_Run-1692209207 - c:\progra~2\msooh.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-2742928999-3257237434-1072491205-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.Email.1"
.
[HKEY_USERS\S-1-5-21-2742928999-3257237434-1072491205-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\SYSTEM32\WISPTIS.EXE
c:\windows\system32\taskhost.exe
c:\program files\Common Files\microsoft shared\ink\TabTip.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
c:\program files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
c:\program files\Common Files\Logishrd\LQCVFX\COCIManager.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\users\admin\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LULnchr.exe
c:\users\admin\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe
c:\program files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
c:\windows\system32\sppsvc.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-06-26  00:22:03 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-06-25 22:22
.
Vor Suchlauf: 6 Verzeichnis(se), 56.204.345.344 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 56.087.425.024 Bytes frei
.
- - End Of File - - 0B3F7341519A74FF7EA92354D126640E
A36C5E4F47E84449FF07ED3517B43A31
vorhin konnte ich avira wieder öffnen, doch jz auch nach dem Neustart steht wieder, dass das Programm durch eine Gruppenrichtlinie blockiert ist..

deeprybka 25.06.2014 23:28
Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Trainie4 25.06.2014 23:38

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-06-2014
Ran by admin (administrator) on ADMIN-PC on 26-06-2014 00:35:52
Running from C:\Users\admin\Downloads
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: Downloading Farbar Recovery Scan Tool
Download link for 64-Bit Version: Downloading Farbar Recovery Scan Tool
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: FRST Tutorial - How to use Farbar Recovery Scan Tool - Malware Removal Guides and Tutorials

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Sony) C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems Incorporated) C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1706096 2010-10-27] (VIA)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM\...\Policies\Explorer\Run: [1692209207] => C:\PROGRA~2\msooh.exe No File
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-18] (Microsoft Corporation)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Sony PC Companion] => C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe [466656 2014-05-23] (Sony)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21446272 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [EwpiSvono] => regsvr32.exe "C:\ProgramData\EwpiSvono\EwpiSvono.dat"
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Sign In
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x69F67AF84008CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=BDCF6DAE-E76B-45DD-A68C-D329956164D9&apn_sauid=72DB5C68-BBFE-414A-89E2-DA441947410A
SearchScopes: HKCU - {E7DFEC4F-1E56-43FC-879E-21F642BE1D8A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB05
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {5D6F45B3-9043-443D-A792-115447494D24} MSN Games - Free Online Games
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} MSN Games - Free Online Games
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default
FF Homepage: hxxp://msn.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\admin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-06-11]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh [2013-09-20]
CHR Extension: (Skype Click to Call) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-03-24]
CHR Extension: (No Name) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp [2012-09-23]
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20]
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-02-21]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
S4 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]
S3 npggsvc; C:\Windows\system32\GameMon.des [3975544 2012-05-09] (INCA Internet Co., Ltd.) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1740600 2013-08-30] (TuneUp Software)
S2 HPSLPSVC; C:\Users\admin\AppData\Local\Temp\7zS6B90\hpslpsvc32.dll [X]

==================== Drivers (Whitelisted) ====================

R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2006-11-02] (Microsoft Corporation)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-23] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1149552 2010-10-25] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\admin\AppData\Local\Temp\catchme.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 00:30 - 2014-06-26 00:32 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-26 00:29 - 2014-06-26 00:29 - 01342659 _____ () C:\Users\admin\Downloads\adwcleaner_3.213.exe
2014-06-26 00:22 - 2014-06-26 00:22 - 00015850 _____ () C:\ComboFix.txt
2014-06-25 23:58 - 2014-06-26 00:22 - 00000000 ____D () C:\Qoobox
2014-06-25 23:58 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-25 23:58 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-25 23:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-25 23:57 - 2014-06-26 00:20 - 00000000 ____D () C:\Windows\erdnt
2014-06-25 23:57 - 2014-06-25 23:57 - 05211571 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-25 23:41 - 2014-06-25 23:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{186F2A27-6EF0-4FF8-9017-830AF6D5FE66}
2014-06-25 23:20 - 2014-06-25 23:20 - 00031594 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-25 23:18 - 2014-06-26 00:35 - 00017326 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-25 23:18 - 2014-06-26 00:35 - 00000000 ____D () C:\FRST
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 22:43 - 2014-06-25 22:44 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:14 - 2014-06-25 22:20 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 12:36 - 2014-06-25 12:36 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-25 11:40 - 2014-06-25 11:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:07 - 2014-06-25 17:09 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-23 20:48 - 2014-06-24 00:08 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 11:44 - 2014-06-22 23:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:49 - 2014-06-16 11:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:20 - 2014-06-23 20:49 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-13 19:07 - 2014-06-17 20:50 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-13 19:07 - 2014-06-13 19:08 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:43 - 2014-06-13 15:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 12:18 - 2014-06-12 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-11 18:58 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 18:58 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 18:58 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 18:58 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 18:58 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 18:58 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 18:58 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 18:58 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 18:58 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 18:58 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 18:58 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 18:58 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 18:58 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 18:58 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 18:58 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 18:58 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 18:58 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 18:58 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 18:58 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 18:58 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 18:58 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 18:58 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 18:58 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 18:58 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 18:58 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 18:58 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 18:58 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 18:58 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 18:57 - 2014-05-08 11:06 - 00919040 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 18:57 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 18:57 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 18:57 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 18:57 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 18:57 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 11:22 - 2014-06-10 23:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:24 - 2014-06-09 20:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:24 - 2014-06-09 00:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:32 - 2014-06-07 20:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:17 - 2014-06-05 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-03 12:14 - 2014-06-04 00:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:12 - 2014-06-02 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 11:52 - 2014-06-01 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-05-31 23:54 - 2014-05-31 23:55 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-05-31 23:52 - 2014-06-01 00:04 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-30 12:50 - 2014-05-31 00:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-29 12:48 - 2014-05-30 00:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:40 - 2014-06-04 20:38 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-05-28 20:20 - 2014-05-28 20:21 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:19 - 2014-05-28 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}
2014-05-27 12:18 - 2014-05-27 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{248FC10F-4936-4B0B-9DBE-FF1E957DD692}

==================== One Month Modified Files and Folders =======

2014-06-26 00:37 - 2014-06-25 23:18 - 00017326 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-26 00:35 - 2014-06-25 23:18 - 00000000 ____D () C:\FRST
2014-06-26 00:33 - 2012-03-10 17:35 - 00625448 _____ () C:\Windows\PFRO.log
2014-06-26 00:33 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 00:33 - 2009-07-14 06:39 - 00092717 _____ () C:\Windows\setupact.log
2014-06-26 00:32 - 2014-06-26 00:30 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:32 - 2012-03-09 20:29 - 01909478 _____ () C:\Windows\WindowsUpdate.log
2014-06-26 00:31 - 2012-03-13 22:38 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-06-26 00:31 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 00:31 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 00:29 - 2014-06-26 00:29 - 01342659 _____ () C:\Users\admin\Downloads\adwcleaner_3.213.exe
2014-06-26 00:29 - 2012-03-09 20:53 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-26 00:22 - 2014-06-26 00:22 - 00015850 _____ () C:\ComboFix.txt
2014-06-26 00:22 - 2014-06-25 23:58 - 00000000 ____D () C:\Qoobox
2014-06-26 00:22 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-26 00:20 - 2014-06-25 23:57 - 00000000 ____D () C:\Windows\erdnt
2014-06-26 00:16 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-06-26 00:07 - 2012-04-10 22:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-25 23:59 - 2012-09-08 00:14 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-25 23:57 - 2014-06-25 23:57 - 05211571 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-25 23:41 - 2014-06-25 23:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{186F2A27-6EF0-4FF8-9017-830AF6D5FE66}
2014-06-25 23:20 - 2014-06-25 23:20 - 00031594 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 23:12 - 2012-05-12 13:55 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-25 22:50 - 2012-03-25 22:03 - 00000000 ____D () C:\Users\admin\AppData\Local\CrashDumps
2014-06-25 22:44 - 2014-06-25 22:43 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:32 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-25 22:20 - 2014-06-25 22:14 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 22:18 - 2012-03-09 20:39 - 00000000 ____D () C:\Users\admin
2014-06-25 22:17 - 2012-03-13 22:36 - 00000000 ____D () C:\Users\admin\Desktop\HUONG
2014-06-25 17:09 - 2014-06-24 00:07 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-25 14:12 - 2012-05-12 13:55 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-25 12:36 - 2014-06-25 12:36 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-25 11:41 - 2014-06-25 11:40 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 22:09 - 2012-08-08 13:39 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Skype
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 17:59 - 2012-09-08 00:14 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-24 16:22 - 2012-07-05 23:19 - 00498794 _____ () C:\Windows\DPINST.LOG
2014-06-24 16:22 - 2012-07-05 23:19 - 00001972 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-06-24 16:22 - 2012-07-05 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-06-24 16:22 - 2012-03-10 17:22 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:08 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 20:49 - 2014-06-13 19:20 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-23 20:49 - 2012-09-08 12:57 - 00071680 ____H () C:\Users\admin\Desktop\photothumb.db
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 23:46 - 2014-06-22 11:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:08 - 2012-03-13 19:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 20:50 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:50 - 2014-06-16 11:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 21:02 - 2012-09-08 00:15 - 00002322 _____ () C:\Users\admin\Desktop\Google Chrome.lnk
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:08 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:44 - 2014-06-13 15:43 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 19:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-06-12 12:19 - 2014-06-12 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-12 12:15 - 2012-04-26 19:00 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-12 01:16 - 2013-08-14 23:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 01:15 - 2012-07-07 20:26 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 23:23 - 2014-06-10 11:22 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:25 - 2014-06-09 20:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:25 - 2014-06-09 00:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:33 - 2014-06-07 20:32 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:18 - 2014-06-05 12:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 20:38 - 2014-05-28 20:40 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-06-04 13:40 - 2013-08-24 12:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 13:40 - 2013-08-24 12:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-04 00:16 - 2014-06-03 12:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:13 - 2014-06-02 12:12 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 23:53 - 2014-06-01 11:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-06-01 00:04 - 2014-05-31 23:52 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:55 - 2014-05-31 23:54 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 23:33 - 2012-04-03 18:46 - 00000000 ____D () C:\Users\admin\AppData\Local\Microsoft Games
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-31 00:52 - 2014-05-30 12:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ___RD () C:\Program Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ____D () C:\ProgramData\Skype
2014-05-30 11:18 - 2014-06-11 18:58 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-11 18:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-11 18:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-11 18:58 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-11 18:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-11 18:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 18:58 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-11 18:58 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 18:58 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-11 18:58 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-11 18:58 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-11 18:58 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-11 18:58 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-11 18:58 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-11 18:58 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 18:58 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 18:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-11 18:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 18:58 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-11 18:58 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-11 18:58 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-11 18:58 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 18:58 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 18:58 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-11 18:58 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-11 18:58 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-11 18:58 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-11 18:58 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 00:49 - 2014-05-29 12:48 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:21 - 2014-05-28 20:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:20 - 2014-05-28 00:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}
2014-05-27 12:19 - 2014-05-27 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{248FC10F-4936-4B0B-9DBE-FF1E957DD692}
2014-05-27 00:14 - 2014-05-26 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{93E7D62A-2DDD-4946-AC45-78B125FFAD72}

Some content of TEMP:
====================
C:\Users\admin\AppData\Local\temp\avgnt.exe
C:\Users\admin\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 22:19

==================== End Of Log ============================
--- --- ---

deeprybka 25.06.2014 23:43
Bekommen wir schon hin... ;)

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...st/frstfix.png

Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe notepad in das Ausführen Fenster.
Klicke auf OK und kopiere nun den Text aus der Codebox in das leere Textdokument:
Code:
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM\...\Policies\Explorer\Run: [1692209207] => C:\PROGRA~2\msooh.exe No File
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [EwpiSvono] => regsvr32.exe "C:\ProgramData\EwpiSvono\EwpiSvono.dat"
C:\ProgramData\EwpiSvono
Reboot:
Speichere dieses bitte als Fixlist.txt in das Verzeichnis ab, in dem sich auch die FRST-Anwendung befindet.
  • Starte FRST und drücke auf den Fix-Button.
  • Das Tool erstellt eine "Fixlog.txt" -Datei.
  • Poste mir bitte deren Inhalt.

Nach dem Neustart dann weiter mit:

Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3

http://filepony.de/icon/malwarebytes_anti_malware.png Malwarebytes Antimalware
  • Download-Link
  • Installiere das Programm in den vorgegebenen Pfad.
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Sollte die Benutzeroberfläche noch in Englisch sein, klicke auf Settings und wähle bei Language Deutsch aus.
  • Unter Erkennung und Schutz setze bitte einen Haken bei "Suche nach Rootkits".
  • Klicke im Anschluss auf "Suchlauf", wähle den Bedrohungssuchlauf aus, aktualisiere die Datenbanken und klicke auf "Suchlauf jetzt starten".
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. (geht so...)
  • Poste mir den Inhalt der Logdatei (geht so...). Klicke dazu auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Suchlauf-Protokoll aus und klicke auf Ansicht. Klicke auf "In Zwischenablage kopieren" poste mir den Inhalt in Code-Tags als Antwort in den Thread.

Schritt 4
Downloade Dir HitmanProhttp://deeprybka.trojaner-board.de/b.../hitmanpro.pngauf Deinen Desktop:

HitmanPro - 32 Bit
HitmanPro - 64 Bit
  • Starte die HitmanPro.exe
  • Klicke auf Weiter und akzeptiere die Lizenzbedingungen. Klicke auf Weiter.
  • Wähle "Nein, ich möchte nur einen Einmalscan zur Überprüfung dieses Computers ausführen" aus und klicke auf Weiter.
  • Lass am Ende des Suchlaufs alle auftretende Funde in die Quarantäne verschieben und klicke auf Weiter.
  • Wähle unten links auf der Button-Leiste Logdatei speichern und speichere die Logdatei auf Deinem Desktop.
  • Schließe HitmanPro.
  • Poste bitte den Inhalt der HitmanPro_<Datum_Uhrzeit>.txt mit Deiner nächsten Antwort.

Trainie4 25.06.2014 23:49
ah moment

deeprybka 25.06.2014 23:51
nee nee...;)
Du musst sie ins Download-Verzeichnis speichern...
Code:
Running from C:\Users\admin\Downloads

Trainie4 25.06.2014 23:55
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:25-06-2014
Ran by admin at 2014-06-26 00:49:54 Run:2
Running from C:\Users\admin\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM\...\Policies\Explorer\Run: [1692209207] => C:\PROGRA~2\msooh.exe No File
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [EwpiSvono] => regsvr32.exe "C:\ProgramData\EwpiSvono\EwpiSvono.dat"
C:\ProgramData\EwpiSvono
Reboot:
       
*****************

HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\1692209207 => value deleted successfully.
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\Software\Microsoft\Windows\CurrentVersion\Run\\EwpiSvono => value deleted successfully.
C:\ProgramData\EwpiSvono => Moved successfully.


