Ich werde immer auf ILivid weitergeleitet

Phill23 · 20.06.2014, 15:39

Hallo Leute,

ich habe ein Problem mit Firefox und zwar werde ich, bei manchen Links, öfters auf ILivid umgeleitet und nicht auf die Seite, die ich eigentlich aufrufen wollte. Ich hab schon ein bisschen gegoogelt, aber nichts hat geholfen z.B. stand auf einer Seite man soll im Taskmanager ILivid.exe beenden oder Toolbars deinstallieren, aber das hab ich alles gar nicht auf dem Netbook oder es ist jedenfalls nicht sichtbar.

M-K-D-B · 20.06.2014, 15:55

Mein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen.

Bitte beachte folgende Hinweise:

Falls wir Hinweise auf illegal erworbene Software finden, werden wir den Support unterbrechen bis jegliche Art von illegaler Software vom Rechner entfernt wurde.
Lies dir die Anleitungen sorgfältig durch. Solltest du Probleme haben, stoppe mit deiner Bearbeitung und beschreibe mir dein Problem so gut es geht.
Solltest du mir nicht innerhalb von 3 Tagen antworten, gehe ich davon aus, dass du keine Hilfe mehr benötigst. Dann lösche ich dein Thema aus meinem Abo.
Solltest du einmal länger abwesend sein, so gib mir bitte Bescheid!
Während der Bereinigung bitte nichts installieren oder deinstallieren, außer ich bitte dich darum!
Alle zu verwendenen Programme sind auf dem Desktop abzuspeichern und von dort zu starten!

Bitte arbeite alle Schritte in der vorgegebenen Reihefolge nacheinander ab und poste alle Logdateien in CODE-Tags:

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert deinem Helfer massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu groß für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Danke für deine Mitarbeit!

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Phill23 · 20.06.2014, 16:47

Das erste ist FRST.txt und das zweite dieses Addition.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:20-06-2014
Ran by toshiba (administrator) on TOSHIBA-TOSH on 20-06-2014 17:26:45
Running from C:\Users\toshiba\Downloads
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Spotify Ltd) C:\Users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe
() C:\ProgramData\DatacardService\DCService.exe
(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9874024 2010-11-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1522280 2010-11-11] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-06] (AVAST Software)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-07-28] (Microsoft Corporation)
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\Run: [Spotify Web Helper] => C:\Users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-19] (Spotify Ltd)
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\Run: [Amazon Music] => C:\Users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe [3162944 2014-06-05] ()
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\MountPoints2: E - E:\AutoRun.exe
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\MountPoints2: F - F:\AutoRun.exe
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\MountPoints2: {8da8de7d-bfd0-11e3-9e52-1c659de605fe} - F:\AutoRun.exe
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\MountPoints2: {8da8de8f-bfd0-11e3-9e52-1c75087a7c42} - E:\AutoRun.exe
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\MountPoints2: {e10a14d9-ea23-11e3-bd1a-001e101f7fb6} - E:\AutoRun.exe
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba.msn.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {D5B78770-6E14-4B0A-BEA4-C81ECBF84D8A} URL = 
SearchScopes: HKCU - {57448763-C011-4734-A276-E53BB3BD3B42} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
SearchScopes: HKCU - {B3CE397C-FCBC-433A-87C0-2370055E8814} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
SearchScopes: HKCU - {D5B78770-6E14-4B0A-BEA4-C81ECBF84D8A} URL = 
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{013054FD-81BA-44D0-9BE9-E798D45A925C}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{7DCE7013-4574-42CF-A404-68C4DCFCC17E}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF ProfilePath: C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*'))%20%7B%20return%20'PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000%3B%20PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us07.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-04-09]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-04-16]
FF Extension: Adblock Plus - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-09]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-09]

Chrome: 
=======
CHR Extension: (Google Docs) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-24]
CHR Extension: (Google Drive) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-27]
CHR Extension: (YouTube) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-27]
CHR Extension: (Adblock Plus) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-04-27]
CHR Extension: (Google-Suche) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-27]
CHR Extension: (ProxMate - Proxy on steroids!) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki [2014-04-27]
CHR Extension: (Google Wallet) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-27]
CHR Extension: (Google Mail) - C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-27]

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-02] (AVAST Software)
R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-05-08] () [File not signed]
R2 IconMan_R; C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1809920 2010-08-04] (Realsil Microelectronics Inc.) [File not signed]
S3 TemproMonitoringService; C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [51576 2010-07-01] (TOSHIBA Corporation)
S2 McAfee SiteAdvisor Service; c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe [X]

==================== Drivers (Whitelisted) ====================

R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [63616 2010-08-14] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-08-14] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-05-02] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-05-02] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-05-02] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-05-02] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [68312 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-05-02] ()
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-09-24] (ATI Technologies, Inc.)
S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [33640 2010-10-18] (Atheros)
R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [36208 2009-07-30] (COMPAL ELECTRONIC INC.)
R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [24064 2009-06-22] (TOSHIBA Corporation)
R2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-20 17:26 - 2014-06-20 17:29 - 00016441 _____ () C:\Users\toshiba\Downloads\FRST.txt
2014-06-20 17:26 - 2014-06-20 17:27 - 00000000 ____D () C:\FRST
2014-06-20 17:25 - 2014-06-20 17:25 - 01073152 _____ (Farbar) C:\Users\toshiba\Downloads\FRST.exe
2014-06-20 16:59 - 2014-06-20 17:00 - 13354502 _____ () C:\Users\toshiba\Downloads\The_Saturdays_-_If_this_is_love_-_Single.rar
2014-06-20 12:57 - 2014-05-29 00:34 - 00000000 ____D () C:\Users\toshiba\Downloads\Cher Lloyd - Sorry I'm Late Sorry I'm Late (Deluxe Target Edition) (2014)
2014-06-20 12:28 - 2014-06-20 12:28 - 00000000 ____D () C:\Users\toshiba\Downloads\Cher_Lloyd-Sorry_Im_Late-_Deluxe_Edition_-2014-MTD
2014-06-19 21:40 - 2014-06-19 21:57 - 414291165 _____ () C:\Users\toshiba\Downloads\Behaving Badly.mp4
2014-06-19 21:10 - 2014-06-19 21:11 - 00000000 ____D () C:\Users\toshiba\Downloads\Blackout - Single
2014-06-19 20:40 - 2014-06-19 20:40 - 00000000 ____D () C:\Users\toshiba\Downloads\Home (feat. will.i.am) - Single
2014-06-19 20:39 - 2014-06-19 20:40 - 00000000 ____D () C:\Users\toshiba\Downloads\Fuel My Fire - Single
2014-06-19 20:33 - 2014-06-19 20:33 - 00000000 ____D () C:\Users\toshiba\Downloads\Too Much (From Zapped) - Single
2014-06-19 12:35 - 2014-06-19 11:18 - 16290428 _____ () C:\Users\toshiba\Desktop\Work Bitch.mp4
2014-06-19 12:35 - 2014-06-19 11:12 - 02787214 _____ () C:\Users\toshiba\Desktop\Starships Heaven.mp4
2014-06-18 12:58 - 2014-06-19 20:33 - 00000000 ____D () C:\Users\toshiba\Downloads\Don't Stop - EP
2014-06-18 11:40 - 2014-06-18 11:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-17 17:54 - 2014-06-17 17:54 - 00001720 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-17 17:54 - 2014-06-17 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-17 17:51 - 2014-06-17 17:53 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-17 17:51 - 2014-06-17 17:53 - 00000000 ____D () C:\Program Files\iTunes
2014-06-17 17:51 - 2014-06-17 17:51 - 00000000 ____D () C:\Program Files\iPod
2014-06-12 14:44 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 14:44 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 14:44 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 14:44 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 14:44 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 14:44 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 14:44 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 14:44 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 14:44 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 14:44 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 14:44 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 14:44 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 14:44 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 14:44 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 14:44 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 14:44 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 14:44 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 14:44 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 14:44 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 14:44 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 14:44 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 14:44 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 14:44 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 14:44 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 14:44 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 14:44 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 14:44 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 14:44 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 14:41 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 14:41 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 14:41 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 14:41 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 14:41 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 14:41 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 14:41 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-05-28 21:04 - 2014-06-13 00:19 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Amazon Cloud Player
2014-05-25 22:01 - 2014-05-25 22:01 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ___RD () C:\Program Files\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders =======