The system needed a reboot.

==== End of Fixlog ====
so?

deeprybka 25.06.2014 23:55
Sehr gut gemacht...Gleich weiter mit den nächsten Schritten... ;)

Trainie4 25.06.2014 23:56
nach dem Neustart kam wieder eine Meldung mit den Gruppenrichtlinien ,_,

deeprybka 25.06.2014 23:57
Mach bitte trotzdem mit den anderen Schritten weiter...

Trainie4 26.06.2014 00:39
Code:
# AdwCleaner v3.213 - Bericht erstellt am 26/06/2014 um 00:58:09
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzername : admin - ADMIN-PC
# Gestartet von : C:\Users\admin\Downloads\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nikpibnbobmbdbheedjfogjlikpgpnhp

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\prefs.js ]


-\\ Google Chrome v

[ Datei : C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [46064 octets] - [26/06/2014 00:30:27]
AdwCleaner[R1].txt - [1167 octets] - [26/06/2014 00:56:43]
AdwCleaner[S0].txt - [45808 octets] - [26/06/2014 00:31:15]
AdwCleaner[S1].txt - [1089 octets] - [26/06/2014 00:58:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1149 octets] ##########
Code:
Malwarebytes Anti-Malware
www.malwarebytes.org

Suchlauf Datum: 26.06.2014
Suchlauf-Zeit: 01:02:58
Logdatei:
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.25.18
Rootkit Datenbank: v2014.06.23.02
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x86
Dateisystem: NTFS
Benutzer: admin

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 267150
Verstrichene Zeit: 15 Min, 44 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(No malicious items detected)

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 1
PUP.Optional.SupTab.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{3593C8B9-8E18-4B4B-B7D3-CB8BEB1AA42C}, In Quarantäne, [12d8fe7d700b171f9568dc6d887abc44],

Registrierungswerte: 1
Trojan.Ransom.Gen, HKU\S-1-5-21-2742928999-3257237434-1072491205-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|EwpiSvono, regsvr32.exe "C:\ProgramData\EwpiSvono\EwpiSvono.dat", Löschen bei Neustart, [5d8d9edde5960a2c8a36f3110bf98c74]

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 0
(No malicious items detected)

Dateien: 5
PUP.Optional.Somoto.A, C:\Users\admin\Downloads\7ZipSetup.exe, In Quarantäne, [d8121665146755e1998581b7817feb15],
PUP.Optional.Koyote.A, C:\Users\admin\Downloads\FreeVideoConverterSetup-r135-n-bf.exe, In Quarantäne, [e70326552b506cca4eb47dc8bc45837d],
PUP.Optional.DomaIQ, C:\Users\admin\Downloads\Player_Setup.exe, In Quarantäne, [5d8dc4b78af11026572bc57d4eb2e51b],
PUP.Optional.NewTab.A, C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_bakijjialdiiboeaknfpmflphhmljfkd_0.localstorage, In Quarantäne, [d812eb90a1da41f5b122eb17eb191fe1],
Trojan.Ransom.Gen, C:\ProgramData\EwpiSvono\EwpiSvono.dat, In Quarantäne, [5d8d9edde5960a2c8a36f3110bf98c74],

Physische Sektoren: 0
(No malicious items detected)


(end)
Code:

       
Code:

       
HitmanPro 3.7.9.219
www.hitmanpro.com

   Computer name . . . . : ADMIN-PC
   Windows . . . . . . . : 6.1.1.7601.X86/4
   User name . . . . . . : admin-PC\admin
   UAC . . . . . . . . . : Disabled
   License . . . . . . . : Free

   Scan date . . . . . . : 2014-06-26 01:28:48
   Scan mode . . . . . . : Normal
   Scan duration . . . . : 4m 28s
   Disk access mode  . . : Direct disk access (SRB)
   Cloud . . . . . . . . : Internet
   Reboot  . . . . . . . : No

   Threats . . . . . . . : 0
   Traces  . . . . . . . : 403

   Objects scanned . . . : 1.461.227
   Files scanned . . . . : 28.474
   Remnants scanned  . . : 494.078 files / 938.675 keys

Suspicious files ____________________________________________________________

   C:\Users\admin\Downloads\FRST.exe
      Size . . . . . . . : 1.073.152 bytes
      Age  . . . . . . . : 0.1 days (2014-06-25 23:18:07)
      Entropy  . . . . . : 8.0
      SHA-256  . . . . . : 4719D377C2C6FA3E8D8944E877997E664508FFF75BE40A84A57E221B7D5F832D
      Needs elevation  . : Yes
      Fuzzy  . . . . . . : 24.0
         Program has no publisher information but prompts the user for permission elevation.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Authors name is missing in version info. This is not common to most programs.
         Version control is missing. This file is probably created by an individual. This is not typical for most programs.
         Time indicates that the file appeared recently on this computer.
      Forensic Cluster
          0.0s C:\Users\admin\Downloads\FRST.exe
         23.8s C:\FRST\Logs\
         23.8s C:\FRST\
         23.8s C:\FRST\Hives\
         23.8s C:\FRST\Quarantine\
         24.2s C:\FRST\Hives\ERDNT.INF
         24.2s C:\FRST\Hives\ERDNT.CON
         24.2s C:\FRST\Hives\BCD
         24.2s C:\FRST\Hives\system
         24.5s C:\FRST\Hives\software
         25.4s C:\FRST\Hives\default
         25.4s C:\FRST\Hives\security
         25.4s C:\FRST\Hives\sam
         25.5s C:\FRST\Hives\Users\
         25.5s C:\FRST\Hives\Users\00000001\
         25.5s C:\FRST\Hives\Users\00000001\ntuser.dat
         25.6s C:\FRST\Hives\Users\00000002\
         25.6s C:\FRST\Hives\Users\00000002\UsrClass.dat
         25.6s C:\FRST\Hives\Users\00000002\UsrClass.dat
         25.7s C:\FRST\Hives\ERDNT.EXE
         25.7s C:\FRST\Hives\ERDNT.EXE
         25.7s C:\FRST\Hives\ERDNTWIN.LOC
         25.7s C:\FRST\Hives\ERDNTDOS.LOC
         25.7s C:\FRST\Hives\ERDNTDOS.LOC
         25.7s C:\FRST\Hives\ERDNTDOS.LOC
         26.9s C:\Users\admin\Downloads\FRST.txt

   C:\Windows\system32\GameMon.des
      Size . . . . . . . : 3.975.544 bytes
      Age  . . . . . . . : 300.5 days (2013-08-29 12:39:04)
      Entropy  . . . . . : 7.9
      SHA-256  . . . . . : 750001935A5C5541C47A5F5C7A57228CB663DFA35A4E50BD7D368F36A732660C
      Product  . . . . . : nProtect Game Monitor
      Publisher  . . . . : INCA Internet Co., Ltd.
      Description  . . . : nProtect Game Monitor Rev 1865
      Version  . . . . . : 2012.5.3.1
      Service  . . . . . : npggsvc
      LanguageID . . . . : 1042
      Fuzzy  . . . . . . : 36.0
         The file name extension of this program is not common.
         Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
         Starts automatically as a service during system bootup.
         The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\npggsvc\


Potential Unwanted Programs _________________________________________________

   C:\Program Files\AskPartnerNetwork\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe (AskBar)
      Size . . . . . . . : 166.352 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:47)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : C3081358313A982F53CAD54C214AFECAD9660A59FB4A3DDFE068724E83041AF8
      Product  . . . . . : APN Updater
      Publisher  . . . . : APN LLC.
      Description  . . . : APN Updater
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      Service  . . . . . : APNMCP
      LanguageID . . . . : 1033
      Fuzzy  . . . . . . : -9.0
      Startup
         HKLM\SYSTEM\CurrentControlSet\Services\APNMCP\

   C:\Program Files\AskPartnerNetwork\Toolbar\APNSetup.exe (AskBar)
      Size . . . . . . . : 489.392 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : C17717A1D8DF84341DE4C98611F5B9B059B4819BCECA15E1A1B7B882A34F3354
      Product  . . . . . : Stub Installer
      Publisher  . . . . : Ask Partner Network
      Description  . . . : Stub Installer
      Version  . . . . . : 7.2.1.1
      Copyright  . . . . : Copyright © 2013 Ask Partner Network.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (AskBar)
      Size . . . . . . . : 12.240 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:25)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : 26DD353E636B8ABE2739CEB97A04220F1964E8951C93386D5CFAACE823874898
      Product  . . . . . : Passport
      Publisher  . . . . : APN LLC.
      Description  . . . : Passport
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0
      Startup
         HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{41564952-412D-5637-00A7-7A786E7484D7}
         HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{41564952-412D-5637-00A7-7A786E7484D7}\
      References
         HKLM\SOFTWARE\Classes\CLSID\{41564952-412D-5637-00A7-7A786E7484D7}\
         HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{41564952-412D-5637-00A7-7A786E7484D7}\

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1031.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1033.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1034.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1036.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1040.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1041.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1043.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1045.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\1049.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\2070.mst (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\appdata\Mozilla\Firefox\Profiles\{DefaultProfilesFolder}\extensions\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\appdata\Mozilla\Firefox\Profiles\{DefaultProfilesFolder}\extensions\toolbar_AVIRA-V7@apn.ask.com.xpi (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.10.0_AVIRA-V7.msi (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.10.3_AVIRA-V7.msi (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.2.2_AVIRA-V7.msi (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.6.0_AVIRA-V7.msi (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\ToolbarCR.crx (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\Update.xml (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\{Crx_Version}\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\common appdata\AskPartnerNetwork\Toolbar\{PartnerID}\CRX\{Crx_Version}\Toolbar.crx (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\apnmcp.exe (AskBar)
      Size . . . . . . . : 166.352 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : C3081358313A982F53CAD54C214AFECAD9660A59FB4A3DDFE068724E83041AF8
      Product  . . . . . : APN Updater
      Publisher  . . . . : APN LLC.
      Description  . . . : APN Updater
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\searchhook.dll (AskBar)
      Size . . . . . . . : 74.704 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.3
      SHA-256  . . . . . : E1853B5640881511544A9B6C9F2227BD639B279B281A8612746BE07040E3B013
      Product  . . . . . : Search Hook
      Publisher  . . . . : APN LLC.
      Description  . . . : Search Hook
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ServiceLocator.exe (AskBar)
      Size . . . . . . . : 115.664 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 4B919C48DD074B802488864BB266E2B1D980A1E73C3FFAE36FEE79874E884FDC
      Product  . . . . . : Service Locator
      Publisher  . . . . : APN LLC.
      Description  . . . : Service Locator
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\SO.dll (AskBar)
      Size . . . . . . . : 428.496 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.5
      SHA-256  . . . . . : 9D34E70B5CA1DE2D4FDD8DD0AB5987A60EC620D2DFEDE7F89443FFFFDBF6A60A
      Product  . . . . . : Object Model
      Publisher  . . . . : APN LLC.
      Description  . . . : Object Model
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar.dll (AskBar)
      Size . . . . . . . : 204.752 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : C7BC280CA198B10252BBE8EB1DB0A78AB8CB5DC7C6BAD1497690D141221CFBE0
      Product  . . . . . : Toolbar
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Toolbar.exe (AskBar)
      Size . . . . . . . : 366.032 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 5.7
      SHA-256  . . . . . : BE6CA90E00B1F2D7C8A9D86D8FC9AB92F124D1D59D0A94F3BEA8552D15DDDD9A
      Product  . . . . . : Toolbar Core
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar Core
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar_x64.dll (AskBar)
      Size . . . . . . . : 249.808 bytes
      Age  . . . . . . . : 244.5 days (2013-10-24 12:32:22)
      Entropy  . . . . . : 6.1
      SHA-256  . . . . . : B971FFE3A9662BEACF7B4DC2B397A8C674C75F22115AE85DD850FBB73A35BCB1
      Product  . . . . . : Toolbar
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ToolbarPS.dll (AskBar)
      Size . . . . . . . : 45.520 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.1
      SHA-256  . . . . . : 137538E3C6CD7044B24B9A2428DD5E0B3949CAD6808E1CDC4E6A24AECE8265B2
      Product  . . . . . : Toolbar PS
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar PS
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\UpdateManager.exe (AskBar)
      Size . . . . . . . : 114.128 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : DCB7FE544B967787BB1515F9CD344688B9234D188BC50DAE5C966BBD9D5E8836
      Product  . . . . . : Update Manager
      Publisher  . . . . : APN LLC.
      Description  . . . : Update Manager
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\ask-search.xml (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (AskBar)
      Size . . . . . . . : 1.758.160 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 5C557182618218B2A66408BA89438E154B3236D0F0EED2D64C3CD65C68129700
      Product  . . . . . : Ask TBNotifier
      Publisher  . . . . : APN
      Description  . . . : Ask Toolbar Notifier
      Version  . . . . . : 31.6.3.286
      Copyright  . . . . : (c) Ask.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\{PartnerID}\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Updater\{PartnerID}\config.xml (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport.dll (AskBar)
      Size . . . . . . . : 12.240 bytes
      Age  . . . . . . . : 305.5 days (2013-08-24 12:17:33)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : 26DD353E636B8ABE2739CEB97A04220F1964E8951C93386D5CFAACE823874898
      Product  . . . . . : Passport
      Publisher  . . . . : APN LLC.
      Description  . . . : Passport
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport_x64.dll (AskBar)
      Size . . . . . . . : 13.776 bytes
      Age  . . . . . . . : 244.5 days (2013-10-24 12:32:22)
      Entropy  . . . . . : 6.0
      SHA-256  . . . . . : 5C86C854487467F74A8A86C9F268EF8898AAA1B48D43026CECD49740CD3D4CCD
      Product  . . . . . : Passport
      Publisher  . . . . : APN LLC.
      Description  . . . : Passport
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\VNT\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\VNT\content.zip (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\VNT\vntldr.exe (AskBar)
      Size . . . . . . . : 195.536 bytes
      Age  . . . . . . . : 187.1 days (2013-12-20 23:09:45)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : FA80FC08B390340C6056748D58ACDDD0A949F3D9218A9282B67F7CA9EADC36D5
      Product  . . . . . : Virtual New Tab
      Publisher  . . . . : APN LLC.
      Description  . . . : Virtual New Tab Loader
      Version  . . . . . : 1.2.0.3294
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -15.0

   C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\VNT\vntsrv.dll (AskBar)
      Size . . . . . . . : 92.672 bytes
      Age  . . . . . . . : 187.1 days (2013-12-20 23:09:45)
      Entropy  . . . . . : 6.2
      SHA-256  . . . . . : 1A545675F7C8937A31CB3F7512E253660E3ADA637160E549F21595F7A0893B97
      Product  . . . . . : Virtual New Tab
      Publisher  . . . . : APN LLC.
      Description  . . . : Virtual New Tab Server
      Version  . . . . . : 1.2.0.3294
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      LanguageID . . . . : 1033
      Fuzzy  . . . . . . : -8.0

   C:\Program Files\AskPartnerNetwork\Toolbar\searchhook.dll (AskBar)
      Size . . . . . . . : 74.704 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:25)
      Entropy  . . . . . : 6.3
      SHA-256  . . . . . : E1853B5640881511544A9B6C9F2227BD639B279B281A8612746BE07040E3B013
      Product  . . . . . : Search Hook
      Publisher  . . . . : APN LLC.
      Description  . . . : Search Hook
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -19.0

   C:\Program Files\AskPartnerNetwork\Toolbar\ServiceLocator.exe (AskBar)
      Size . . . . . . . : 115.664 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:25)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 4B919C48DD074B802488864BB266E2B1D980A1E73C3FFAE36FEE79874E884FDC
      Product  . . . . . : Service Locator
      Publisher  . . . . : APN LLC.
      Description  . . . : Service Locator
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -19.0

   C:\Program Files\AskPartnerNetwork\Toolbar\SO.dll (AskBar)
      Size . . . . . . . : 428.496 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:47)
      Entropy  . . . . . : 6.5
      SHA-256  . . . . . : 9D34E70B5CA1DE2D4FDD8DD0AB5987A60EC620D2DFEDE7F89443FFFFDBF6A60A
      Product  . . . . . : Object Model
      Publisher  . . . . : APN LLC.
      Description  . . . : Object Model
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -19.0

   C:\Program Files\AskPartnerNetwork\Toolbar\toolbar.dll (AskBar)
      Size . . . . . . . : 204.752 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:47)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : C7BC280CA198B10252BBE8EB1DB0A78AB8CB5DC7C6BAD1497690D141221CFBE0
      Product  . . . . . : Toolbar
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -19.0

   C:\Program Files\AskPartnerNetwork\Toolbar\Toolbar.exe (AskBar)
      Size . . . . . . . : 366.032 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:25)
      Entropy  . . . . . : 5.7
      SHA-256  . . . . . : BE6CA90E00B1F2D7C8A9D86D8FC9AB92F124D1D59D0A94F3BEA8552D15DDDD9A
      Product  . . . . . : Toolbar Core
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar Core
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -19.0

   C:\Program Files\AskPartnerNetwork\Toolbar\ToolbarPS.dll (AskBar)
      Size . . . . . . . : 45.520 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:25)
      Entropy  . . . . . : 6.1
      SHA-256  . . . . . : 137538E3C6CD7044B24B9A2428DD5E0B3949CAD6808E1CDC4E6A24AECE8265B2
      Product  . . . . . : Toolbar PS
      Publisher  . . . . : APN LLC.
      Description  . . . : Toolbar PS
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      RSA Key Size . . . : 2048
      LanguageID . . . . : 1033
      Authenticode . . . : Valid
      Fuzzy  . . . . . . : -19.0

   C:\Program Files\AskPartnerNetwork\Toolbar\UpdateManager.exe (AskBar)
      Size . . . . . . . : 114.128 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:47)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : DCB7FE544B967787BB1515F9CD344688B9234D188BC50DAE5C966BBD9D5E8836
      Product  . . . . . : Update Manager
      Publisher  . . . . : APN LLC.
      Description  . . . : Update Manager
      Version  . . . . . : 21.5.0.2560
      Copyright  . . . . : (c) APN LLC.  All rights reserved.
      LanguageID . . . . : 1033
      Fuzzy  . . . . . . : -12.0

   C:\Program Files\AskPartnerNetwork\Toolbar\Updater\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\Updater\ask-search.xml (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\Updater\AVIRA-V7\ (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\Updater\AVIRA-V7\config.xml (AskBar)
   C:\Program Files\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe (AskBar)
      Size . . . . . . . : 1.758.160 bytes
      Age  . . . . . . . : 132.8 days (2014-02-13 07:22:26)
      Entropy  . . . . . : 6.4
      SHA-256  . . . . . : 5C557182618218B2A66408BA89438E154B3236D0F0EED2D64C3CD65C68129700
      Product  . . . . . : Ask TBNotifier
      Publisher  . . . . : APN
      Description  . . . : Ask Toolbar Notifier
      Version  . . . . . : 31.6.3.286
      Copyright  . . . . : (c) Ask.  All rights reserved.
      LanguageID . . . . : 1033
      Fuzzy  . . . . . . : -12.0

   C:\ProgramData\APN\ (AskBar)
   C:\ProgramData\AskPartnerNetwork\ (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\32.10\ (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\32.10\Toolbar.crx (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Config\ (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Config\Config.31.1.0.0-3.xml (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Config\Config.31.4.1.0-3.xml (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Config\Config.31.4.1.0-4.xml (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Config\Config.31.6.0.0-4.xml (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Config\Config.31.6.3.0-4.xml (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Response\ (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Response\Response.31.6.3.0-62.xml (AskBar)
   C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\Updater\Response\Response.31.6.3.0-63.xml (AskBar)
   HKLM\SOFTWARE\AskPartnerNetwork\ (AskBar)
   HKLM\SOFTWARE\Classes\CLSID\{44CBC005-6243-4502-8A02-3A096A282664}\ (AskBar)
   HKLM\SOFTWARE\Classes\CLSID\{80703783-E415-4EE3-AB60-D36981C5A6F1}\ (AskBar)
   HKLM\SOFTWARE\Classes\CLSID\{D8278076-BC68-4484-9233-6E7F1628B56C}\ (AskBar)
   HKLM\SOFTWARE\Classes\CLSID\{F297534D-7B06-459D-BC19-2DD8EF69297B}\ (AskBar)
   HKLM\SOFTWARE\Classes\Installer\UpgradeCodes\7AB5857A57A0687786597A857BFFFFFF\ (AskBar)
   HKLM\SOFTWARE\Classes\Interface\{80703783-E415-4EE3-AB60-D36981C5A6F1}\ (AskBar)
   HKLM\SOFTWARE\Classes\Interface\{BD125908-5F10-409F-9C01-F2207CA18887}\ (AskBar)
   HKLM\SOFTWARE\Classes\TypeLib\{9945959C-AAD8-4312-8B57-2DE11927E770}\ (AskBar)
   HKLM\SOFTWARE\Classes\TypeLib\{EEA63863-87BC-4DCA-A5B5-EB97E3B04806}\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6978F29A-3493-40B2-8CDC-9C13A02F85A4}\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D7949A66-D936-4028-9552-14F7DC50F38D}\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06B42F08F6F40FA4F83EA94EF9F03F63\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\06FCEE940712E4B4C8A7362CD8D249A1\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\085CE460BADC1D14EA94D8A62E517577\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0B2690283E07C9B4085B3B794202E7F7\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\12D3738E79C70C74E9D808E162BD6691\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\158D6D9E3FE81fa428925F22ACB3A965\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\15E6C514FEFC09f45BAFAAE1D7546ED4\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\189F6D048E923EA48B11D15B30CDAC81\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1DB42320A8525634AA089F0BEC86473B\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F0968491626AD249A2A6CBAC4DE352D\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22468B0D6050b2e46B9C4B67A8F59577\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2251BF05A2F606d43BB064BD63CBD87E\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\22A78C977EC431247B2ECECC374DFE13\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2CAC1D959B4188B4F8E8C251A25DA9DB\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3255D95681398614190EDF0A4F3F77DB\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\33990057697C62f47BB9FFD59CB4AEEB\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\3CDF313E9B28c944FBC7579CF4949414\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41BF64DDE5C2457478691CB0675759BA\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\42F5B13BF4BAD8D409578286A354E360\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4374E71C5355C4B4AACC93BBBF40E99F\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4410C9B6FF0094C418865CD2B243B258\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\45B0A4620F799834C82DE0BD4E90E40B\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4859A93046C917F408248F3C16F75E77\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A3D29BA507550f4F87F6F33D42B24D6\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4E28C30B25E21BF4C9418857AEB2AF7C\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\50390A9E27AD04A4698BF297EF564973\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5D5D3B13CCBA08C479F107E50BD81C8A\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\65655A3C1C3738748BE6470495D534FC\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\661134B612233374391C95E8AC373BA3\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\71E54748EDD3dc1468548785DC856EDA\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\734F787B99D52824EAB6CA1A89F801F7\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\73A172B6C18A3594A9FA363311A187A3\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\754590DD06DE8d249B526503432F99D4\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7A0CF0C6A9F9B8642A392A1896DCCCF2\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7CE43E6BAE0DC0B43883C669D8DCE8B1\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7D7860B78D7B6F64887AFCB83061837A\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7EC46CC5C43127A45A99762BF7A9C9E5\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7FFDE7BEC9977ac46B41B0A2BF7D88CD\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8011A895DAAC4CC45AF1397E3CE9CA16\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8036C72171EF4ba46856BF57969F6A36\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\81EE804DA9066C64A859E01A38075C59\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\879DDA62492E58A40898AD146BBB572E\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\88761D7BAC02ccc428CD5EF352BB933C\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\89BB7852687BDC34B9A81E01C7FF9173\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CB53AD495D2C5443B95C9EE29E47902\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CBC85D72B148084ABE8C2F072F781F4\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CC5A38A64D6098468BC8395BA0EFF03\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8DF9A1AC557F56c49B56F6B83E293C15\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8F85A4D374D5bf245B8722C062C2D00E\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9516FC331A505934FA76C22DCFFEC47E\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\98B242210207F2D48AF879D69C381D08\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A08449608E3Ca1f4ABF236256A256754\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A431C8F3F57D7844B89242F5F7A5F62C\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A66E2D84F93A9E94FBA6AB3524D85958\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A97C590397DCC454AA8923563BAB10E4\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AA27FE018F87f5e4F97F31C09E7C5370\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AC049320EE27170499EC0B6124142ED7\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B448F401EF39C8346BF7BE9B8D1C7060\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5211271DD585A740AA28576B137D09D\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B58469E2C54833741B90BAD9CE5A1159\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B6DA77032731EEE40B463A325128D613\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCC2BCA248E19F74F9AEDE4D1EFEFBC9\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C6A54B56C58C82a4688AFB93F42EA17B\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C70C6F53DEE245249956FC291D801A71\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C7C0052DD04CBC84C81C0AC586485E50\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C879DCC3D00BE8E4282F02F1735E78DF\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\C9FBD8E8A2691564FA012512BCC3748C\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB3AEBFFA9E907145906294AB669B1F2\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE142BFA81B72674892EB318BD603CB0\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CE90A73A5D5A01a43A2EDCCF04BA9487\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CFA51B44D54927c4E9B7BC1D3FD1E49F\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D03E28F842DF79F4DA05A3B6B86B095C\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D05B2B3F5629f9d41A7E57FB534168CA\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D14A7F65792054F418578C78367D13F7\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D158B0E5D051EA046B8E08BF6B004842\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D45A81F48EF19334EABB33FF8871C4F5\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D538E650623CB2C43AD5FBF587227D55\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D8D06C15BF8AFCD449EFF90B935AEF7C\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DB1AE396B3BBfe940922C55C6EEF740A\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DDF3C3F412F4F954F9F2723C62C65C25\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DDF89DEE0C7E9A5448382117C4436818\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DFE9F0BD163D827438CB6AD6B100EC48\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E55AA93871A0fde4490A708053AC6501\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E954A03F45EC92B419A55A0D4815C0A3\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E97C12D46BF588241856422D760336B4\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EA1332016439DD54C840C7D45CFB2705\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EFBB6B0872B0DBB4D912A0F52986399D\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F739A19A8327dc64C9A8B641A9E89646\ (AskBar)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{58124A0B-DC32-4180-9BFF-E0E21AE34026} (Iminent)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{977AE9CC-AF83-45E8-9E03-E2798216E2D5} (Iminent)
   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (Iminent)
   HKLM\SYSTEM\ControlSet001\services\APNMCP\ (AskBar)
   HKLM\SYSTEM\ControlSet001\services\eventlog\Application\Wpm\ (FTDownloader)
   HKLM\SYSTEM\ControlSet002\services\APNMCP\ (AskBar)
   HKLM\SYSTEM\ControlSet002\services\eventlog\Application\Wpm\ (FTDownloader)
   HKLM\SYSTEM\CurrentControlSet\services\APNMCP\ (AskBar)
   HKLM\SYSTEM\CurrentControlSet\services\eventlog\Application\Wpm\ (FTDownloader)
   HKU\.DEFAULT\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\ (FLV Player)
   HKU\.DEFAULT\Software\AskPartnerNetwork\ (AskBar)
   HKU\S-1-5-18\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}\ (FLV Player)
   HKU\S-1-5-18\Software\AskPartnerNetwork\ (AskBar)
   HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\Software\AskPartnerNetwork\ (AskBar)
   HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\Software\Microsoft\Internet Explorer\SearchScopes\{E7DFEC4F-1E56-43FC-879E-21F642BE1D8A}\ (Conduit)