2014-06-20 17:29 - 2014-06-20 17:26 - 00016441 _____ () C:\Users\toshiba\Downloads\FRST.txt
2014-06-20 17:29 - 2013-07-24 18:28 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-20 17:27 - 2014-06-20 17:26 - 00000000 ____D () C:\FRST
2014-06-20 17:27 - 2010-12-10 16:39 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-06-20 17:25 - 2014-06-20 17:25 - 01073152 _____ (Farbar) C:\Users\toshiba\Downloads\FRST.exe
2014-06-20 17:23 - 2014-04-09 15:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-20 17:22 - 2014-04-09 16:15 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-06-20 17:22 - 2014-04-09 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-06-20 17:22 - 2014-04-09 15:49 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-06-20 17:22 - 2014-04-09 15:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-06-20 17:21 - 2014-04-09 16:15 - 00000000 ____D () C:\Program Files\WinRAR
2014-06-20 17:20 - 2009-07-14 06:34 - 00014304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-20 17:20 - 2009-07-14 06:34 - 00014304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-20 17:15 - 2013-07-23 12:38 - 01464849 _____ () C:\Windows\WindowsUpdate.log
2014-06-20 17:09 - 2013-07-24 18:28 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-20 17:09 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-20 17:09 - 2009-07-14 06:39 - 00062388 _____ () C:\Windows\setupact.log
2014-06-20 17:00 - 2014-06-20 16:59 - 13354502 _____ () C:\Users\toshiba\Downloads\The_Saturdays_-_If_this_is_love_-_Single.rar
2014-06-20 12:28 - 2014-06-20 12:28 - 00000000 ____D () C:\Users\toshiba\Downloads\Cher_Lloyd-Sorry_Im_Late-_Deluxe_Edition_-2014-MTD
2014-06-20 01:52 - 2014-04-09 12:41 - 00000647 _____ () C:\Users\toshiba\Documents\Ausgaben.txt
2014-06-20 01:15 - 2014-04-09 15:17 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Spotify
2014-06-20 00:46 - 2014-04-09 15:18 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Spotify
2014-06-19 22:55 - 2010-12-10 14:57 - 01619832 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-19 22:52 - 2014-04-09 14:44 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\foobar2000
2014-06-19 21:57 - 2014-06-19 21:40 - 414291165 _____ () C:\Users\toshiba\Downloads\Behaving Badly.mp4
2014-06-19 21:49 - 2014-04-09 14:55 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Last.fm
2014-06-19 21:11 - 2014-06-19 21:10 - 00000000 ____D () C:\Users\toshiba\Downloads\Blackout - Single
2014-06-19 21:09 - 2014-04-09 15:33 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\vlc
2014-06-19 20:40 - 2014-06-19 20:40 - 00000000 ____D () C:\Users\toshiba\Downloads\Home (feat. will.i.am) - Single
2014-06-19 20:40 - 2014-06-19 20:39 - 00000000 ____D () C:\Users\toshiba\Downloads\Fuel My Fire - Single
2014-06-19 20:33 - 2014-06-19 20:33 - 00000000 ____D () C:\Users\toshiba\Downloads\Too Much (From Zapped) - Single
2014-06-19 20:33 - 2014-06-18 12:58 - 00000000 ____D () C:\Users\toshiba\Downloads\Don't Stop - EP
2014-06-19 17:00 - 2014-04-09 12:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-19 11:18 - 2014-06-19 12:35 - 16290428 _____ () C:\Users\toshiba\Desktop\Work Bitch.mp4
2014-06-19 11:12 - 2014-06-19 12:35 - 02787214 _____ () C:\Users\toshiba\Desktop\Starships Heaven.mp4
2014-06-18 15:58 - 2013-08-19 10:44 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\SoftGrid Client
2014-06-18 11:41 - 2014-06-18 11:40 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-17 17:54 - 2014-06-17 17:54 - 00001720 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-17 17:54 - 2014-06-17 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-17 17:53 - 2014-06-17 17:51 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-17 17:53 - 2014-06-17 17:51 - 00000000 ____D () C:\Program Files\iTunes
2014-06-17 17:51 - 2014-06-17 17:51 - 00000000 ____D () C:\Program Files\iPod
2014-06-17 17:51 - 2014-04-09 16:28 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-06-17 17:23 - 2014-04-09 21:31 - 00000445 _____ () C:\Users\toshiba\Desktop\Downloads.lnk
2014-06-17 15:50 - 2014-04-09 21:08 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Mp3tag
2014-06-15 14:51 - 2014-05-12 01:26 - 00138097 _____ () C:\Users\toshiba\Documents\charts.wlmp
2014-06-13 14:36 - 2014-04-11 16:26 - 00000000 ____D () C:\Program Files\Recuva
2014-06-13 09:00 - 2014-04-09 17:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-13 08:50 - 2014-04-09 17:08 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-13 00:19 - 2014-05-28 21:04 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Amazon Cloud Player
2014-06-09 20:08 - 2014-05-12 00:54 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Windows Live
2014-06-03 20:03 - 2014-05-11 15:08 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Skype
2014-05-30 11:18 - 2014-06-12 14:44 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 14:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 14:44 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 14:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 14:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 14:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 14:44 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 14:44 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 14:44 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 14:44 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 14:44 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 14:44 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 14:44 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 14:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 14:44 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 14:44 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 14:44 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 14:44 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 14:44 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 14:44 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 14:44 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 14:44 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 14:44 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 14:44 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 14:44 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 14:44 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 14:44 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 14:44 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-29 00:34 - 2014-06-20 12:57 - 00000000 ____D () C:\Users\toshiba\Downloads\Cher Lloyd - Sorry I'm Late Sorry I'm Late (Deluxe Target Edition) (2014)
2014-05-28 12:58 - 2014-04-11 22:34 - 00000000 ____D () C:\Users\toshiba\dwhelper
2014-05-25 22:01 - 2014-05-25 22:01 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ___RD () C:\Program Files\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-25 22:00 - 2010-12-10 16:47 - 00000000 ____D () C:\ProgramData\Skype

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-19 13:24

==================== End Of Log ============================

--- --- ---

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:20-06-2014
Ran by toshiba at 2014-06-20 17:30:17
Running from C:\Users\toshiba\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe AIR (HKLM\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe AIR (Version: 14.0.0.110 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.0.0.564 - Amazon Services LLC)
Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{5494B59E-6E82-499E-91AC-C53199955EC5}) (Version: 1.00.0004 - Atheros Communications)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.0 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{450A9893-DEF7-5DA9-7B71-229EC3F08CB3}) (Version: 3.0.804.0 - ATI Technologies, Inc.)
avast! Free Antivirus (HKLM\...\avast) (Version: 9.0.2018 - Avast Software)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2010.1110.1539.28046 - ATI) Hidden
Catalyst Control Center Localization All (Version: 2010.1110.1539.28046 - ATI) Hidden
CCC Help Chinese Standard (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Czech (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Danish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Dutch (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help English (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Finnish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help French (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help German (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Greek (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Hungarian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Italian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Japanese (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Korean (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Norwegian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Polish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Portuguese (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Russian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Spanish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Swedish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Thai (Version: 2010.1110.1538.28046 - ATI) Hidden
ccc-core-static (Version: 2010.1110.1539.28046 - Ihr Firmenname) Hidden
ccc-utility (Version: 2010.1110.1539.28046 - ATI) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
foobar2000 v1.3.1 (HKLM\...\foobar2000) (Version: 1.3.1 - Peter Pawlowski)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
iTunes (HKLM\...\{0718A90E-93AA-49AF-A4FE-0165ACD91DF0}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 55 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217051FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Last.fm Scrobbler 2.1.36 (HKLM\...\LastFM_is1) (Version:  - Last.fm)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM\...\{2C303EE0-A595-3543-A71A-931C7AC40EDE}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 16.002.03.03.511 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.58 (HKLM\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PhotoScape (HKLM\...\PhotoScape) (Version:  - )
Portrait Professional Studio 10.9 (HKLM\...\Portrait Professional Studio 10 PREACTIVATED by .:sHaRe:._is1) (Version: 10.9 - )
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.30.1019.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6246 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30123 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.1.3C - TOSHIBA CORPORATION)
TOSHIBA Flash Cards Support Utility (Version: 1.63.1.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.31C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (Version: 1.63.0.31C - TOSHIBA CORPORATION) Hidden
Toshiba Manuals (HKLM\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.02 - TOSHIBA)
TOSHIBA Media Controller (HKLM\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.85.4 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.5 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator Reminder (HKLM\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA ReelTime (HKLM\...\InstallShield_{8CD0B97D-46E9-4293-B467-A24DB96DB6DB}) (Version: 1.7.16.32 - TOSHIBA Corporation)
TOSHIBA ReelTime (Version: 1.7.16.32 - TOSHIBA Corporation) Hidden
TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.45 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.1.6 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (Version: 1.63.51.2C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.51.2C - TOSHIBA CORPORATION)
Toshiba TEMPRO (HKLM\...\{DBB7021A-3437-446F-ACE5-7261644A972C}) (Version: 3.33 - Toshiba Europe GmbH)
TOSHIBA Web Camera Application (HKLM\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 1.1.5.7 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (Version: 1.1.5.7 - TOSHIBA Corporation) Hidden
Utility Common Driver (Version: 1.0.52.1C - TOSHIBA) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 5.10 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
WMV9/VC-1 Video Playback (Version: 1.0.51110.1535 - ATI Technologies Inc.) Hidden
Wondershare Dr.Fone for Android(Build 4.2.1.76) (HKLM\...\{1DB91A95-C548-4BA5-9D4C-18C7DEAAC39F}_is1) (Version: 4.2.1.76 - Wondershare Software Co.,Ltd.)

==================== Restore Points  =========================

10-06-2014 09:05:07 Windows Update
13-06-2014 06:47:21 Windows Update
17-06-2014 12:26:15 Windows Update
20-06-2014 13:59:07 Installed STOPzilla
20-06-2014 14:33:28 STOPzilla Restore Point.
20-06-2014 15:15:58 Removed STOPzilla

==================== Hosts content: ==========================

2009-07-14 04:04 - 2014-06-20 16:03 - 00000860 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {29626820-35C1-4624-9217-1D5C743EB035} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-02] (AVAST Software)
Task: {383BEDD2-B8B6-43E5-9F74-D0D2093833BF} - System32\Tasks\toshiba Local Autobackup 5 4 => C:\Program Files\Nero\Nero 10\Nero BackItUp\NBCore.exe
Task: {4FACB137-D8F7-4F96-B3D0-0AA255084A82} - System32\Tasks\toshiba NBAgent 5 4 => C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
Task: {613AB6F5-4CC6-4095-93CE-10D91D82A240} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-20] (Adobe Systems Incorporated)
Task: {68233134-9468-4614-98AC-6ACA1A05A708} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-24] (Google Inc.)
Task: {892599D8-FB8B-4730-BD4D-9E8A134E2CC3} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3911603531-60462317-1733039333-1000
Task: {91CD4CE7-AD84-4A5C-9FDB-0A4F43FE6190} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A346D0F6-CEDF-46E2-AB94-94B6655CAB59} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-24] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-20 11:58 - 2014-06-20 11:58 - 02783232 _____ () C:\Program Files\AVAST Software\Avast\defs\14062000\algo.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-04-09 14:36 - 2014-04-09 14:36 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-06-13 00:19 - 2014-06-05 00:18 - 03162944 _____ () C:\Users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe
2010-05-08 13:48 - 2010-05-08 13:48 - 00229376 _____ () C:\ProgramData\DatacardService\DCService.exe
2014-06-18 11:40 - 2014-06-18 11:41 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (whitelisted) =============



HKU\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Classes\.exe: exefile =>  <===== ATTENTION!
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Classes\exefile:  <===== ATTENTION!

==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupreg: 00TCrdMain => %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: HWSetup => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
MSCONFIG\startupreg: ITSecMng => %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KeNotify => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
MSCONFIG\startupreg: NBAgent => "c:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe" /WinStart
MSCONFIG\startupreg: RocketDock => "C:\Program Files\RocketDock\RocketDock.exe"
MSCONFIG\startupreg: SmoothView => %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
MSCONFIG\startupreg: Spotify => "C:\Users\toshiba\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SVPWUTIL => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: Teco => "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r
MSCONFIG\startupreg: TOSHIBA Online Product Information => C:\Program Files\TOSHIBA\TOSHIBA Online Product Information\topi.exe
MSCONFIG\startupreg: Toshiba Registration => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
MSCONFIG\startupreg: Toshiba TEMPRO => C:\Program Files\Toshiba TEMPRO\TemproTray.exe
MSCONFIG\startupreg: ToshibaServiceStation => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe /hide:60
MSCONFIG\startupreg: TosNC => %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosSENotify => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
MSCONFIG\startupreg: TosVolRegulator => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
MSCONFIG\startupreg: TPwrMain => %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
MSCONFIG\startupreg: TSleepSrv => %ProgramFiles%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

==================== Faulty Device Manager Devices =============

Name: CDC Abstract Control Model (ACM)
Description: CDC Abstract Control Model (ACM)
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/20/2014 04:10:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x10d0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/20/2014 04:02:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/19/2014 09:39:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1394
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/13/2014 08:20:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/13/2014 01:34:54 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/11/2014 05:21:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/11/2014 11:12:45 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Error: XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml. Type: 94::InvalidSignature.

Error: (06/11/2014 11:12:44 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml.

Error: (06/11/2014 08:58:21 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/06/2014 06:51:46 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (06/20/2014 05:09:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "szkgfs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/20/2014 05:09:43 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom
is3srv
szkgfs

Error: (06/20/2014 05:09:15 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/20/2014 05:08:56 PM) (Source: EventLog) (EventID: 6008) (User: )
Description: Das System wurde zuvor am ‎20.‎06.‎2014 um 17:06:33 unerwartet heruntergefahren.

Error: (06/20/2014 04:03:36 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "szkgfs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/20/2014 04:02:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "szkgfs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/20/2014 03:51:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "DCService.exe" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/20/2014 03:51:46 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "TOSHIBA Optical Disc Drive Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (06/20/2014 01:45:01 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (06/20/2014 01:44:46 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (06/20/2014 04:10:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b10d001cf8c8a063f5650C:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dlla87eabf2-f884-11e3-9027-1c75087a7c42

Error: (06/20/2014 04:02:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files\STOPzilla!\STOPzilla.exe

Error: (06/19/2014 09:39:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b139401cf8bed0add92bdC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll5f8d1ff4-f7e9-11e3-bea0-1c75087a7c42

Error: (06/13/2014 08:20:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/13/2014 01:34:54 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/11/2014 05:21:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"c:\program files\TOSHIBA\toshiba sleep utility\SetupProp64.exe

Error: (06/11/2014 11:12:45 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Error: XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml. Type: 94::InvalidSignature.

Error: (06/11/2014 11:12:44 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml.

Error: (06/11/2014 08:58:21 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/06/2014 06:51:46 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"c:\program files\TOSHIBA\toshiba sleep utility\SetupProp64.exe


==================== Memory info =========================== 

Percentage of memory in use: 78%
Total physical RAM: 747.64 MB
Available physical RAM: 160.79 MB
Total Pagefile: 1771.64 MB
Available Pagefile: 865.95 MB
Total Virtual: 2047.88 MB
Available Virtual: 1914.64 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:116.44 GB) (Free:79.05 GB) NTFS
Drive d: (Data) (Fixed) (Total:116.05 GB) (Free:30.28 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 4126374A)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=116 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=116 GB) - (Type=07 NTFS)

==================== End Of Log ============================

M-K-D-B · 20.06.2014, 17:11

Zitat:

Running from C:\Users\toshiba\Downloads

Alle Tools direkt auf den Desktop downloaden bzw. dorthin verschieben und vom Desktop starten, da unsere Anleitungen daraufhin ausgelegt sind.
Zudem lassen sich dann am Ende der Bereinigung alle verwendeten Tools sehr einfach entfernen.

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Phill23 · 20.06.2014, 17:37

Okay, werde ich heute leider nicht mehr schaffen, werde das Ergebnis dann morgen Mittag/Nachmittag posten

M-K-D-B · 20.06.2014, 17:49

ok, bis morgen.