Cookies _____________________________________________________________________

   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.360yield.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.ad-srv.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.adnet.biz
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.adnet.de
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.auditude.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.dyntracker.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.dyntracker.de
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.movad.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.propellerads.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.yieldmanager.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ad.zanox.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.ad4game.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adk2.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adnet.de
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.adplxmd.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.brandwire.tv
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.creative-serving.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.escinteractive.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.p161.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.pubmatic.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.stickyadstv.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.undertone.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.visionads.de
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ads.yahoo.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtech.de
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:adtechus.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:advertising.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:apmebf.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:at.atwola.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:atdmt.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:bs.serving-sys.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:burstnet.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:c.atdmt.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:casalemedia.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:doubleclick.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:eas.apm.emediate.eu
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ero-advertising.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:exoclick.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:fastclick.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:h.atdmt.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:invitemedia.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:media6degrees.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:mediaplex.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:revsci.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:ru4.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:serving-sys.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:smartadserver.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:statcounter.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:statse.webtrendslive.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adcocktail.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:track.adform.net
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:tradedoubler.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:tribalfusion.com
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:www.etracker.de
   C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Cookies:xiti.com
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\044XISL6.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\0KIVSHPM.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\0TM9BAQY.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\142S3JIV.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\2OEV5NBZ.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\3E77CD1P.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\3SHSZ7D8.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\41ILTE8G.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\4OQCJMMW.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\4OSZP0H9.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\6MS75D7O.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\6YGVBD3K.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\95SGKL2Y.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\97312X5H.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\A32ISDRB.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\A6FE57HA.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\admin@revsci[1].txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\AU7B3YML.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\BS3PEAIW.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\E879FF72.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\FLUZBXDH.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\FZPTDADZ.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\HZ6C55YP.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\I9091CQV.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\KFXBPB90.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\KVPYRDZ5.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\NP6HKQ46.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\NXZL2PSA.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PC01NG8B.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PFUPDZ4T.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PFZAUIVG.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\PGLT0K74.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\QH7OPS1K.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\RNZT1AXG.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\RPWXXAGI.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\RS6HIV5V.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SDS190NE.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\SX7GFR00.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\TCM03PCQ.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\URLUQYLB.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\W1SLUIR3.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\WISO3VFL.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\WV5RN6JD.txt
   C:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Y53353UD.txt
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:247realmedia.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad-emea.doubleclick.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.360yield.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.ad-srv.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.adc-serv.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.adnet.biz
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.adnet.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.adserver01.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.afy11.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.auditude.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.doubleclick.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.dyntracker.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.dyntracker.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.movad.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.reklamport.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.wingads.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.yieldmanager.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.yieldpartners.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ad.zanox.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.ad4game.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.adjet.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.adk2.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.adnet.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.adplxmd.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.adsrig.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.creative-serving.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.dmolmn.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.escinteractive.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.glispa.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.gltrkk.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.lzjl.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.mediade.sk
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.p161.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.pointroll.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.pubmatic.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.smartstream.tv
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.stickyadstv.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.tunein.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ads.yahoo.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adserver.adtech.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adserver.hatcolorsoft.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adserver.wz-media.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adserving.unibet.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adservnow.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adtech.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:adtechus.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:advertising.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:aok.122.2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:at.atwola.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:atdmt.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:audible.112.2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:bs.serving-sys.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:burstnet.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:casalemedia.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:chitika.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:collective-media.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:content.yieldmanager.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:de.sitestat.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:doubleclick.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:eas.apm.emediate.eu
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:emjcd.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:engine.pgmediaserve.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ero-advertising.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:exoclick.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:fastclick.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:googleadservices.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ikea.122.2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:img-cdn.mediaplex.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:img.mediaplex.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:in.getclicky.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:interclick.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:livejasmin.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:media6degrees.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:mediaplex.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:mm.chitika.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:msnportal.112.2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:myroitracking.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:partypoker.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:pornme.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:premiumtv.122.2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:questionmarket.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:revsci.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ru4.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:secure.img-cdn.mediaplex.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:server.cpmstar.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:serving-sys.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:sexad.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:smartadserver.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:specificclick.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:stat.dealtime.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:statcounter.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:statse.webtrendslive.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:stepstone.112.2o7.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:track.adform.net
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:track.effiliation.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:track.mdsmatch.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:track.tnm.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:track.webtrekk.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:tradedoubler.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:tribalfusion.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:uk.at.atwola.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:weborama.fr
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:ww251.smartadserver.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:www.etracker.de
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:www.googleadservices.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:xiti.com
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:yadro.ru
   C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\cookies.sqlite:zedo.com

sooo...hoffe hab alles richtig gemacht :D

deeprybka 26.06.2014 00:39
Hi, wurde der PC nach dem Suchlauf von MBAM schon neu gestartet? Wenn nicht, bitte neu starten. Anschließend

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, und drücke auf Scan.
Bitte poste mir den Inhalt des Logs.

Trainie4 26.06.2014 00:46

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-06-2014
Ran by admin (administrator) on ADMIN-PC on 26-06-2014 01:44:33
Running from C:\Users\admin\Downloads
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(Sony) C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
() C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1706096 2010-10-27] (VIA)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-18] (Microsoft Corporation)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Sony PC Companion] => C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe [466656 2014-05-23] (Sony)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21446272 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x69F67AF84008CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=BDCF6DAE-E76B-45DD-A68C-D329956164D9&apn_sauid=72DB5C68-BBFE-414A-89E2-DA441947410A
SearchScopes: HKCU - {E7DFEC4F-1E56-43FC-879E-21F642BE1D8A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB05
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default
FF Homepage: hxxp://msn.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\admin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-06-11]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh [2013-09-20]
CHR Extension: (Skype Click to Call) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-03-24]
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20]
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-02-21]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
S4 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]
S3 npggsvc; C:\Windows\system32\GameMon.des [3975544 2012-05-09] (INCA Internet Co., Ltd.) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1740600 2013-08-30] (TuneUp Software)
S2 HPSLPSVC; C:\Users\admin\AppData\Local\Temp\7zS6B90\hpslpsvc32.dll [X]

==================== Drivers (Whitelisted) ====================

R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2006-11-02] (Microsoft Corporation)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-23] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1149552 2010-10-25] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\admin\AppData\Local\Temp\catchme.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 01:34 - 2014-06-26 01:34 - 00121222 _____ () C:\Users\admin\Downloads\HitmanPro_20140626_0134.log
2014-06-26 01:28 - 2014-06-26 01:34 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-26 01:28 - 2014-06-26 01:28 - 10274632 _____ (SurfRight B.V.) C:\Users\admin\Downloads\HitmanPro.exe
2014-06-26 01:01 - 2014-06-26 01:24 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-26 01:01 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-26 01:01 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-26 01:01 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-26 01:00 - 2014-06-26 01:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-26 00:49 - 2014-06-26 01:21 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-26 00:30 - 2014-06-26 00:58 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-26 00:29 - 2014-06-26 00:29 - 01342659 _____ () C:\Users\admin\Downloads\adwcleaner_3.213.exe
2014-06-26 00:22 - 2014-06-26 00:22 - 00015850 _____ () C:\ComboFix.txt
2014-06-25 23:58 - 2014-06-26 00:22 - 00000000 ____D () C:\Qoobox
2014-06-25 23:58 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-25 23:58 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-25 23:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-25 23:57 - 2014-06-26 00:20 - 00000000 ____D () C:\Windows\erdnt
2014-06-25 23:57 - 2014-06-25 23:57 - 05211571 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-25 23:41 - 2014-06-25 23:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{186F2A27-6EF0-4FF8-9017-830AF6D5FE66}
2014-06-25 23:20 - 2014-06-25 23:20 - 00031594 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-25 23:18 - 2014-06-26 01:44 - 00016799 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-25 23:18 - 2014-06-26 01:44 - 00000000 ____D () C:\FRST
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 22:43 - 2014-06-25 22:44 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:14 - 2014-06-25 22:20 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 11:40 - 2014-06-25 11:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:07 - 2014-06-25 17:09 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-23 20:48 - 2014-06-24 00:08 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 11:44 - 2014-06-22 23:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:49 - 2014-06-16 11:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:20 - 2014-06-23 20:49 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-13 19:07 - 2014-06-17 20:50 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-13 19:07 - 2014-06-13 19:08 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:43 - 2014-06-13 15:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 12:18 - 2014-06-12 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-11 18:58 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 18:58 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 18:58 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 18:58 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 18:58 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 18:58 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 18:58 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 18:58 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 18:58 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 18:58 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 18:58 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 18:58 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 18:58 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 18:58 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 18:58 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 18:58 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 18:58 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 18:58 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 18:58 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 18:58 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 18:58 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 18:58 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 18:58 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 18:58 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 18:58 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 18:58 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 18:58 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 18:58 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 18:57 - 2014-05-08 11:06 - 00919040 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 18:57 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 18:57 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 18:57 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 18:57 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 18:57 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 11:22 - 2014-06-10 23:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:24 - 2014-06-09 20:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:24 - 2014-06-09 00:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:32 - 2014-06-07 20:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:17 - 2014-06-05 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-03 12:14 - 2014-06-04 00:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:12 - 2014-06-02 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 11:52 - 2014-06-01 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-05-31 23:54 - 2014-05-31 23:55 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-05-31 23:52 - 2014-06-01 00:04 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-30 12:50 - 2014-05-31 00:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-29 12:48 - 2014-05-30 00:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:40 - 2014-06-04 20:38 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-05-28 20:20 - 2014-05-28 20:21 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:19 - 2014-05-28 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}
2014-05-27 12:18 - 2014-05-27 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{248FC10F-4936-4B0B-9DBE-FF1E957DD692}

==================== One Month Modified Files and Folders =======

2014-06-26 01:45 - 2014-06-25 23:18 - 00016799 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-26 01:44 - 2014-06-25 23:18 - 00000000 ____D () C:\FRST
2014-06-26 01:43 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 01:43 - 2009-07-14 06:39 - 00092941 _____ () C:\Windows\setupact.log
2014-06-26 01:42 - 2012-03-10 17:35 - 00627532 _____ () C:\Windows\PFRO.log
2014-06-26 01:42 - 2012-03-09 20:29 - 01943143 _____ () C:\Windows\WindowsUpdate.log
2014-06-26 01:34 - 2014-06-26 01:34 - 00121222 _____ () C:\Users\admin\Downloads\HitmanPro_20140626_0134.log
2014-06-26 01:34 - 2014-06-26 01:28 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-26 01:28 - 2014-06-26 01:28 - 10274632 _____ (SurfRight B.V.) C:\Users\admin\Downloads\HitmanPro.exe
2014-06-26 01:28 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 01:28 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 01:27 - 2012-03-09 20:53 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-26 01:24 - 2014-06-26 01:01 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 01:21 - 2014-06-26 00:49 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-26 01:21 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32
2014-06-26 01:07 - 2012-04-10 22:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-26 01:00 - 2014-06-26 01:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-26 00:58 - 2014-06-26 00:30 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:31 - 2012-03-13 22:38 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-06-26 00:29 - 2014-06-26 00:29 - 01342659 _____ () C:\Users\admin\Downloads\adwcleaner_3.213.exe
2014-06-26 00:22 - 2014-06-26 00:22 - 00015850 _____ () C:\ComboFix.txt
2014-06-26 00:22 - 2014-06-25 23:58 - 00000000 ____D () C:\Qoobox
2014-06-26 00:22 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-26 00:20 - 2014-06-25 23:57 - 00000000 ____D () C:\Windows\erdnt
2014-06-26 00:16 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-06-25 23:59 - 2012-09-08 00:14 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-25 23:57 - 2014-06-25 23:57 - 05211571 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-25 23:41 - 2014-06-25 23:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{186F2A27-6EF0-4FF8-9017-830AF6D5FE66}
2014-06-25 23:20 - 2014-06-25 23:20 - 00031594 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 23:12 - 2012-05-12 13:55 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-25 22:50 - 2012-03-25 22:03 - 00000000 ____D () C:\Users\admin\AppData\Local\CrashDumps
2014-06-25 22:44 - 2014-06-25 22:43 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:32 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-25 22:20 - 2014-06-25 22:14 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 22:18 - 2012-03-09 20:39 - 00000000 ____D () C:\Users\admin
2014-06-25 22:17 - 2012-03-13 22:36 - 00000000 ____D () C:\Users\admin\Desktop\HUONG
2014-06-25 17:09 - 2014-06-24 00:07 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-25 14:12 - 2012-05-12 13:55 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-25 11:41 - 2014-06-25 11:40 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 22:09 - 2012-08-08 13:39 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Skype
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 17:59 - 2012-09-08 00:14 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-24 16:22 - 2012-07-05 23:19 - 00498794 _____ () C:\Windows\DPINST.LOG
2014-06-24 16:22 - 2012-07-05 23:19 - 00001972 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-06-24 16:22 - 2012-07-05 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-06-24 16:22 - 2012-03-10 17:22 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:08 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 20:49 - 2014-06-13 19:20 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-23 20:49 - 2012-09-08 12:57 - 00071680 ____H () C:\Users\admin\Desktop\photothumb.db
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 23:46 - 2014-06-22 11:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:08 - 2012-03-13 19:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 20:50 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:50 - 2014-06-16 11:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 21:02 - 2012-09-08 00:15 - 00002322 _____ () C:\Users\admin\Desktop\Google Chrome.lnk
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:08 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:44 - 2014-06-13 15:43 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 19:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-06-12 12:19 - 2014-06-12 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-12 12:15 - 2012-04-26 19:00 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-12 01:16 - 2013-08-14 23:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 01:15 - 2012-07-07 20:26 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 23:23 - 2014-06-10 11:22 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:25 - 2014-06-09 20:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:25 - 2014-06-09 00:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:33 - 2014-06-07 20:32 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:18 - 2014-06-05 12:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 20:38 - 2014-05-28 20:40 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-06-04 13:40 - 2013-08-24 12:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 13:40 - 2013-08-24 12:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-04 00:16 - 2014-06-03 12:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:13 - 2014-06-02 12:12 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 23:53 - 2014-06-01 11:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-06-01 00:04 - 2014-05-31 23:52 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:55 - 2014-05-31 23:54 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 23:33 - 2012-04-03 18:46 - 00000000 ____D () C:\Users\admin\AppData\Local\Microsoft Games
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-31 00:52 - 2014-05-30 12:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ___RD () C:\Program Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ____D () C:\ProgramData\Skype
2014-05-30 11:18 - 2014-06-11 18:58 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-11 18:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-11 18:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-11 18:58 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-11 18:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-11 18:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 18:58 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-11 18:58 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 18:58 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-11 18:58 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-11 18:58 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-11 18:58 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-11 18:58 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-11 18:58 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-11 18:58 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 18:58 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 18:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-11 18:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 18:58 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-11 18:58 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-11 18:58 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-11 18:58 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 18:58 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 18:58 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-11 18:58 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-11 18:58 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-11 18:58 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-11 18:58 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 00:49 - 2014-05-29 12:48 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:21 - 2014-05-28 20:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:20 - 2014-05-28 00:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}
2014-05-27 12:19 - 2014-05-27 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{248FC10F-4936-4B0B-9DBE-FF1E957DD692}
2014-05-27 00:14 - 2014-05-26 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{93E7D62A-2DDD-4946-AC45-78B125FFAD72}

Some content of TEMP:
====================
C:\Users\admin\AppData\Local\temp\avgnt.exe
C:\Users\admin\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 22:19

==================== End Of Log ============================
--- --- ---

deeprybka 26.06.2014 00:51
Gut... :)
Um die Gruppenrichtlinien kümmern wir uns später...