Phill23 · 21.06.2014, 11:32

So da bin ich wieder

Code:

ATTFilter

ComboFix 14-06-21.02 - toshiba 21.06.2014  11:58:57.1.2 - x86
Microsoft Windows 7 Starter   6.1.7601.1.1252.49.1031.18.748.128 [GMT 2:00]
ausgeführt von:: c:\users\toshiba\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_DCService.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-05-21 bis 2014-06-21  ))))))))))))))))))))))))))))))
.
.
2014-06-21 10:19 . 2014-06-21 10:19	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-06-20 15:26 . 2014-06-20 15:32	--------	d-----w-	C:\FRST
2014-06-20 10:12 . 2014-06-05 10:54	8140904	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{C4E47F48-A27D-4E3C-9C3A-82573E10BC31}\mpengine.dll
2014-06-17 15:51 . 2014-06-17 15:51	--------	d-----w-	c:\program files\iPod
2014-06-17 15:51 . 2014-06-17 15:53	--------	d-----w-	c:\programdata\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-17 15:51 . 2014-06-17 15:53	--------	d-----w-	c:\program files\iTunes
2014-06-12 22:18 . 2014-06-18 10:55	--------	d-----w-	c:\users\toshiba\AppData\Local\Amazon Music
2014-06-12 12:41 . 2014-04-05 02:25	1294272	----a-w-	c:\windows\system32\drivers\tcpip.sys
2014-06-12 12:41 . 2014-04-05 02:24	187840	----a-w-	c:\windows\system32\drivers\FWPKCLNT.SYS
2014-06-12 12:41 . 2014-03-26 14:27	1389056	----a-w-	c:\windows\system32\msxml6.dll
2014-06-12 12:41 . 2014-03-26 14:27	1237504	----a-w-	c:\windows\system32\msxml3.dll
2014-06-12 12:41 . 2014-03-26 14:25	2048	----a-w-	c:\windows\system32\msxml6r.dll
2014-06-12 12:41 . 2014-03-26 14:25	2048	----a-w-	c:\windows\system32\msxml3r.dll
2014-06-12 12:41 . 2014-04-25 02:06	626688	----a-w-	c:\windows\system32\usp10.dll
2014-05-28 19:04 . 2014-06-12 22:19	--------	d-----w-	c:\users\toshiba\AppData\Local\Amazon Cloud Player
2014-05-25 20:01 . 2014-05-25 20:01	--------	d-----w-	c:\users\toshiba\AppData\Local\Skype
2014-05-25 20:00 . 2014-05-25 20:00	--------	d-----w-	c:\program files\Common Files\Skype
2014-05-25 20:00 . 2014-05-25 20:00	--------	d-----r-	c:\program files\Skype
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-20 15:22 . 2014-04-09 13:49	699056	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2014-06-20 15:22 . 2014-04-09 13:49	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-15 21:33 . 2014-04-09 12:37	68312	----a-w-	c:\windows\system32\drivers\aswstm.sys
2014-05-15 21:33 . 2014-04-09 11:44	411680	----a-w-	c:\windows\system32\drivers\aswsp.sys
2014-05-15 21:33 . 2014-04-09 11:43	777488	----a-w-	c:\windows\system32\drivers\aswsnx.sys
2014-05-09 07:06 . 2014-05-15 12:03	369664	----a-w-	c:\windows\system32\aepdu.dll
2014-05-09 07:04 . 2014-05-15 12:03	302592	----a-w-	c:\windows\system32\aeinv.dll
2014-05-04 16:58 . 2014-05-04 16:58	851176	----a-w-	c:\windows\system32\WinUSBCoInstaller2.dll
2014-05-04 16:53 . 2014-05-04 16:53	80184	----a-w-	c:\windows\system32\drivers\ssudbus.sys
2014-05-02 09:32 . 2014-04-09 12:23	180632	----a-w-	c:\windows\system32\drivers\aswVmm.sys
2014-05-02 09:32 . 2014-04-09 11:43	776976	----a-w-	c:\windows\system32\drivers\aswsnx.sys.1400189633800
2014-05-02 09:32 . 2014-04-09 11:44	411552	----a-w-	c:\windows\system32\drivers\aswsp.sys.1400189633800
2014-05-02 09:32 . 2014-05-02 09:32	24184	----a-w-	c:\windows\system32\drivers\aswHwid.sys
2014-05-02 09:32 . 2014-04-09 12:23	49944	----a-w-	c:\windows\system32\drivers\aswRvrt.sys
2014-05-02 09:32 . 2014-04-09 11:43	67824	----a-w-	c:\windows\system32\drivers\aswMonFlt.sys
2014-05-02 09:32 . 2014-04-09 11:44	81768	----a-w-	c:\windows\system32\drivers\aswRdr2.sys
2014-05-02 09:32 . 2014-05-02 09:32	43152	----a-w-	c:\windows\avastSS.scr
2014-05-02 09:32 . 2014-04-09 11:35	271264	----a-w-	c:\windows\system32\aswBoot.exe
2014-04-14 18:13 . 2014-04-26 11:51	94632	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2014-04-12 07:13 . 2014-04-12 07:13	194048	----a-w-	c:\windows\system32\elshyph.dll
2014-04-12 07:13 . 2014-04-12 07:13	71680	----a-w-	c:\windows\system32\RegisterIEPKEYs.exe
2014-04-12 07:13 . 2014-04-12 07:13	645120	----a-w-	c:\windows\system32\jsIntl.dll
2014-04-12 07:13 . 2014-04-12 07:13	182272	----a-w-	c:\windows\system32\msls31.dll
2014-04-12 07:13 . 2014-04-12 07:13	62464	----a-w-	c:\windows\system32\tdc.ocx
2014-04-12 07:13 . 2014-04-12 07:13	337408	----a-w-	c:\windows\system32\html.iec
2014-04-12 07:13 . 2014-04-12 07:13	24576	----a-w-	c:\windows\system32\licmgr10.dll
2014-04-12 07:13 . 2014-04-12 07:13	139264	----a-w-	c:\windows\system32\wextract.exe
2014-04-12 07:13 . 2014-04-12 07:13	151552	----a-w-	c:\windows\system32\iexpress.exe
2014-04-12 07:13 . 2014-04-12 07:13	13312	----a-w-	c:\windows\system32\mshta.exe
2014-04-12 07:13 . 2014-04-12 07:13	61952	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-04-12 07:13 . 2014-04-12 07:13	36352	----a-w-	c:\windows\system32\imgutil.dll
2014-04-12 07:13 . 2014-04-12 07:13	74240	----a-w-	c:\windows\system32\SetIEInstalledDate.exe
2014-04-12 07:13 . 2014-04-12 07:13	111616	----a-w-	c:\windows\system32\IEAdvpack.dll
2014-04-12 07:13 . 2014-04-12 07:13	86016	----a-w-	c:\windows\system32\iesysprep.dll
2014-04-12 07:13 . 2014-04-12 07:13	48640	----a-w-	c:\windows\system32\mshtmler.dll
2014-04-12 02:15 . 2014-05-15 12:02	136640	----a-w-	c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 02:15 . 2014-05-15 12:02	67520	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2014-04-12 02:12 . 2014-05-15 12:02	100352	----a-w-	c:\windows\system32\sspicli.dll
2014-04-12 02:12 . 2014-05-15 12:02	15872	----a-w-	c:\windows\system32\sspisrv.dll
2014-04-12 02:12 . 2014-05-15 12:02	22016	----a-w-	c:\windows\system32\secur32.dll
2014-04-12 02:11 . 2014-05-15 12:03	1059840	----a-w-	c:\windows\system32\lsasrv.dll
2014-04-12 02:11 . 2014-05-15 12:02	22528	----a-w-	c:\windows\system32\lsass.exe
2014-03-31 07:35 . 2010-12-10 13:06	231584	------w-	c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-05-02 09:31	260976	----a-w-	c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-05-18 1176632]
"Amazon Music"="c:\users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe" [2014-06-04 3162944]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-11-16 9874024]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RtHDVBg.exe" [2010-11-11 1522280]
"AvastUI.exe"="c:\program files\AVAST Software\Avast\AvastUI.exe" [2014-06-06 3890208]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2014-01-17 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-05-26 152392]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-07-28 280576]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
TRDCReminder.lnk - c:\program files\TOSHIBA\TRDCReminder\TRDCReminder.exe [2009-9-1 481184]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 08:36	958576	----a-r-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2013-05-08 21:20	41056	----a-w-	c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HWSetup]
2010-03-04 14:44	425984	----a-w-	c:\program files\TOSHIBA\Utilities\HWSetup.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2014-05-26 17:12	152392	----a-w-	c:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KeNotify]
2010-09-14 05:14	35440	----a-w-	c:\program files\TOSHIBA\Utilities\KeNotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify]
2014-05-18 23:50	6170168	----a-w-	c:\users\toshiba\AppData\Roaming\Spotify\spotify.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2014-05-18 23:50	1176632	----a-w-	c:\users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StartCCC]
2010-11-10 13:32	336384	----a-w-	c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SVPWUTIL]
2010-11-09 10:09	532480	----a-w-	c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2010-03-10 16:49	1697064	----a-w-	c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba Registration]
2010-04-19 12:40	136136	----a-w-	c:\program files\TOSHIBA\Registration\ToshibaReminder.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Toshiba TEMPRO]
2010-05-11 08:41	1050072	----a-w-	c:\program files\Toshiba TEMPRO\TemproTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ToshibaServiceStation]
2010-07-01 08:59	1295224	----a-w-	c:\program files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosReelTimeMonitor]
2010-07-09 18:21	31648	----a-w-	c:\program files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TosVolRegulator]
2009-11-11 12:31	22840	----a-w-	c:\program files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TSleepSrv]
2010-06-04 14:32	252792	----a-w-	c:\program files\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TWebCamera]
2010-11-02 10:01	2475384	----a-w-	c:\program files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe
.
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~1\mcafee\SITEAD~1\mcsacore.exe [x]
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys [x]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-10-23 172192]
R3 BtFilter;Bluetooth LowerFilter Class Filter Driver;c:\windows\system32\DRIVERS\btfilter.sys [2010-10-18 33640]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [2014-05-04 80184]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [2010-03-20 101504]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [2010-04-07 204800]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe [2014-05-30 108032]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-07-20 194664]
R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files\Toshiba TEMPRO\TemproSvc.exe [2010-05-11 124368]
R3 TMachInfo;TMachInfo;c:\program files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2010-07-01 51576]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 51040]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2010-08-14 63616]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2010-08-14 32384]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys [2014-05-15 777488]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2014-05-15 411680]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-11-09 176128]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys [2014-05-02 24184]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys [2014-05-02 67824]
S2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys [2014-05-15 68312]
S2 cvhsvc;Client Virtualization Handler;c:\program files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2013-04-22 822504]
S2 IconMan_R;IconMan_R;c:\program files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2010-08-04 1809920]
S2 sftlist;Application Virtualization Client;c:\program files\Microsoft Application Virtualization Client\sftlist.exe [2013-06-26 523944]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-09-24 102416]
S3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [2010-04-09 63616]
S3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys [2009-06-22 24064]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2010-10-19 322664]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2013-06-26 583848]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2013-06-26 197800]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2013-06-26 24232]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2013-06-26 20136]
S3 sftvsa;Application Virtualization Service Agent;c:\program files\Microsoft Application Virtualization Client\sftvsa.exe [2013-06-26 207528]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	SSDPSRV upnphost SCardSvr TBS fdrespub AppIDSvc QWAVE wcncsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-06-13 07:32	1091912	----a-w-	c:\program files\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-06-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-09 15:22]
.
2014-06-21 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-07-24 16:28]
.
2014-06-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2013-07-24 16:28]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Zu TOSHIBA Bulletin Board hinzufügen - c:\program files\TOSHIBA\BulletinBoard\TosBBCom.dll/1000
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{013054FD-81BA-44D0-9BE9-E798D45A925C}: NameServer = 193.189.244.206 193.189.244.225
TCP: Interfaces\{7DCE7013-4574-42CF-A404-68C4DCFCC17E}: NameServer = 193.189.244.225 193.189.244.206
FF - ProfilePath - c:\users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\
FF - prefs.js: network.proxy.type - 2
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-00TCrdMain - c:\program files\TOSHIBA\FlashCards\TCrdMain.exe
MSConfigStartUp-ITSecMng - c:\program files\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe
MSConfigStartUp-NBAgent - c:\program files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
MSConfigStartUp-RocketDock - c:\program files\RocketDock\RocketDock.exe
MSConfigStartUp-SmoothView - c:\program files\Toshiba\SmoothView\SmoothView.exe
MSConfigStartUp-Teco - c:\program files\TOSHIBA\TECO\Teco.exe
MSConfigStartUp-TOSHIBA Online Product Information - c:\program files\TOSHIBA\TOSHIBA Online Product Information\topi.exe
MSConfigStartUp-TosNC - c:\program files\Toshiba\BulletinBoard\TosNcCore.exe
MSConfigStartUp-TosSENotify - c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
MSConfigStartUp-TPwrMain - c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_125_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil32_14_0_0_125_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]
@="?????????????????? v1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]
@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]
@="?????????????????? v2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]
@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\AVAST Software\Avast\AvastSvc.exe
c:\windows\system32\taskhost.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\TODDSrv.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\windows\system32\conhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-06-21  12:30:04 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-06-21 10:30
.
Vor Suchlauf: 7 Verzeichnis(se), 85.493.788.672 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 84.875.558.912 Bytes frei
.
- - End Of File - - A4EDC461BA94D2E60A87187BFC62DC60
A36C5E4F47E84449FF07ED3517B43A31