Jetzt noch das hier. Ein Scan, der sehr lange dauert. ;)

Schritt 1

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Trainie4 26.06.2014 00:53
sehr lange ? haha
können wir morgen Abend damit weiter machen ? Ist für meine Verhältnisse schon spät und muss morgen früh aufstehen..
bis hierhin vielen vielen lieben dank ich fange morgen abend mit dem scan an
Gute Nacht und bis morgen !! :)

deeprybka 26.06.2014 00:57
Na klar reicht das morgen auch noch... ;)

Gute Nacht... :D

Trainie4 26.06.2014 22:05
halloooo bin wieder da :)
Fange jz mit dem scan an

deeprybka 26.06.2014 22:06
Der wird aber heute nicht mehr fertig... :D

Trainie4 26.06.2014 22:24
der scan?? warum :O dauert der etwa so lange?

deeprybka 26.06.2014 22:26
Jup... ;)

Trainie4 26.06.2014 23:25
oh man...

heute wirds wohl wirklich nichts.. morgen bin ich nicht zuhause und samstag auch nicht lang...
also dann wohl sonntag :/
bis dahin ! :)

deeprybka 26.06.2014 23:32
Lass halt über Nacht laufen und poste in der Früh... ;)

Trainie4 26.06.2014 23:33
meinst du es wird bis morgen früh fertig sein?

deeprybka 26.06.2014 23:35
Naja...so mache ich es halt immer mit den PC's die Freunde anschleppen...;)
Und bis morgen früh sollte es fertig sein. Muss ja nicht unbedingt so gemacht werden. Wir richten uns nach den Usern. :)

Trainie4 26.06.2014 23:37
ich versuchs dann maaal :D
sag dir dann morgen Bescheid Naaacht ! :)

deeprybka 26.06.2014 23:38
OK...Gute Nacht! :D

Trainie4 27.06.2014 12:27
der scan ist endlich vorbeeeei haha :D

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=a5a5b5578bcc4948b663d36f4544ae47
# engine=18903
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-27 10:26:02
# local_time=2014-06-27 12:26:02 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 135407 148416940 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 26525696 155495953 0 0
# scanned=127845
# found=49
# cleaned=0
# scan_time=47316
sh=8992F72873D09212597E582A16F8D9BC60E6A22A ft=1 fh=e21391a34e842ffc vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Common Files\DVDVideoSoft\TB\ConduitInstaller.exe.vir"
sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\Conduit\Community Alerts\Alert.dll.vir"
sh=C7C0F42A23562AA6DCCD60326FD8CC2AA41B5448 ft=1 fh=c053642cee9f3def vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\DpInterface32.dll.vir"
sh=9DC13DB9C123270C2356ED410128E11D5ADF7C6E ft=1 fh=023ab782f0a9b07d vn="Win32/Thinknice.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files\SupTab\SupTab.dll.vir"
sh=56659F7FF1F1FA7906A77228E315F65F38BCEF73 ft=1 fh=0ff759dfc352fd03 vn="Variante von Win32/ELEX.AD evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\ProgramData\IePluginServices\PluginService.exe.vir"
sh=FFC8C0F5F61304C9FB8C8AE8F84363FD4B303ECC ft=1 fh=a070018d0efef5d2 vn="Variante von Win32/Conduit.SearchProtect.P evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\10.29.0.520_0\APISupport\APISupport.dll.vir"
sh=FADE4553CF63ABD446132E31C7F927AC9D191F5D ft=1 fh=cfebcaa46fcaed43 vn="Variante von Win32/Toolbar.Conduit.AH evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\10.29.0.520_0\nativeMessaging\TBMessagingHost.exe.vir"
sh=6324A1B6DDC60ED6DBF3FD7D5E0D8ED87A69D1DC ft=1 fh=94b7f1c67327f691 vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\plmlpkfpkijnlijgalnjaacllnjmoamo\10.29.0.520_0\plugins\ChromeApiPlugin.dll.vir"
sh=37824D4B366B35F9C84237C48E66DF9687EEDEC6 ft=1 fh=c570259d3a36278d vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}\Plugins\npConduitFirefoxPlugin.dll.vir"
sh=7B039B89BF4F1052102DC990DE981F298F181B14 ft=1 fh=189b440ac0fdf9bc vn="Win32/PSW.Papras.DC Trojaner" ac=I fn="C:\FRST\Quarantine\C\ProgramData\EwpiSvono\EwpiSvono.dat"
sh=2A88FC6509FDC3B22587F6E97AC12F70E4F75DC8 ft=1 fh=86e0df17c19558fd vn="Variante von Win32/Bundled.Toolbar.Ask.E potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\APNSetup.exe"
sh=408E55A7D2D56C02EF844CA63C1EA8D440D1F8B2 ft=1 fh=cf5f3ba9cab9d1c3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\searchhook.dll"
sh=EC5913DE16698FF281FE1F1108602BD300AFDA91 ft=1 fh=400322602d09beb6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\ServiceLocator.exe"
sh=4E3A9EF57C71B5829AC8CD185CBED27AF6610C13 ft=1 fh=83a0e01ca2b69786 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\SO.dll"
sh=698FB11D2C5D96C744D8602AD22309F10509063A ft=1 fh=c3312308a781a9fa vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\toolbar.dll"
sh=0111559B94F5572B6777EBE3E85CB9F9C94BC85B ft=1 fh=76e883fd9357c7a4 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\Toolbar.exe"
sh=BB237CE0031AFF6ABD4E3626D7C6AE3D6ABEDB5A ft=1 fh=2522929e49563be6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\ToolbarPS.dll"
sh=6CDE6B1DD298CA47510EB79334AE149F60FEFFCE ft=1 fh=0241d1e8e3e9ed03 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll"
sh=F2CFD9E6717ED73F51E976B3957C81DD518C5603 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.10.0_AVIRA-V7.msi"
sh=01EF1A2420765129D2F26E0530725B5F71D8BB96 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.2.2_AVIRA-V7.msi"
sh=F4B0FF4B42F223CF8338684906BCFFAD9AA2710E ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\AskToolbarInstaller-12.6.0_AVIRA-V7.msi"
sh=0AB7E14045C76206A8733C6E4D36220A58C85A77 ft=1 fh=9f671b8e7a289dd3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\apnmcp.exe"
sh=408E55A7D2D56C02EF844CA63C1EA8D440D1F8B2 ft=1 fh=cf5f3ba9cab9d1c3 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\searchhook.dll"
sh=EC5913DE16698FF281FE1F1108602BD300AFDA91 ft=1 fh=400322602d09beb6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ServiceLocator.exe"
sh=4E3A9EF57C71B5829AC8CD185CBED27AF6610C13 ft=1 fh=83a0e01ca2b69786 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\SO.dll"
sh=698FB11D2C5D96C744D8602AD22309F10509063A ft=1 fh=c3312308a781a9fa vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar.dll"
sh=0111559B94F5572B6777EBE3E85CB9F9C94BC85B ft=1 fh=76e883fd9357c7a4 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\Toolbar.exe"
sh=BB237CE0031AFF6ABD4E3626D7C6AE3D6ABEDB5A ft=1 fh=2522929e49563be6 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\ToolbarPS.dll"
sh=9C835C702D070F54C59E36FED31696261FEBFDA3 ft=1 fh=29643e02259e76bc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\toolbar_x64.dll"
sh=B27AA1F8303815E20CE148744957CB3726BCDE96 ft=1 fh=e7bb97c341e31fcc vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\UpdateManager.exe"
sh=6CDE6B1DD298CA47510EB79334AE149F60FEFFCE ft=1 fh=0241d1e8e3e9ed03 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport.dll"
sh=84987AF48F5107F84A12BB7418C0A7A2106906B0 ft=1 fh=6e62188c597b6ea7 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\AskPartnerNetwork\Toolbar\{PartnerID}\Passport_x64.dll"
sh=75A9BFE798ADFBFDFA8E0155A242E69ACD396E53 ft=1 fh=7e8b040c1a60dd55 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Source\program files\VNT\vntldr.exe"
sh=4B553651EF610C0614F8393D6C25ABA0A8F09ECA ft=1 fh=92ef1bb072edf568 vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Avira\AntiVir Desktop\offercast_avirav7_.exe"
sh=81C2C3354F11ECE49D7667538CEFE9F2B2395319 ft=1 fh=cca4b3788ffc60aa vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Common Files\DVDVideoSoft\AskTB\ApnIC.dll"
sh=99DD33D629341F95D9853B1E63FCE454EC654560 ft=1 fh=08803d4e54260720 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Program Files\Common Files\DVDVideoSoft\AskTB\ApnToolbarInstaller.exe"
sh=1D821D41C70D680FB496DFACE747B025C1CCE97F ft=1 fh=1e43c52facbea9b2 vn="Variante von Win32/DomaIQ.BB evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000"
sh=37381F388BAE1EDBAC14E32FF3277F224AF74188 ft=1 fh=bc860133a238d9e1 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Users\admin\Downloads\avira_free_antivirus_de12001125.exe"
sh=35987E8A8AA932982D9CF0EA6DF502087644448E ft=1 fh=d82ceaa6d24562da vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\FreeYouTubeDownload.exe"
sh=846D95D63EDE9508EFC7CEEE1D145D7CE62988C3 ft=1 fh=ec23a4ae3310ce50 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\FreeYouTubeToMP3Converter(1).exe"
sh=7568B5EAC77999757C396FCAE5CF5CA2F350F0C4 ft=1 fh=877954751a9f8b60 vn="Win32/OpenCandy potenziell unsichere Anwendung" ac=I fn="C:\Users\admin\Downloads\FreeYouTubeToMP3Converter(2).exe"
sh=250AD920C538EBAC63102E368FB642EE33AD0593 ft=1 fh=8e020e8f8829bf65 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\FreeYouTubeToMP3Converter.exe"
sh=ADF1B98262EA25B6417F774D0A27F6F5FF69E3F0 ft=1 fh=6479540831fb8cef vn="Variante von Win32/DownloadSponsor.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\admin\Downloads\OpenOffice - CHIP-Downloader.exe"
sh=1C5244967D8907B676C6CBCEEE6BD9F90F10CC6B ft=1 fh=51b3b1bbaa02ab32 vn="Win32/Bundled.Toolbar.Google.D potenziell unsichere Anwendung" ac=I fn="C:\Users\admin\Downloads\PhotoScape_V3.6.2.exe"
sh=71435DDB11E00D0243380C4902324853FE4ECE8F ft=1 fh=12b0cd2dde452d65 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ApnIC[1].0"
sh=E44D062204C9698F5C95651F2E424D37A31F5B15 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[1].7z"
sh=A9B44B47329DFDC56F86EDA59429593DF39B5A54 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[2].7z"
sh=1F69FB9BC4F314CBEC9BECEBA3F5C393006A7C57 ft=0 fh=0000000000000000 vn="Variante von Win32/Bundled.Toolbar.Ask.F potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\AskToolbarInstaller-AVIRA-V7[3].7z"
sh=40E49124AD0B55A25F947333CA88E9D0BC30A7E3 ft=1 fh=e26ad988592b2af9 vn="Variante von Win32/Bundled.Toolbar.Ask potenziell unsichere Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XZ5BNK7Y\ApnIC[1].0"

deeprybka 27.06.2014 12:44
Ok und nochmal frische FRST-Logs bitte dann sind wir hoffentlich durch... ;)

Schritt 1

http://filepony.de/icon/frst.pnghttp://deeprybka.trojaner-board.de/b...t/frstscan.png

Bitte starte FRST erneut, markiere auch die checkbox http://deeprybka.trojaner-board.de/b...t/addition.pngund drücke auf Scan.
Bitte poste mir den Inhalt der beiden Logs die erstellt werden.

Trainie4 27.06.2014 14:46
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-06-2014
Ran by admin (administrator) on ADMIN-PC on 27-06-2014 14:02:11
Running from C:\Users\admin\Downloads
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
(Microsoft Corporation) C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Windows\System32\wisptis.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Logitech Inc.) C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Sony) C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
() C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
() C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
() C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Logitech, Inc.) C:\Users\admin\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LULnchr.exe
(Logitech, Inc.) C:\Users\admin\AppData\Local\Logitech® Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Hewlett-Packard Development Co. L.P.) C:\Program Files\Common Files\HP\Digital Imaging\bin\hpqPhotoCrm.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\OneClick.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
() C:\Program Files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HDAudDeck] => C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe [1706096 2010-10-27] (VIA)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-02-14] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [LWS] => C:\Program Files\Logitech\LWS\Webcam Software\LWS.exe [205336 2011-11-11] (Logitech Inc.)
HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [737872 2014-06-04] (Avira Operations GmbH & Co. KG)
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
HKLM\...\Policies\Explorer: [TaskbarNoNotification] 0
HKLM\...\Policies\Explorer: [HideSCAHealth] 0
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-05-18] (Microsoft Corporation)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Sony PC Companion] => C:\Program Files\Sony\Sony PC Companion\PCCompanion.exe [466656 2014-05-23] (Sony)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [GoogleChromeAutoLaunch_A822CA3D40D4B8944864CFEA751D8D57] => C:\Users\admin\AppData\Local\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Skype] => C:\Program Files\Skype\Phone\Skype.exe [21446272 2014-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Run: [Google Update] => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2012-09-08] (Google Inc.)
HKU\S-1-5-21-2742928999-3257237434-1072491205-1000\...\Policies\Explorer: [TaskbarNoNotification] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AML Device Install.lnk
ShortcutTarget: AML Device Install.lnk -> C:\Program Files\AMD AVT\bin\kdbsync.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x69F67AF84008CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=BDCF6DAE-E76B-45DD-A68C-D329956164D9&apn_sauid=72DB5C68-BBFE-414A-89E2-DA441947410A
SearchScopes: HKCU - {E7DFEC4F-1E56-43FC-879E-21F642BE1D8A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB05
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
BHO: No Name - {DBC80044-A445-435b-BC74-9C25C1C588A9} -  No File
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Avira SearchFree Toolbar - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Program Files\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default
FF Homepage: hxxp://msn.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.5.0 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.5.0 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\admin\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\admin\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Avira SearchFree Toolbar plus Web Protection - C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\2r8qsyd3.default\Extensions\toolbar_AVIRA-V7@apn.ask.com.xpi [2013-07-26]
FF Extension: No Name - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-06-11]
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-02-09]

Chrome:
=======
CHR HomePage:
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\21.0.1180.89\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\admin\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 7 U5) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Java Deployment Toolkit 7.0.50.5) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Windows Live™ Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\admin\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Avira SearchFree Toolbar plus Web Protection) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaacalgebmfelllfiaoknifldpngjh [2013-09-20]
CHR Extension: (Skype Click to Call) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-03-24]
CHR Extension: (Google Wallet) - C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-20]
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx [2014-02-21]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-04] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1039440 2014-06-04] (Avira Operations GmbH & Co. KG)
S4 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2014-02-13] () [File not signed]
R2 c2cautoupdatesvc; C:\Program Files\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)
R2 c2cpnrsvc; C:\Program Files\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)
R3 hpqcxs08; C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed]
S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44544 2008-12-03] (Hewlett-Packard) [File not signed]
S3 npggsvc; C:\Windows\system32\GameMon.des [3975544 2012-05-09] (INCA Internet Co., Ltd.) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2008-12-03] (Hewlett-Packard) [File not signed]
S3 Sony PC Companion; C:\Program Files\Sony\Sony PC Companion\PCCService.exe [155824 2013-02-04] (Avanquest Software)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1740600 2013-08-30] (TuneUp Software)
S2 HPSLPSVC; C:\Users\admin\AppData\Local\Temp\7zS6B90\hpslpsvc32.dll [X]