M-K-D-B · 21.06.2014, 14:25

Schritt 1
Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2
Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Schritt 3
Bitte deaktiviere dein Anti-Viren-Programm, da es das Ergebnis beeinflussen oder ggf. die Bereinigung stören kann.
Bitte lade dir zoek.exe von hier: http://hijackthis.nl/smeenk/ und speichere die Datei auf deinem Desktop.

Starte Zoek.exe mit einem Doppelklick.
Achtung: Das folgende Skript wurde nur für diesen speziellen Fall geschrieben und könnte andere Computer beschädigen.
Kopiere den Text der folgenden Box in das Skriptfenster von zoek:
Code:
ATTFilter
```
iedefaults;
resetIEproxy;
FFdefaults;
CHRdefaults;
emptyclsid;
autoclean;
         
```
Nun klicke auf "Run script" und sei geduldig bis das Skript durchgelaufen ist.
Wenn das Tool fertig ist, wird sich Notepad mit der Logdatei öffnen (ggf. erst nach einem Neustart). Das Log befindet sich aber auch noch unter c:\ .
Bitte poste mir das ZOEK-Log (möglichst in CODE-Tags - #-Symbol im Antwortfenster klicken).

Schritt 4

Starte die FRST.exe erneut. Setze einen Haken vor Addition.txt und drücke auf Scan.
FRST erstellt wieder zwei Logdateien (FRST.txt und Addition.txt).
Poste mir beide Logdateien mit deiner nächsten Antwort.

Bitte poste mit deiner nächsten Antwort

die Logdatei von AdwCleaner,
die Logdatei von MBAM,
die Logdatei von Zoek,
die beiden neuen Logdateien von FRST.

Phill23 · 21.06.2014, 17:38

So ich hab jetzt alles gemacht, nur kann ich beim Malwarebytes keine Log-Datei erstellen. Mein Netbook-Display ist irgendwie zu klein und ich komm mit der Maus nicht zu dem Feld wo exportieren steht. Hab mal den Inhalt der XML Datei kopiert, vielleicht geht das ja auch.

ADW Cleaner

Code:

ATTFilter

# AdwCleaner v3.212 - Bericht erstellt am 21/06/2014 um 16:46:29
# Aktualisiert 05/06/2014 von Xplode
# Betriebssystem : Windows 7 Starter Service Pack 1 (32 bits)
# Benutzername : toshiba - TOSHIBA-TOSH
# Gestartet von : C:\Users\toshiba\Desktop\adwcleaner_3.212.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1EC9510D-A439-4950-9399-B6399EDF9EA7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17126


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\prefs.js ]


-\\ Google Chrome v35.0.1916.153

[ Datei : C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://websearch.relevantsearch.info/?l=1&q={searchTerms}&pid=356&r=2013/10/14&hid=7773490410785272874&lg=EN&cc=DE&unqvl=38
Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN40191177981854511&ctid=CT3312523&UM=1
Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3314759&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP629425A1-F149-4F84-AE51-BCA5F71FA9A8&q={searchTerms}&SSPV=
Gelöscht [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}

*************************

AdwCleaner[R0].txt - [1915 octets] - [21/06/2014 16:38:16]
AdwCleaner[S0].txt - [1840 octets] - [21/06/2014 16:46:29]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1900 octets] ##########

Malware Bytes

Code:

ATTFilter

<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


-<header>

<date>2014/06/21 17:01:20 +0200</date>

<logfile>mbam-log-2014-06-21 (17-01-18).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.00.2.1012</version>

<malware-database>v2014.06.21.08</malware-database>

<rootkit-database>v2014.06.20.01</rootkit-database>

<license>free</license>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x86</arch>

<username>toshiba</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>267721</objects>

<time>1495</time>

<processes>0</processes>

<modules>0</modules>

<keys>0</keys>

<values>0</values>

<datas>0</datas>

<folders>0</folders>

<files>0</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>

<items> </items>

</mbam-log>

Zoesk

Code:

ATTFilter

Zoek.exe v5.0.0.0 Updated 20-06-2014
Tool run by toshiba on 21.06.2014 at 17:36:20,55.
Microsoft Windows 7 Starter  6.1.7601 Service Pack 1 x86
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\toshiba\Desktop\zoek.exe [Scan all users] [Script inserted] 

==== System Restore Info ======================

21.06.2014 17:39:03 Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\prefs.js:

Added to C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\prefs.js:
user_pref("browser.startup.homepage", "hxxp://www.google.com");
user_pref("browser.search.defaulturl", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "hxxp://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "hxxp://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Deleting Files \ Folders ======================

C:\Users\toshiba\.android deleted
C:\Program Files\Wondershare deleted
C:\Program Files\Common Files\Wondershare deleted
C:\Users\toshiba\AppData\Roaming\Wondershare deleted
C:\Users\toshiba\AppData\Local\Wondershare deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare deleted
C:\Users\toshiba\Searches deleted
C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\jetpack deleted

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"wrc@avast.com"="C:\Program Files\AVAST Software\Avast\WebRep\FF" [02.05.2014 11:32]

==== Firefox Extensions ======================

ProfilePath: C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default
- DownloadHelper - %ProfilePath%\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
- ProxMate - Proxy on steroids - %ProfilePath%\extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi
- Adblock Plus - %ProfilePath%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi

AppDir: C:\Program Files\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default
6897943E58D779D1C7CB74191931B1D5	- C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll -	Java(TM) Platform SE 7 U60
7BF7103176DBFC80A31E275F7ED7918C	- C:\Program Files\Java\jre7\bin\dtplugin\npdeployJava1.dll -	Java Deployment Toolkit 7.0.600.19
738C29EAC995029E13333034C1402F56	- C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll -	Shockwave Flash
785105A23650755A8F7A72405EB0D923	- C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll -	Google Update
E30C13DE5E2B96341BD1B0691A9AFB32	- C:\Program Files\QuickTime\Plugins\npqtplugin5.dll -	QuickTime Plug-in 7.7.5
4310CAACD0FF0506C55389F04ED6049F	- C:\Program Files\QuickTime\Plugins\npqtplugin4.dll -	QuickTime Plug-in 7.7.5
08EF980C9444262DB84C5106BCCA990C	- C:\Program Files\QuickTime\Plugins\npqtplugin3.dll -	QuickTime Plug-in 7.7.5
0E56A9CBF2B73E1C3186094C108690CA	- C:\Program Files\QuickTime\Plugins\npqtplugin2.dll -	QuickTime Plug-in 7.7.5
E972DDCDBEFDED34BCB7B2D1035883E5	- C:\Program Files\QuickTime\Plugins\npqtplugin.dll -	QuickTime Plug-in 7.7.5
B5371D2C9017EEE216B5361D600B3543	- C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll -	iTunes Application Detector
01D93217A9EE48DD37072B671378CC9C	- C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll -	Silverlight Plug-In
0CA4180B21C6B728578F3B0433BB740E	- C:\Program Files\VideoLAN\VLC\npvlc.dll -	VLC Web Plugin
AE84791D996D1F05A2446B0C447D937A	- C:\Program Files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll -	Adobe Acrobat
AE84791D996D1F05A2446B0C447D937A	- C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll -	Adobe Acrobat
CF46E0E1398B382CE0CE738C67A38DD1	- C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll -	Windows Live? Photo Gallery
28986F0A2342A033345EF9E70D395E4F	- C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrlui.dll -	Microsoft® Silverlight


==== Chrome Look ======================

ProxMate - Proxy on steroids - toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki

==== Chrome Fix ======================

C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifalmiidchkjjmkkbkoaibpmoeichmki deleted successfully
C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifalmiidchkjjmkkbkoaibpmoeichmki_0.localstorage deleted successfully
C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_ifalmiidchkjjmkkbkoaibpmoeichmki_0.localstorage-journal deleted successfully
C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ifalmiidchkjjmkkbkoaibpmoeichmki deleted successfully

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.de/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
No DefaultScope Set For HKCU

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="hxxp://www.google.de/"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{6A1806CD-94D4-4689-BA73-E35EA1EA9990}"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing  Url="hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"
{57448763-C011-4734-A276-E53BB3BD3B42} Amazon  Url="hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2"
{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Google  Url="hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}"
{B3CE397C-FCBC-433A-87C0-2370055E8814} eBay  Url="hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}"
{D5B78770-6E14-4B0A-BEA4-C81ECBF84D8A} Unknown  Url="Not_Found"

==== Reset Google Chrome ======================

C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\preferences was reset successfully
C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Microsoft\Internet Explorer\SearchScopes\{D5B78770-6E14-4B0A-BEA4-C81ECBF84D8A} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyOverride"="*.local"
"ProxyEnable"=dword:00000000

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\Users\toshiba\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\toshiba\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\toshiba\AppData\Local\Mozilla\Firefox\Profiles\klkk8t64.default\Cache emptied successfully

==== Empty Chrome Cache ======================

C:\Users\toshiba\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=1039 folders=233 107617343 bytes)

==== Empty Temp Folders ======================

C:\Users\Default\AppData\Local\temp emptied successfully
C:\Users\Default User\AppData\Local\temp emptied successfully
C:\Users\Public\AppData\Local\temp emptied successfully
C:\Users\toshiba\AppData\Local\Temp will be emptied at reboot
C:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\Windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\Windows\Temp successfully emptied
C:\Users\toshiba\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on 21.06.2014 at 18:14:18,89 ======================

FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:21-06-2014 01
Ran by toshiba (administrator) on TOSHIBA-TOSH on 21-06-2014 18:16:46
Running from C:\Users\toshiba\Desktop
Platform: Microsoft Windows 7 Starter  Service Pack 1 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Realsil Microelectronics Inc.) C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Spotify Ltd) C:\Users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9874024 2010-11-16] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RtHDVBg.exe [1522280 2010-11-11] (Realtek Semiconductor)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-06] (AVAST Software)
HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
HKU\.DEFAULT\...\RunOnce: [SPReview] - C:\Windows\System32\SPReview\SPReview.exe [280576 2013-07-28] (Microsoft Corporation)
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\Run: [Spotify Web Helper] => C:\Users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-19] (Spotify Ltd)
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\...\Run: [Amazon Music] => C:\Users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe [3162944 2014-06-05] ()
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {57448763-C011-4734-A276-E53BB3BD3B42} URL = hxxp://www.amazon.de/gp/search?ie=UTF8&keywords={searchTerms}&tag=tochibade-win7-ie-search-21&index=blended&linkCode=ur2
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}
SearchScopes: HKCU - {B3CE397C-FCBC-433A-87C0-2370055E8814} URL = hxxp://rover.ebay.com/rover/1/707-44556-9400-9/4?satitle={searchTerms}
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
Tcpip\..\Interfaces\{013054FD-81BA-44D0-9BE9-E798D45A925C}: [NameServer]193.189.244.206 193.189.244.225
Tcpip\..\Interfaces\{7DCE7013-4574-42CF-A404-68C4DCFCC17E}: [NameServer]193.189.244.225 193.189.244.206

FireFox:
========
FF ProfilePath: C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default
FF NewTab: hxxp://www.google.com/
FF SearchEngineOrder.1: Google
FF SelectedSearchEngine: Google
FF Homepage: hxxp://www.google.com
FF Keyword.URL: hxxp://www.google.com/search?btnG=Google+Search&q=
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*'))%20%7B%20return%20'PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us07.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @java.com/DTPlugin,version=10.60.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.0.4 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.3 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: DownloadHelper - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-04-09]
FF Extension: ProxMate - Proxy on steroids! - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\Extensions\jid1-QpHD8URtZWJC2A@jetpack.xpi [2014-04-16]
FF Extension: Adblock Plus - C:\Users\toshiba\AppData\Roaming\Mozilla\Firefox\Profiles\klkk8t64.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-09]
FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-09]

========================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-02] (AVAST Software)
R2 IconMan_R; C:\Program Files\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1809920 2010-08-04] (Realsil Microelectronics Inc.) [File not signed]
S3 TemproMonitoringService; C:\Program Files\Toshiba TEMPRO\TemproSvc.exe [124368 2010-05-11] (Toshiba Europe GmbH)
S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [51576 2010-07-01] (TOSHIBA Corporation)
S2 McAfee SiteAdvisor Service; c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe [X]