==================== Drivers (Whitelisted) ====================

R1 AsrAppCharger; C:\Windows\System32\DRIVERS\AsrAppCharger.sys [13832 2010-06-11] (Windows (R) Win 7 DDK provider)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [93528 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2014-06-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-11-25] (Avira Operations GmbH & Co. KG)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [20992 2006-11-02] (Microsoft Corporation)
R3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [28944 2008-02-29] (Logitech, Inc.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-08-23] (Avira GmbH)
S3 ss_bbus; C:\Windows\System32\DRIVERS\ss_bbus.sys [98432 2009-09-19] (MCCI)
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1149552 2010-10-25] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\admin\AppData\Local\Temp\catchme.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 23:06 - 2014-06-26 23:06 - 00000000 ____D () C:\Program Files\ESET
2014-06-26 23:05 - 2014-06-26 23:05 - 02347384 _____ (ESET) C:\Users\admin\Downloads\esetsmartinstaller_deu.exe
2014-06-26 01:34 - 2014-06-26 01:34 - 00121222 _____ () C:\Users\admin\Downloads\HitmanPro_20140626_0134.log
2014-06-26 01:28 - 2014-06-26 01:34 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-26 01:28 - 2014-06-26 01:28 - 10274632 _____ (SurfRight B.V.) C:\Users\admin\Downloads\HitmanPro.exe
2014-06-26 01:01 - 2014-06-26 01:24 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-26 01:01 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-26 01:01 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-26 01:01 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-26 01:00 - 2014-06-26 01:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-26 00:49 - 2014-06-26 01:21 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-26 00:30 - 2014-06-26 00:58 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-26 00:29 - 2014-06-26 00:29 - 01342659 _____ () C:\Users\admin\Downloads\adwcleaner_3.213.exe
2014-06-26 00:22 - 2014-06-26 00:22 - 00015850 _____ () C:\ComboFix.txt
2014-06-25 23:58 - 2014-06-26 00:22 - 00000000 ____D () C:\Qoobox
2014-06-25 23:58 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-25 23:58 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-25 23:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-25 23:58 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-25 23:57 - 2014-06-26 00:20 - 00000000 ____D () C:\Windows\erdnt
2014-06-25 23:57 - 2014-06-25 23:57 - 05211571 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-25 23:41 - 2014-06-25 23:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{186F2A27-6EF0-4FF8-9017-830AF6D5FE66}
2014-06-25 23:20 - 2014-06-25 23:20 - 00031594 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-25 23:18 - 2014-06-27 14:02 - 00017723 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-25 23:18 - 2014-06-27 14:02 - 00000000 ____D () C:\FRST
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 22:43 - 2014-06-25 22:44 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:14 - 2014-06-25 22:20 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 11:40 - 2014-06-25 11:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:07 - 2014-06-25 17:09 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-23 20:48 - 2014-06-24 00:08 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 11:44 - 2014-06-22 23:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:49 - 2014-06-16 11:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:20 - 2014-06-23 20:49 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-13 19:07 - 2014-06-17 20:50 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-13 19:07 - 2014-06-13 19:08 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:43 - 2014-06-13 15:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 12:18 - 2014-06-12 12:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-11 18:58 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 18:58 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 18:58 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-11 18:58 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-11 18:58 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 18:58 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-11 18:58 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 18:58 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 18:58 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 18:58 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-11 18:58 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-11 18:58 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-11 18:58 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-11 18:58 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-11 18:58 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 18:58 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-11 18:58 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 18:58 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 18:58 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 18:58 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 18:58 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 18:58 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 18:58 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-11 18:58 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 18:58 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 18:58 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 18:58 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 18:58 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-11 18:57 - 2014-05-08 11:06 - 00919040 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 18:57 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-11 18:57 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 18:57 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-11 18:57 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-11 18:57 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-11 18:57 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 11:22 - 2014-06-10 23:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:24 - 2014-06-09 20:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:24 - 2014-06-09 00:25 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:32 - 2014-06-07 20:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:17 - 2014-06-05 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-03 12:14 - 2014-06-04 00:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:12 - 2014-06-02 12:13 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 11:52 - 2014-06-01 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-05-31 23:54 - 2014-05-31 23:55 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-05-31 23:53 - 2014-06-01 00:04 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-05-31 23:52 - 2014-06-01 00:04 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-30 12:50 - 2014-05-31 00:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-29 12:48 - 2014-05-30 00:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:40 - 2014-06-04 20:38 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-05-28 20:20 - 2014-05-28 20:21 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:19 - 2014-05-28 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}

==================== One Month Modified Files and Folders =======

2014-06-27 14:02 - 2014-06-25 23:18 - 00017723 _____ () C:\Users\admin\Downloads\FRST.txt
2014-06-27 14:02 - 2014-06-25 23:18 - 00000000 ____D () C:\FRST
2014-06-27 13:07 - 2012-09-08 00:14 - 00001120 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-27 13:07 - 2012-04-10 22:04 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-27 11:12 - 2012-05-12 13:55 - 00000928 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job
2014-06-27 11:01 - 2012-03-09 20:29 - 01979739 _____ () C:\Windows\WindowsUpdate.log
2014-06-27 00:07 - 2012-09-08 00:14 - 00001068 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-26 23:08 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 23:08 - 2009-07-14 06:34 - 00016944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 23:06 - 2014-06-26 23:06 - 00000000 ____D () C:\Program Files\ESET
2014-06-26 23:06 - 2012-03-09 20:53 - 01620684 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-26 23:05 - 2014-06-26 23:05 - 02347384 _____ (ESET) C:\Users\admin\Downloads\esetsmartinstaller_deu.exe
2014-06-26 23:00 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 23:00 - 2009-07-14 06:39 - 00092997 _____ () C:\Windows\setupact.log
2014-06-26 01:42 - 2012-03-10 17:35 - 00627532 _____ () C:\Windows\PFRO.log
2014-06-26 01:34 - 2014-06-26 01:34 - 00121222 _____ () C:\Users\admin\Downloads\HitmanPro_20140626_0134.log
2014-06-26 01:34 - 2014-06-26 01:28 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-06-26 01:28 - 2014-06-26 01:28 - 10274632 _____ (SurfRight B.V.) C:\Users\admin\Downloads\HitmanPro.exe
2014-06-26 01:24 - 2014-06-26 01:01 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-26 01:21 - 2014-06-26 00:49 - 00000000 ____D () C:\ProgramData\EwpiSvono
2014-06-26 01:21 - 2009-07-14 06:52 - 00000000 ____D () C:\Windows\twain_32
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-26 01:01 - 2014-06-26 01:01 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware
2014-06-26 01:00 - 2014-06-26 01:00 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\admin\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-26 00:58 - 2014-06-26 00:30 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:31 - 2012-03-13 22:38 - 00000000 ____D () C:\Program Files\Common Files\DVDVideoSoft
2014-06-26 00:29 - 2014-06-26 00:29 - 01342659 _____ () C:\Users\admin\Downloads\adwcleaner_3.213.exe
2014-06-26 00:22 - 2014-06-26 00:22 - 00015850 _____ () C:\ComboFix.txt
2014-06-26 00:22 - 2014-06-25 23:58 - 00000000 ____D () C:\Qoobox
2014-06-26 00:22 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-26 00:20 - 2014-06-25 23:57 - 00000000 ____D () C:\Windows\erdnt
2014-06-26 00:16 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-06-25 23:57 - 2014-06-25 23:57 - 05211571 ____R (Swearware) C:\Users\admin\Downloads\ComboFix.exe
2014-06-25 23:41 - 2014-06-25 23:41 - 00000000 ____D () C:\Users\admin\AppData\Local\{186F2A27-6EF0-4FF8-9017-830AF6D5FE66}
2014-06-25 23:20 - 2014-06-25 23:20 - 00031594 _____ () C:\Users\admin\Downloads\Addition.txt
2014-06-25 23:18 - 2014-06-25 23:18 - 01073152 _____ (Farbar) C:\Users\admin\Downloads\FRST.exe
2014-06-25 22:50 - 2012-03-25 22:03 - 00000000 ____D () C:\Users\admin\AppData\Local\CrashDumps
2014-06-25 22:44 - 2014-06-25 22:43 - 00458833 _____ () C:\Users\admin\Downloads\kavremvr 2014-06-25 22-43-10 (pid 1952).log
2014-06-25 22:42 - 2014-06-25 22:42 - 07168704 _____ (Kaspersky Lab ZAO) C:\Users\admin\Downloads\kavremover.exe
2014-06-25 22:32 - 2009-07-14 04:37 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-06-25 22:20 - 2014-06-25 22:14 - 173838160 _____ () C:\Users\admin\Downloads\New_PC_Studio_1.5.1.10064_2.exe
2014-06-25 22:18 - 2012-03-09 20:39 - 00000000 ____D () C:\Users\admin
2014-06-25 22:17 - 2012-03-13 22:36 - 00000000 ____D () C:\Users\admin\Desktop\HUONG
2014-06-25 17:09 - 2014-06-24 00:07 - 00020927 _____ () C:\Users\admin\Desktop\Bewerbung.odt
2014-06-25 14:12 - 2012-05-12 13:55 - 00000906 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job
2014-06-25 11:41 - 2014-06-25 11:40 - 00000000 ____D () C:\Users\admin\AppData\Local\{3EED6AA6-D524-4F07-A23E-4860E5EAE0FA}
2014-06-24 22:09 - 2012-08-08 13:39 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Skype
2014-06-24 21:52 - 2014-06-24 21:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{EE0CC8EC-9A35-44BC-B3D4-099B1864FB9A}
2014-06-24 16:22 - 2012-07-05 23:19 - 00498794 _____ () C:\Windows\DPINST.LOG
2014-06-24 16:22 - 2012-07-05 23:19 - 00001972 _____ () C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
2014-06-24 16:22 - 2012-07-05 23:19 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
2014-06-24 16:22 - 2012-03-10 17:22 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
2014-06-24 09:50 - 2014-06-24 09:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{53206F07-D646-4DA0-9417-B9741DC90340}
2014-06-24 00:08 - 2014-06-23 20:48 - 00000000 ____D () C:\Users\admin\Desktop\2014-06 (Jun)
2014-06-23 20:49 - 2014-06-13 19:20 - 00006144 ____H () C:\Users\admin\Downloads\photothumb.db
2014-06-23 20:49 - 2012-09-08 12:57 - 00071680 ____H () C:\Users\admin\Desktop\photothumb.db
2014-06-23 19:46 - 2014-06-23 19:46 - 00000000 ____D () C:\Users\admin\AppData\Local\{16242B02-12BA-43F0-BE0D-423B07CD5790}
2014-06-22 23:46 - 2014-06-22 11:44 - 00000000 ____D () C:\Users\admin\AppData\Local\{88AE844F-1371-4F20-9393-856F2B3D8B9D}
2014-06-21 15:29 - 2014-06-21 15:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{BFBB4C36-F3DB-47C7-AC18-3D5D4F33022E}
2014-06-20 23:06 - 2014-06-20 23:06 - 00000000 ____D () C:\Users\admin\AppData\Local\{5D338E0B-BF39-42C7-9C9E-DC5EF7E11EB8}
2014-06-18 18:08 - 2012-03-13 19:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live
2014-06-18 18:07 - 2014-06-18 18:07 - 00000000 ____D () C:\Users\admin\AppData\Local\{949F82E3-9F21-4106-9CB9-63F221468110}
2014-06-18 16:55 - 2014-06-18 16:55 - 00000000 ____D () C:\Users\admin\AppData\Local\{638A86CE-1FF7-4B83-B9CA-B36829E18C4E}
2014-06-17 20:50 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Windows Live Writer
2014-06-17 11:59 - 2014-06-17 11:59 - 00000000 ____D () C:\Users\admin\AppData\Local\{FEA4FC39-13F6-45A9-BE92-9440A4CCEBA8}
2014-06-16 23:50 - 2014-06-16 23:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{E3405660-900F-48FE-A6BF-EE7E5EAD42BC}
2014-06-16 11:50 - 2014-06-16 11:49 - 00000000 ____D () C:\Users\admin\AppData\Local\{4873065B-A4D8-4FC7-9F47-4B235BFF68BA}
2014-06-15 12:03 - 2014-06-15 12:03 - 00000000 ____D () C:\Users\admin\AppData\Local\{8D34C924-5103-43C3-845E-85DA0FCF1DE9}
2014-06-14 21:37 - 2014-06-14 21:37 - 00000000 ____D () C:\Users\admin\AppData\Local\{10937928-55C7-4757-866C-9C474354BC6B}
2014-06-13 21:50 - 2014-06-13 21:50 - 00052894 _____ () C:\Users\admin\Downloads\Dein Lebenslauf als PDF.zip
2014-06-13 21:02 - 2012-09-08 00:15 - 00002322 _____ () C:\Users\admin\Desktop\Google Chrome.lnk
2014-06-13 19:22 - 2014-06-13 19:22 - 00000000 ____D () C:\Users\admin\Downloads\Originals
2014-06-13 19:08 - 2014-06-13 19:07 - 00000000 ____D () C:\Users\admin\AppData\Local\Windows Live Writer
2014-06-13 15:44 - 2014-06-13 15:43 - 00000000 ____D () C:\Users\admin\AppData\Local\{EFAE5DE0-F23D-488B-85F3-47370B533003}
2014-06-13 00:20 - 2014-06-13 00:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{301053BA-6CD3-4FA6-A086-052FB9A23B01}
2014-06-12 19:43 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\rescache
2014-06-12 12:19 - 2014-06-12 12:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{1BF72EF0-3F48-4E5B-A4B4-6F9157DFC8BC}
2014-06-12 12:15 - 2012-04-26 19:00 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-12 01:16 - 2013-08-14 23:16 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 01:15 - 2012-07-07 20:26 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-11 18:33 - 2014-06-11 18:33 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-11 17:29 - 2014-06-11 17:29 - 00000000 ____D () C:\Users\admin\AppData\Local\{570C1815-1684-4688-9D60-2AB1FCA1E52D}
2014-06-10 23:23 - 2014-06-10 11:22 - 00000000 ____D () C:\Users\admin\AppData\Local\{A1EFE083-120B-478A-9D69-737FCD1764F5}
2014-06-09 20:25 - 2014-06-09 20:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{22EADCD1-4D9E-4FDA-9DAC-DC2A6DC935CE}
2014-06-09 00:25 - 2014-06-09 00:24 - 00000000 ____D () C:\Users\admin\AppData\Local\{4CD33A4B-9A86-4AA9-A6A7-CC8611CB999D}
2014-06-08 12:23 - 2014-06-08 12:23 - 00000000 ____D () C:\Users\admin\AppData\Local\{5ED21193-B9EA-477D-A7AC-8CBB3892C1B8}
2014-06-07 20:33 - 2014-06-07 20:32 - 00000000 ____D () C:\Users\admin\AppData\Local\{1D38EC89-E9C7-4702-A4CD-DB2BB0D7AD14}
2014-06-06 12:33 - 2014-06-06 12:33 - 00000000 ____D () C:\Users\admin\AppData\Local\{3F2984A0-D386-4C60-8003-19BBAFA0CB64}
2014-06-06 00:18 - 2014-06-06 00:18 - 00000000 ____D () C:\Users\admin\AppData\Local\{7E55463D-B596-43E5-BEA7-B47DE940FB88}
2014-06-05 12:18 - 2014-06-05 12:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{CB1B5164-E548-42E0-8DD0-40545A9E28B1}
2014-06-05 00:17 - 2014-06-05 00:17 - 00000000 ____D () C:\Users\admin\AppData\Local\{0BD0F7D6-C3FB-4ACE-9775-4B5296AC115D}
2014-06-04 20:38 - 2014-05-28 20:40 - 00000000 ____D () C:\Users\admin\Desktop\PokeMMO-Client
2014-06-04 13:40 - 2013-08-24 12:16 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-04 13:40 - 2013-08-24 12:16 - 00093528 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-04 12:16 - 2014-06-04 12:16 - 00000000 ____D () C:\Users\admin\AppData\Local\{1B122807-7725-4D6B-955D-28B48ED5E356}
2014-06-04 00:16 - 2014-06-03 12:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{55B730A7-3FB8-4374-9002-12B26B186768}
2014-06-03 00:14 - 2014-06-03 00:14 - 00000000 ____D () C:\Users\admin\AppData\Local\{8077B01F-A0B5-4708-9B04-8796367F3465}
2014-06-02 12:13 - 2014-06-02 12:12 - 00000000 ____D () C:\Users\admin\AppData\Local\{BBA74DDF-37FF-420D-8798-6D388996A694}
2014-06-01 23:53 - 2014-06-01 11:52 - 00000000 ____D () C:\Users\admin\AppData\Local\{3475AF7E-6E24-471E-8F9E-585BBF1B86B3}
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Roaming\Opera Software
2014-06-01 00:04 - 2014-05-31 23:53 - 00000000 ____D () C:\Users\admin\AppData\Local\Opera Software
2014-06-01 00:04 - 2014-05-31 23:52 - 00000000 ____D () C:\Program Files\Opera
2014-05-31 23:55 - 2014-05-31 23:54 - 59782173 _____ () C:\Users\admin\Downloads\Pokemon HeartGold.zip
2014-05-31 23:51 - 2014-05-31 23:51 - 05250247 _____ () C:\Users\admin\Downloads\Pokemon FireRed.zip
2014-05-31 23:34 - 2014-05-31 23:34 - 00000000 ____D () C:\ProgramData\TEMP
2014-05-31 23:33 - 2012-04-03 18:46 - 00000000 ____D () C:\Users\admin\AppData\Local\Microsoft Games
2014-05-31 22:50 - 2014-05-31 22:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{AF090ECC-4319-438E-AD73-03F802547607}
2014-05-31 00:52 - 2014-05-30 12:50 - 00000000 ____D () C:\Users\admin\AppData\Local\{A021ECFB-2079-4A1C-860B-85328AFF7AB0}
2014-05-30 11:56 - 2014-05-30 11:56 - 00002505 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Users\admin\AppData\Local\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-30 11:56 - 2014-05-30 11:56 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ___RD () C:\Program Files\Skype
2014-05-30 11:56 - 2012-08-08 13:39 - 00000000 ____D () C:\ProgramData\Skype
2014-05-30 11:18 - 2014-06-11 18:58 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-11 18:58 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-11 18:58 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-11 18:58 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-11 18:58 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-11 18:58 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-11 18:58 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-11 18:58 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-11 18:58 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-11 18:58 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-11 18:58 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-11 18:58 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-11 18:58 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-11 18:58 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-11 18:58 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-11 18:58 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-11 18:58 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-11 18:58 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-11 18:58 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-11 18:58 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-11 18:58 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-11 18:58 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-11 18:58 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-11 18:58 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-11 18:58 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-11 18:58 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-11 18:58 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-11 18:58 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 00:49 - 2014-05-29 12:48 - 00000000 ____D () C:\Users\admin\AppData\Local\{122B6BC9-CC46-4187-AE50-527B28905EE4}
2014-05-28 20:21 - 2014-05-28 20:20 - 00000000 ____D () C:\Users\admin\AppData\Local\{1A827180-D793-473F-9AD2-A1D63B7DA69C}
2014-05-28 00:20 - 2014-05-28 00:19 - 00000000 ____D () C:\Users\admin\AppData\Local\{255B0D89-94EA-4A5F-B006-88B3F77AF1F3}