==================== Drivers (Whitelisted) ====================

R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [63616 2010-08-14] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [32384 2010-08-14] (Advanced Micro Devices)
R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [24184 2014-05-02] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2014-05-02] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [81768 2014-05-02] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2014-05-02] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [68312 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180632 2014-05-02] ()
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-09-24] (ATI Technologies, Inc.)
S3 BtFilter; C:\Windows\System32\DRIVERS\btfilter.sys [33640 2010-10-18] (Atheros)
R0 LPCFilter; C:\Windows\System32\DRIVERS\LPCFilter.sys [36208 2009-07-30] (COMPAL ELECTRONIC INC.)
R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [24064 2009-06-22] (TOSHIBA Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\toshiba\AppData\Local\Temp\catchme.sys [X]
S2 sbapifs; system32\DRIVERS\sbapifs.sys [X]
S3 Tosrfcom; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-21 18:16 - 2014-06-21 18:20 - 00015047 _____ () C:\Users\toshiba\Desktop\FRST.txt
2014-06-21 18:16 - 2014-06-21 18:16 - 00000000 ____D () C:\Users\toshiba\Desktop\FRST-OlderVersion
2014-06-21 18:10 - 2014-06-21 17:36 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-06-21 17:38 - 2014-06-21 18:14 - 00009744 _____ () C:\zoek-results.log
2014-06-21 17:36 - 2014-06-21 18:05 - 00000000 ____D () C:\zoek_backup
2014-06-21 17:35 - 2014-06-21 17:35 - 01285120 _____ () C:\Users\toshiba\Desktop\zoek.exe
2014-06-21 17:30 - 2014-06-21 17:30 - 00000000 __SHD () C:\Users\toshiba\AppData\Local\EmieUserList
2014-06-21 17:30 - 2014-06-21 17:30 - 00000000 __SHD () C:\Users\toshiba\AppData\Local\EmieSiteList
2014-06-21 16:59 - 2014-06-21 16:59 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-21 16:58 - 2014-06-21 16:58 - 00001027 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-21 16:58 - 2014-06-21 16:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-21 16:58 - 2014-06-21 16:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-21 16:58 - 2014-06-21 16:58 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-21 16:58 - 2014-05-12 07:26 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-06-21 16:58 - 2014-05-12 07:25 - 00074456 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-21 16:58 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-06-21 16:52 - 2014-06-21 16:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\toshiba\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-21 16:40 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
2014-06-21 16:38 - 2014-06-21 16:46 - 00000000 ____D () C:\AdwCleaner
2014-06-21 15:58 - 2014-06-21 15:58 - 01333465 _____ () C:\Users\toshiba\Desktop\adwcleaner_3.212.exe
2014-06-21 14:57 - 2014-06-21 14:57 - 00000000 ____D () C:\Users\toshiba\Downloads\Long Way Home
2014-06-21 12:57 - 2014-06-21 12:57 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-06-21 12:57 - 2014-06-21 12:56 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-06-21 12:56 - 2014-06-21 12:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-06-21 12:56 - 2014-06-21 12:56 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-06-21 12:56 - 2014-06-21 12:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-21 12:56 - 2014-06-21 12:55 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-06-21 12:48 - 2014-06-21 12:55 - 00000000 ____D () C:\Users\toshiba\Downloads\sats
2014-06-21 12:30 - 2014-06-21 12:30 - 00021037 _____ () C:\ComboFix.txt
2014-06-21 11:54 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-21 11:54 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-21 11:54 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-21 11:54 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-21 11:54 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-21 11:54 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-21 11:54 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-21 11:54 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-21 11:53 - 2014-06-21 12:30 - 00000000 ____D () C:\Qoobox
2014-06-21 11:50 - 2014-06-21 12:25 - 00000000 ____D () C:\Windows\erdnt
2014-06-21 11:45 - 2014-06-21 11:46 - 05209566 ____R (Swearware) C:\Users\toshiba\Desktop\ComboFix.exe
2014-06-20 17:30 - 2014-06-20 17:32 - 00030067 _____ () C:\Users\toshiba\Downloads\Addition.txt
2014-06-20 17:26 - 2014-06-21 18:17 - 00000000 ____D () C:\FRST
2014-06-20 17:26 - 2014-06-20 17:32 - 00032988 _____ () C:\Users\toshiba\Downloads\FRST.txt
2014-06-20 17:25 - 2014-06-21 18:16 - 01070592 _____ (Farbar) C:\Users\toshiba\Desktop\FRST.exe
2014-06-20 12:28 - 2014-06-20 12:28 - 00000000 ____D () C:\Users\toshiba\Downloads\Sorry I'm Late
2014-06-19 21:40 - 2014-06-19 21:57 - 414291165 _____ () C:\Users\toshiba\Downloads\Behaving Badly.mp4
2014-06-19 21:10 - 2014-06-19 21:11 - 00000000 ____D () C:\Users\toshiba\Downloads\Blackout - Single
2014-06-19 20:40 - 2014-06-19 20:40 - 00000000 ____D () C:\Users\toshiba\Downloads\Home (feat. will.i.am) - Single
2014-06-19 20:39 - 2014-06-19 20:40 - 00000000 ____D () C:\Users\toshiba\Downloads\Fuel My Fire - Single
2014-06-19 20:33 - 2014-06-19 20:33 - 00000000 ____D () C:\Users\toshiba\Downloads\Too Much (From Zapped) - Single
2014-06-19 12:35 - 2014-06-19 11:18 - 16290428 _____ () C:\Users\toshiba\Desktop\Work Bitch.mp4
2014-06-19 12:35 - 2014-06-19 11:12 - 02787214 _____ () C:\Users\toshiba\Desktop\Starships Heaven.mp4
2014-06-18 12:58 - 2014-06-19 20:33 - 00000000 ____D () C:\Users\toshiba\Downloads\Don't Stop - EP
2014-06-18 11:40 - 2014-06-18 11:41 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-17 17:54 - 2014-06-17 17:54 - 00001720 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-17 17:54 - 2014-06-17 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-17 17:51 - 2014-06-17 17:53 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-17 17:51 - 2014-06-17 17:53 - 00000000 ____D () C:\Program Files\iTunes
2014-06-17 17:51 - 2014-06-17 17:51 - 00000000 ____D () C:\Program Files\iPod
2014-06-12 14:44 - 2014-05-30 11:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 14:44 - 2014-05-30 11:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 14:44 - 2014-05-30 11:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 14:44 - 2014-05-30 10:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 14:44 - 2014-05-30 10:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 14:44 - 2014-05-30 10:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 14:44 - 2014-05-30 10:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 14:44 - 2014-05-30 10:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 14:44 - 2014-05-30 10:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 14:44 - 2014-05-30 10:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 14:44 - 2014-05-30 10:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 14:44 - 2014-05-30 10:28 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 14:44 - 2014-05-30 10:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 14:44 - 2014-05-30 10:21 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 14:44 - 2014-05-30 10:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 14:44 - 2014-05-30 10:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 14:44 - 2014-05-30 10:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 14:44 - 2014-05-30 10:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 14:44 - 2014-05-30 10:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 14:44 - 2014-05-30 09:57 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 14:44 - 2014-05-30 09:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 14:44 - 2014-05-30 09:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 14:44 - 2014-05-30 09:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 14:44 - 2014-05-30 09:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 14:44 - 2014-05-30 09:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 14:44 - 2014-05-30 09:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 14:44 - 2014-05-30 09:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 14:44 - 2014-05-30 09:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 14:41 - 2014-04-25 04:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 14:41 - 2014-04-05 04:25 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 14:41 - 2014-04-05 04:24 - 00187840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 14:41 - 2014-03-26 16:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 14:41 - 2014-03-26 16:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 14:41 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 14:41 - 2014-03-26 16:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-05-28 21:04 - 2014-06-13 00:19 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Amazon Cloud Player
2014-05-25 22:01 - 2014-05-25 22:01 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ___RD () C:\Program Files\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\Program Files\Common Files\Skype