Some content of TEMP:
====================
C:\Users\admin\AppData\Local\temp\avgnt.exe
C:\Users\admin\AppData\Local\temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-18 22:19

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x86) Version:25-06-2014
Ran by admin at 2014-06-27 14:03:31
Running from C:\Users\admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

32 Bit HP CIO Components Installer (Version: 6.1.1 - Hewlett-Packard) Hidden
Adobe AIR (HKLM\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe AIR (Version: 1.0.8.4990 - Adobe Systems Inc.) Hidden
Adobe Flash Player 13 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A90000000001}) (Version: 9.0.0 - Adobe Systems Incorporated)
AMD Accelerated Video Transcoding (Version: 2.00.0001 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.898.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{C4100721-2D71-CC80-8877-0A7855B6EEFB}) (Version: 3.0.868.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.70214.2220 - Advanced Micro Devices, Inc.) Hidden
ASRock App Charger v1.0.4 (HKLM\...\ASRock App Charger_is1) (Version:  - ASRock Inc.)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.4.672 - Avira)
Avira SearchFree Toolbar (HKLM\...\{41564952-412D-5637-00A7-A758B70C0A03}) (Version: 12.10.3.4487 - APN, LLC)
BufferChm (Version: 130.0.331.000 - Hewlett-Packard) Hidden
CameraHelperMsi (Version: 13.31.1038.0 - Logitech) Hidden
Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (Version: 2012.0214.2218.39913 - Ihr Firmenname) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (Version: 2012.0214.2217.39913 - Advanced Micro Devices, Inc.) Hidden
ccc-utility (Version: 2012.0214.2218.39913 - Advanced Micro Devices, Inc.) Hidden
Copy (Version: 130.0.428.000 - Hewlett-Packard) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (Version: 130.0.0.0 - Hewlett-Packard) Hidden
DeviceDiscovery (Version: 130.0.465.000 - Hewlett-Packard) Hidden
DJ_AIO_03_F4200_Software_Min (Version: 130.0.365.000 - Hewlett-Packard) Hidden
Elsword_DE (HKLM\...\Elsword_DE_is1) (Version:  - )
erLT (Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
F4200 (Version: 130.0.365.000 - Hewlett-Packard) Hidden
Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Free Audio CD Burner version 1.4.8 (HKLM\...\Free Audio CD Burner_is1) (Version:  - DVDVideoSoft Limited.)
Free YouTube Download version 3.1.37.918 (HKLM\...\Free YouTube Download_is1) (Version: 3.1.37.918 - DVDVideoSoft Ltd.)
Free YouTube to MP3 Converter version 3.12.13.925 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.13.925 - DVDVideoSoft Ltd.)
Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
GPBaseService2 (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP)
HP Deskjet F4200 All-In-One Driver Software 13.0 Rel. 3 (HKLM\...\{A00C9114-40E6-4C70-A619-7DF264B23485}) (Version: 13.0 - HP)
HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP)
HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP)
HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP)
HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP)
HP Update (HKLM\...\{7059BDA7-E1DB-442C-B7A1-6144596720A4}) (Version: 4.000.011.006 - Hewlett-Packard)
HPPhotoGadget (Version: 130.0.282.000 - Hewlett-Packard) Hidden
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPPhotosmartEssential (Version: 2.04.0000 - Hewlett-Packard) Hidden
HPProductAssistant (Version: 130.0.371.000 - Hewlett-Packard) Hidden
HPSSupply (Version: 130.0.371.000 - Hewlett-Packard) Hidden
Java Auto Updater (Version: 2.1.6.0 - Sun Microsystems, Inc.) Hidden
Java(TM) 7 Update 5 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217005FF}) (Version: 7.0.50 - Oracle)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Logitech Vid HD (HKLM\...\Logitech Vid) (Version: 7.2 (7259) - Logitech Inc..)
Logitech Webcam-Software (HKLM\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.31 - Logitech Inc.)
LWS Facebook (Version: 13.31.1038.0 - Logitech) Hidden
LWS Gallery (Version: 13.31.1038.0 - Logitech) Hidden
LWS Help_main (Version: 13.31.1044.0 - Logitech) Hidden
LWS Launcher (Version: 13.31.1038.0 - Logitech) Hidden
LWS Motion Detection (Version: 13.30.1395.0 - Logitech) Hidden
LWS Pictures And Video (Version: 13.31.1038.0 - Logitech) Hidden
LWS Twitter (Version: 13.30.1346.0 - Logitech) Hidden
LWS Video Mask Maker (Version: 13.30.1379.0 - Logitech) Hidden
LWS VideoEffects (Version: 13.30.1379.0 - Logitech) Hidden
LWS Webcam Software (Version: 13.31.1038.0 - Logitech) Hidden
LWS WLM Plugin (Version: 1.30.1201.0 - Logitech) Hidden
LWS YouTube Plugin (Version: 13.31.1038.0 - Logitech) Hidden
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
MarketResearch (Version: 130.0.374.000 - Hewlett-Packard) Hidden
Media Go (HKLM\...\{362AB21A-E2C4-40CE-81C2-8C4D62B0635A}) (Version: 2.4.256 - Sony)
Media Go Video Playback Engine 1.116.109.02030 (HKLM\...\{54215B8A-6212-8DB8-39B4-98EE2BB98BD1}) (Version: 1.116.109.02030 - Sony)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
OpenOffice 4.0.1 (HKLM\...\{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}) (Version: 4.01.9714 - Apache Software Foundation)
PhotoScape (HKLM\...\PhotoScape) (Version:  - )
Platform (Version: 1.34 - VIA Technologies, Inc.) Hidden
Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)
Revo Uninstaller 1.95 (HKLM\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Scan (Version: 13.0.0.0 - Hewlett-Packard) Hidden
Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP)
Skype Click to Call (HKLM\...\{BB285C9F-C821-4770-8970-56C4AB52C87E}) (Version: 7.2.15747.10003 - Microsoft Corporation)
Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.)
SmartWebPrinting (Version: 130.0.457.000 - Hewlett-Packard) Hidden
SolutionCenter (Version: 130.0.373.000 - Hewlett-Packard) Hidden
Sony Ericsson Update Engine (HKLM\...\Update Engine) (Version: 2.13.6.201305161305 - Sony Ericsson Communications AB)
Sony PC Companion 2.10.211 (HKLM\...\{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}) (Version: 2.10.211 - Sony)
Status (Version: 130.0.469.000 - Hewlett-Packard) Hidden
Toolbox (Version: 130.0.648.000 - Hewlett-Packard) Hidden
TrayApp (Version: 130.0.422.000 - Hewlett-Packard) Hidden
TuneUp Utilities 2014 (de-DE) (Version: 14.0.1000.89 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities 2014) (Version: 14.0.1000.89 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.89 - TuneUp Software) Hidden
Uninstall 1.0.0.1 (HKLM\...\Uninstall_is1) (Version:  - )
UnloadSupport (Version: 11.0.0 - Hewlett-Packard) Hidden
VIA Plattform-Geräte-Manager (HKLM\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.34 - VIA Technologies, Inc.)
WebReg (Version: 130.0.132.017 - Hewlett-Packard) Hidden
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3555.0308 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

18-06-2014 15:11:39 Sony PC Companion
25-06-2014 21:58:14 ComboFix created restore point
25-06-2014 23:34:07 Prüfpunkt von HitmanPro

==================== Hosts content: ==========================

2009-07-14 04:04 - 2014-06-26 00:16 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {018230F2-5D11-43A1-9A51-76FA8FF48BC0} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-14] (Adobe Systems Incorporated)
Task: {0A179964-1EF9-4B62-AED2-85E8B451F2EF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-17] (Facebook Inc.)
Task: {2FA9F294-38CC-460D-B185-D1712D4ECB41} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-08] (Google Inc.)
Task: {61C9533C-A5A8-4C69-856F-827F9C3507D1} - System32\Tasks\HP-Online-Aktualisierungsprogramm => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-05-08] (Hewlett-Packard)
Task: {82C778DE-26A7-4C0D-9BF6-2494C569478B} - System32\Tasks\Google Updater and Installer => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-08] (Google Inc.)
Task: {83264D8B-8132-4C15-AEA6-90F200DCC147} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-08-17] (Facebook Inc.)
Task: {DE300EED-CB94-400C-B0B7-6EBE6CA68E3B} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2012-01-17] (Sun Microsystems, Inc.)
Task: {E12AD530-7E84-4CF7-BA94-53CB2AB82F8F} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2013-08-30] (TuneUp Software)
Task: {EB2C763D-C12D-42BD-BDAA-3ADEFE8C25BB} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe [2012-09-08] (Google Inc.)
Task: {FCBF433A-16B6-42B7-AD83-48B23BC97863} - System32\Tasks\Microsoft\Windows\TabletPC\InputPersonalization => C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job => C:\Users\admin\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000Core.job => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2742928999-3257237434-1072491205-1000UA.job => C:\Users\admin\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-08-30 09:51 - 2013-08-30 09:51 - 00501560 _____ () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2012-03-10 17:30 - 2010-10-27 08:56 - 00080496 ____R () C:\Program Files\VIA\VIAudioi\VDeck\QsApoApi.dll
2012-03-10 17:30 - 2010-10-27 08:56 - 00113264 ____R () C:\Program Files\VIA\VIAudioi\VDeck\Dts2ApoApi.dll
2012-03-10 17:30 - 2010-10-27 08:57 - 00100976 ____R () C:\Program Files\VIA\VIAudioi\VDeck\VMicApi.dll
2012-03-10 17:30 - 2010-10-27 08:57 - 64663664 ____R () C:\Program Files\VIA\VIAudioi\VDeck\Skin.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 02145304 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtCore4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 07956504 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtGui4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00342552 _____ () C:\Program Files\Logitech\LWS\Webcam Software\QtXml4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00029208 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QGif4.dll
2011-11-11 14:08 - 2011-11-11 14:08 - 00128536 _____ () C:\Program Files\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll
2012-07-05 23:19 - 2012-04-30 11:57 - 00039936 _____ () C:\Program Files\Sony\Sony PC Companion\TMonitorAPI.dll
2012-07-05 23:19 - 2013-09-13 11:02 - 00208896 _____ () C:\Program Files\Sony\Sony PC Companion\MExplorer.dll
2011-07-07 15:54 - 2011-07-07 15:54 - 00233984 _____ () C:\Program Files\Sony\Sony PC Companion\Report.dll
2013-01-09 14:11 - 2013-01-09 14:11 - 00599040 _____ () C:\Program Files\Sony\Sony PC Companion\PhoneUpdate.dll
2011-11-11 14:07 - 2011-11-11 14:07 - 00265240 _____ () C:\Program Files\Logitech\LWS\Webcam Software\CameraHelperShell.exe
2011-11-11 14:09 - 2011-11-11 14:09 - 00336408 _____ () C:\Program Files\Common Files\logishrd\LWSPlugins\LWS\Applets\CameraHelper\DevManagerCore.dll
2011-08-12 12:19 - 2011-08-12 12:19 - 00680984 _____ () C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
2012-07-05 23:19 - 2013-10-31 12:35 - 00070880 _____ () C:\Program Files\Sony\Sony PC Companion\PCCompanionInfo.exe
2012-02-14 23:13 - 2012-02-14 23:13 - 00369152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2014-06-11 18:33 - 2014-06-11 18:33 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2014-05-14 21:07 - 2014-05-14 21:07 - 16361136 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll
2014-06-26 23:06 - 2014-05-23 10:56 - 00119184 _____ () C:\Program Files\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/25/2014 10:49:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: msooh.exe, Version: 0.0.0.0, Zeitstempel: 0x539ef790
Name des fehlerhaften Moduls: msooh.exe, Version: 0.0.0.0, Zeitstempel: 0x539ef790
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00007602
ID des fehlerhaften Prozesses: 0xdf8
Startzeit der fehlerhaften Anwendung: 0xmsooh.exe0
Pfad der fehlerhaften Anwendung: msooh.exe1
Pfad des fehlerhaften Moduls: msooh.exe2
Berichtskennung: msooh.exe3

Error: (06/25/2014 10:26:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x14a4
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/24/2014 07:58:39 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/24/2014 07:56:32 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/21/2014 07:52:06 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/21/2014 07:50:46 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/18/2014 10:21:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/18/2014 10:20:09 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (06/16/2014 10:18:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/16/2014 10:17:16 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (06/26/2014 11:02:59 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 11:01:27 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 11:01:27 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {10DA4F3C-CC99-4190-BE4D-58330754E882}

Error: (06/26/2014 11:00:57 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 01:45:37 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 01:44:05 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 01:44:05 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {10DA4F3C-CC99-4190-BE4D-58330754E882}

Error: (06/26/2014 01:43:35 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 01:34:16 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126

Error: (06/26/2014 01:23:33 AM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "HP Network Devices Support" wurde mit folgendem Fehler beendet:
%%126


Microsoft Office Sessions:
=========================
Error: (06/25/2014 10:49:54 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: msooh.exe0.0.0.0539ef790msooh.exe0.0.0.0539ef790c000000500007602df801cf90b703cb1e14C:\ProgramData\msooh.exeC:\ProgramData\msooh.exe42530246-fcaa-11e3-aa4e-bc5ff40be9f8

Error: (06/25/2014 10:26:46 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b14a401cf90ab4a22b22aC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll06b2d934-fca7-11e3-b901-bc5ff40be9f8

Error: (06/24/2014 07:58:39 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/24/2014 07:56:32 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/21/2014 07:52:06 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/21/2014 07:50:46 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/18/2014 10:21:58 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/18/2014 10:20:09 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3

Error: (06/16/2014 10:18:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\program files\Sony\sony pc companion\Drivers\DPInst64.exe

Error: (06/16/2014 10:17:16 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllC:\Program Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3


==================== Memory info ===========================

Percentage of memory in use: 62%
Total physical RAM: 3255.05 MB
Available physical RAM: 1217.98 MB
Total Pagefile: 6506.34 MB
Available Pagefile: 3624.7 MB
Total Virtual: 2047.88 MB
Available Virtual: 1908.67 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:50.81 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: F648F648)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================
muss aber jetzt los :/
Bis morgen ! :)

deeprybka 28.06.2014 14:44
Hi,
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument


Code:
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
SearchScopes: HKCU - {33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=BDCF6DAE-E76B-45DD-A68C-D329956164D9&apn_sauid=72DB5C68-BBFE-414A-89E2-DA441947410A
SearchScopes: HKCU - {E7DFEC4F-1E56-43FC-879E-21F642BE1D8A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB05
2014-06-26 00:49 - 2014-06-26 01:21 - 00000000 ____D () C:\ProgramData\EwpiSvono

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.



Unten bei den Tipps ist Java verlinkt. Hier die neueste Version installieren. Deine Version
Zitat:
Java(TM) 7 Update 5
bitte deinstallieren.
Ebenfalls verlinkt, Flash: Den Link mit allen Browser anklicken und die neueste Version ohne die optionalen Angebote installieren.

Aufräumen:
Defogger: Falls benutzt worden, Defogger nochmal starten und auf re-enable klicken.
Anschließend:

Schritt 1
http://deeprybka.trojaner-board.de/b...s/combofix.png Combofix-Deinstallation.
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die http://deeprybka.trojaner-board.de/b...ne/revo/w7.png + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

http://deeprybka.trojaner-board.de/b...ean/fragen.png Gibts jetzt noch Probleme mit Deinem Rechner? Oder hast Du noch Fragen?

NEIN?

Alle Logs gepostet? Ja! Dann lade Dir bitte http://filepony.de/icon/delfix.pngDelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

>>clean<<
Wir haben es geschafft! :abklatsch:
Die Logs sehen für mich im Moment sauber aus. :daumenhoc

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...:dankeschoen:und/oder das Forum mit einer kleinen Spende http://www.trojaner-board.de/extra/spende.png unterstützen. :applaus:
Es bleibt mir nur noch, Dir unbeschwertes und sicheres Surfen zu wünschen und dass wir uns hier so bald nicht wiedersehen. ;)

Epilog: Tipps, Dos & Don'ts

Aktualität von System und Software

Das Betriebsystem http://deeprybka.trojaner-board.de/b...an/windows.pngWindows muss zwingend immer auf dem neusten Stand sein. Stelle sicher, dass die http://deeprybka.trojaner-board.de/b...an/updates.PNGautomatischen Updates aktiviert sind.

Auch die installierte Software sollte immer in der aktuellsten Version vorliegen.
Speziell gilt das für die Browser http://deeprybka.trojaner-board.de/b...n/browsers.png, Java http://deeprybka.trojaner-board.de/b...clean/java.png, Flash-Player http://filepony.de/icon/flashplayer_firefox.png und PDF-Reader http://filepony.de/icon/adobe_reader.png, denn bekannte Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim blossen Besuch einer präparierten Website per Drive-by Download Malware zu installieren. Das kann sogar auf normalerweise legitimen Websites geschehen, wenn es einem Angreifer gelungen ist, seinen Code in die Seite einzuschleusen, und ist deshalb relativ unberechenbar.
  • Mit diesem kleinen Plugin-Check kannst du regelmässig diese Komponenten auf deren Aktualität überprüfen.
  • Achte auch darauf, dass alte, nicht mehr verwendete Versionen deinstalliert sind.

Sicherheits-Software

Eine Bemerkung vorneweg: Jede Softwarelösung hat ihre Schwächen. Die gesamte Verantwortung für die Sicherheit auf Software zu übertragen und einen Rundum-Schutz zu erwarten, wäre eine gefährliche Illusion. Bei unbedachtem oder bewusst risikoreichem Verhalten wird auch das beste Programm früher oder später seinen Dienst versagen (z.B. ein Virenscanner, der eine infizierte Datei nicht erkennt).
Trotzdem ist entsprechende Software natürlich wichtig und hilft dir in Kombination mit einem gut gewarteten (up-to-date) System und durchdachtem Verhalten, deinen Rechner sauber zu halten.
Es liegt in der Natur der Sache, dass die am weitesten verbreitete Anwendungs-Software auch am häufigsten von Malware-Autoren attackiert wird. Es kann daher bereits einen kleinen Sicherheitsgewinn darstellen, wenn man alternative Software (z.B. einen alternativen PDF Reader) benutzt.
Anstelle des Internet Explorers kann man beispielsweise den Mozilla Firefox http://deeprybka.trojaner-board.de/b...an/firefox.png einsetzen, für welchen es zwei nützliche Addons als Empfehlung gibt:
  • http://filepony.de/icon/noscript.png NoScript verhindert standardmässig das Ausführen von aktiven Inhalten (Java, JavaScript, Flash, ..) für sämtliche Websites. Du kannst selber nach dem Prinzip einer Whitelist festlegen, welchen Seiten du vertrauen und Scripts erlauben willst, auch temporär.
  • http://filepony.de/icon/adblock_firefox.pngAdblock Plus blockt die meisten Werbebanner weg. Solche Banner können nebst ihrer störenden Erscheinung auch als Infektionsherde fungieren.

(Un-)Sicheres Verhalten im Internet

Nebst unbemerkten Drive-by Installationen wird Malware aber auch oft mehr oder weniger aktiv vom Benutzer selbst installiert.

Der Besuch zwielichtiger Websites kann bereits Risiken bergen. Und Downloads aus dubiosen Quellen sind immer russisches Roulette. Auch wenn der Virenscanner im Moment darin keine Bedrohung erkennt, muss das nichts bedeuten.

  • Illegale Cracks, Keygens und Serials sind ein ausgesprochen einfacher (und ein beliebter) Weg, um Malware zu verbreiten.
  • Bei Dateien aus Peer-to-Peer- und Filesharingprogrammen oder von Filehostern kannst du dir nie sicher sein, ob auch wirklich drin ist, was drauf steht.
  • Optional: Auch http://deeprybka.trojaner-board.de/b...virustotal.png virustotal.com ist Dein Freund! Lade dubiose oder unbekannte Dateien hoch, bevor Du diese startest oder installierst.

Oft wird auch versucht, den Benutzer mit mehr oder weniger trickreichen Methoden dazu zu bringen, eine für ihn verhängnisvolle Handlung selbst auszuführen (Überbegriff Social Engineering).
  • Surfe mit Vorsicht und lass dich nicht von irgendwie interessant erscheinenden Elementen zu einem vorschnellen Klick verleiten. Lass dich nicht von Popups täuschen, die aussehen wie System- oder Virenmeldungen.
  • Sei skeptisch bei unerwarteten E-Mails, insbesondere wenn sie Anhänge enthalten. Auch wenn sie auf den ersten Blick authentisch wirken, persönliche Daten von dir enthalten oder vermeintlich von einem bekannten Absender stammen: Lieber nochmals in Ruhe überdenken oder nachfragen, anstatt einfach mal Links oder ausführbare Anhänge öffnen oder irgendwo deine Daten eingeben.
  • Auch in sozialen Netzwerken oder über Instant Messaging Systeme können schädliche Links oder Dateien die Runde machen. Erhältst du von einem deiner Freunde eine Nachricht, die merkwürdig ist oder so sensationell interessant oder skandalös tönt, dass man einfach draufklicken muss, dann hat bei ihm/ihr wahrscheinlich Neugier über Verstand gesiegt und du solltest nicht denselben Fehler machen.
  • Lass die Dateiendungen anzeigen, so dass du dich nicht täuschen lässt, wenn eine ausführbare Datei über ein doppelte Dateiendung kaschiert wird, z.B. Nacktfoto.jpg.exe.

Nervige Adware (Werbung) und unnötige Toolbars werden auch meist durch den Benutzer selbst mitinstalliert.
  • Lade Software in erster Priorität immer direkt vom Hersteller herunter. Viele Softwareportale (z.B. Softonic) packen noch unnützes Zeug mit in die Installation. Alternativ dazu wähle ein sauberes Portal wie Filepony oder heise.
  • Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.

Allgemeine Hinweise

Abschließend noch ein paar grundsätzliche Bemerkungen:
  • Dein Benutzerkonto für den alltäglichen Gebrauch sollte nicht über Administratorenrechte verfügen. Nutze ein Konto mit eingeschränkten Rechten bzw. aktiviere die Benutzerkontensteuerung (UAC) auf der höchsten Stufe (Windows Vista/7/8 ).
  • Erstelle regelmässig Backups deiner Daten und Dokumente auf externen Datenträgern, bei wichtigen Dateien mindestens zweifach. Nicht nur ein Malwarebefall kann schmerzhaften Datenverlust nach sich ziehen sondern auch ein gewöhnlicher Festplattendefekt.
  • Die Autorun/Autoplay-Funktion stellt ein Risiko dar, denn sie ermöglicht es, dass beispielsweise beim Einstecken eines entsprechend infizierten USB-Sticks der Befall auf den Rechner überspringt. Überlege dir, ob du diese Funktion nicht besser deaktivieren möchtest.
  • Wähle deine Passwörter gemäss den gängigen Regeln, um besser gegen Brute-Force- und Wörterbuchattacken gewappnet zu sein. Benutze jedes deiner Passwörter nur einmal und ändere sie regelmässig.
  • Der Nutzen von Registry-Cleanern zur Performancesteigerung ist umstritten. Auf jeden Fall lässt sich damit grosser Schaden anrichten, wenn man nicht weiss, was man tut. Wir empfehlen deshalb, die Finger von der Registry zu lassen. Um von Zeit zu Zeit die temporären Dateien zu löschen, genügt TFC.

Trainie4 28.06.2014 15:45
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:28-06-2014 02
Ran by admin at 2014-06-28 16:43:58 Run:3
Running from C:\Users\admin\Downloads
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000
HKLM Group Policy restriction on software: C:\Program Files\Avira <====== ATTENTION
HKLM Group Policy restriction on software: C:\Documents and Settings\All Users\Application Data\Avira <====== ATTENTION
SearchScopes: HKCU - {33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=kw&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^DE&apn_uid=BDCF6DAE-E76B-45DD-A68C-D329956164D9&apn_sauid=72DB5C68-BBFE-414A-89E2-DA441947410A
SearchScopes: HKCU - {E7DFEC4F-1E56-43FC-879E-21F642BE1D8A} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEOB05
2014-06-26 00:49 - 2014-06-26 01:21 - 00000000 ____D () C:\ProgramData\EwpiSvono
       
*****************

C:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000 => Moved successfully.
HKLM => Group Policy Restriction on software restored successfully.
HKLM => Group Policy Restriction on software restored successfully.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{33DB43ED-5D63-4CBC-BF33-B59ECC2BA1C7}'=> Key not found.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E7DFEC4F-1E56-43FC-879E-21F642BE1D8A}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{E7DFEC4F-1E56-43FC-879E-21F642BE1D8A}'=> Key not found.
C:\ProgramData\EwpiSvono => Moved successfully.

==== End of Fixlog ====

deeprybka 28.06.2014 16:27
http://www.trojaner-board.de/extra/lesestoff.pngGibt es jetzt noch Probleme mit dem PC? Wenn ja, welche?


Alle Zeitangaben in WEZ +1. Es ist jetzt 18:05 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131