==================== One Month Modified Files and Folders =======

2014-06-21 18:20 - 2014-06-21 18:16 - 00015047 _____ () C:\Users\toshiba\Desktop\FRST.txt
2014-06-21 18:19 - 2013-07-23 12:38 - 01504217 _____ () C:\Windows\WindowsUpdate.log
2014-06-21 18:17 - 2014-06-20 17:26 - 00000000 ____D () C:\FRST
2014-06-21 18:16 - 2014-06-21 18:16 - 00000000 ____D () C:\Users\toshiba\Desktop\FRST-OlderVersion
2014-06-21 18:16 - 2014-06-20 17:25 - 01070592 _____ (Farbar) C:\Users\toshiba\Desktop\FRST.exe
2014-06-21 18:14 - 2014-06-21 17:38 - 00009744 _____ () C:\zoek-results.log
2014-06-21 18:13 - 2013-07-24 21:33 - 00229920 _____ () C:\Windows\PFRO.log
2014-06-21 18:13 - 2013-07-24 18:28 - 00001096 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-21 18:13 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-21 18:13 - 2009-07-14 06:39 - 00062780 _____ () C:\Windows\setupact.log
2014-06-21 18:05 - 2014-06-21 17:36 - 00000000 ____D () C:\zoek_backup
2014-06-21 18:03 - 2013-07-23 15:42 - 00000000 ____D () C:\Users\toshiba
2014-06-21 17:58 - 2014-04-09 15:49 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-21 17:36 - 2014-06-21 18:10 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-06-21 17:35 - 2014-06-21 17:35 - 01285120 _____ () C:\Users\toshiba\Desktop\zoek.exe
2014-06-21 17:30 - 2014-06-21 17:30 - 00000000 __SHD () C:\Users\toshiba\AppData\Local\EmieUserList
2014-06-21 17:30 - 2014-06-21 17:30 - 00000000 __SHD () C:\Users\toshiba\AppData\Local\EmieSiteList
2014-06-21 17:30 - 2014-05-12 00:54 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Windows Live
2014-06-21 17:28 - 2013-07-24 18:28 - 00001100 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-21 16:59 - 2014-06-21 16:59 - 00110296 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-21 16:58 - 2014-06-21 16:58 - 00001027 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-06-21 16:58 - 2014-06-21 16:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-06-21 16:58 - 2014-06-21 16:58 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-21 16:58 - 2014-06-21 16:58 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2014-06-21 16:57 - 2009-07-14 06:34 - 00014304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-21 16:57 - 2009-07-14 06:34 - 00014304 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-21 16:53 - 2014-06-21 16:52 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\toshiba\Desktop\mbam-setup-2.0.2.1012.exe
2014-06-21 16:46 - 2014-06-21 16:38 - 00000000 ____D () C:\AdwCleaner
2014-06-21 16:46 - 2013-08-19 10:44 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\SoftGrid Client
2014-06-21 15:58 - 2014-06-21 15:58 - 01333465 _____ () C:\Users\toshiba\Desktop\adwcleaner_3.212.exe
2014-06-21 15:57 - 2010-12-10 14:57 - 01619832 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-21 14:57 - 2014-06-21 14:57 - 00000000 ____D () C:\Users\toshiba\Downloads\Long Way Home
2014-06-21 13:57 - 2014-04-09 15:33 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\vlc
2014-06-21 12:57 - 2014-06-21 12:57 - 00000000 ____D () C:\Program Files\Common Files\Java
2014-06-21 12:56 - 2014-06-21 12:57 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-06-21 12:56 - 2014-06-21 12:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-06-21 12:56 - 2014-06-21 12:56 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2014-06-21 12:56 - 2014-06-21 12:56 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-06-21 12:55 - 2014-06-21 12:56 - 00175528 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-06-21 12:55 - 2014-06-21 12:48 - 00000000 ____D () C:\Users\toshiba\Downloads\sats
2014-06-21 12:30 - 2014-06-21 12:30 - 00021037 _____ () C:\ComboFix.txt
2014-06-21 12:30 - 2014-06-21 11:53 - 00000000 ____D () C:\Qoobox
2014-06-21 12:30 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2014-06-21 12:30 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2014-06-21 12:25 - 2014-06-21 11:50 - 00000000 ____D () C:\Windows\erdnt
2014-06-21 12:22 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2014-06-21 12:20 - 2009-07-14 04:03 - 42991616 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-06-21 12:20 - 2009-07-14 04:03 - 19136512 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-06-21 12:20 - 2009-07-14 04:03 - 01048576 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-06-21 12:20 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-06-21 12:20 - 2009-07-14 04:03 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-06-21 11:46 - 2014-06-21 11:45 - 05209566 ____R (Swearware) C:\Users\toshiba\Desktop\ComboFix.exe
2014-06-20 17:32 - 2014-06-20 17:30 - 00030067 _____ () C:\Users\toshiba\Downloads\Addition.txt
2014-06-20 17:32 - 2014-06-20 17:26 - 00032988 _____ () C:\Users\toshiba\Downloads\FRST.txt
2014-06-20 17:27 - 2010-12-10 16:39 - 00000000 ____D () C:\Program Files\Common Files\Adobe AIR
2014-06-20 17:22 - 2014-04-09 16:15 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-06-20 17:22 - 2014-04-09 16:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
2014-06-20 17:22 - 2014-04-09 15:49 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-06-20 17:22 - 2014-04-09 15:49 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-06-20 17:21 - 2014-04-09 16:15 - 00000000 ____D () C:\Program Files\WinRAR
2014-06-20 12:28 - 2014-06-20 12:28 - 00000000 ____D () C:\Users\toshiba\Downloads\Sorry I'm Late
2014-06-20 01:52 - 2014-04-09 12:41 - 00000647 _____ () C:\Users\toshiba\Documents\Ausgaben.txt
2014-06-20 01:15 - 2014-04-09 15:17 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Spotify
2014-06-20 00:46 - 2014-04-09 15:18 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Spotify
2014-06-19 22:52 - 2014-04-09 14:44 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\foobar2000
2014-06-19 21:57 - 2014-06-19 21:40 - 414291165 _____ () C:\Users\toshiba\Downloads\Behaving Badly.mp4
2014-06-19 21:49 - 2014-04-09 14:55 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Last.fm
2014-06-19 21:11 - 2014-06-19 21:10 - 00000000 ____D () C:\Users\toshiba\Downloads\Blackout - Single
2014-06-19 20:40 - 2014-06-19 20:40 - 00000000 ____D () C:\Users\toshiba\Downloads\Home (feat. will.i.am) - Single
2014-06-19 20:40 - 2014-06-19 20:39 - 00000000 ____D () C:\Users\toshiba\Downloads\Fuel My Fire - Single
2014-06-19 20:33 - 2014-06-19 20:33 - 00000000 ____D () C:\Users\toshiba\Downloads\Too Much (From Zapped) - Single
2014-06-19 20:33 - 2014-06-18 12:58 - 00000000 ____D () C:\Users\toshiba\Downloads\Don't Stop - EP
2014-06-19 17:00 - 2014-04-09 12:49 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-06-19 11:18 - 2014-06-19 12:35 - 16290428 _____ () C:\Users\toshiba\Desktop\Work Bitch.mp4
2014-06-19 11:12 - 2014-06-19 12:35 - 02787214 _____ () C:\Users\toshiba\Desktop\Starships Heaven.mp4
2014-06-18 11:41 - 2014-06-18 11:40 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-06-17 17:54 - 2014-06-17 17:54 - 00001720 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-06-17 17:54 - 2014-06-17 17:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-06-17 17:53 - 2014-06-17 17:51 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-06-17 17:53 - 2014-06-17 17:51 - 00000000 ____D () C:\Program Files\iTunes
2014-06-17 17:51 - 2014-06-17 17:51 - 00000000 ____D () C:\Program Files\iPod
2014-06-17 17:51 - 2014-04-09 16:28 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-06-17 17:23 - 2014-04-09 21:31 - 00000445 _____ () C:\Users\toshiba\Desktop\Downloads.lnk
2014-06-17 15:50 - 2014-04-09 21:08 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Mp3tag
2014-06-15 14:51 - 2014-05-12 01:26 - 00138097 _____ () C:\Users\toshiba\Documents\charts.wlmp
2014-06-13 14:36 - 2014-04-11 16:26 - 00000000 ____D () C:\Program Files\Recuva
2014-06-13 09:00 - 2014-04-09 17:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-13 08:50 - 2014-04-09 17:08 - 92708840 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-13 00:19 - 2014-05-28 21:04 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Amazon Cloud Player
2014-06-03 20:03 - 2014-05-11 15:08 - 00000000 ____D () C:\Users\toshiba\AppData\Roaming\Skype
2014-05-30 11:18 - 2014-06-12 14:44 - 17271296 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 11:02 - 2014-06-12 14:44 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 11:02 - 2014-06-12 14:44 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 10:44 - 2014-06-12 14:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 10:43 - 2014-06-12 14:44 - 00061952 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 10:42 - 2014-06-12 14:44 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 10:38 - 2014-06-12 14:44 - 02179072 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 10:34 - 2014-06-12 14:44 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 10:33 - 2014-06-12 14:44 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 10:30 - 2014-06-12 14:44 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 10:28 - 2014-06-12 14:44 - 00112128 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 10:28 - 2014-06-12 14:44 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 10:27 - 2014-06-12 14:44 - 00592896 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 10:21 - 2014-06-12 14:44 - 00646144 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 10:16 - 2014-06-12 14:44 - 00368128 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 10:10 - 2014-06-12 14:44 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 10:06 - 2014-06-12 14:44 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 10:04 - 2014-06-12 14:44 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 10:02 - 2014-06-12 14:44 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 09:57 - 2014-06-12 14:44 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 09:56 - 2014-06-12 14:44 - 04244992 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 09:54 - 2014-06-12 14:44 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 09:50 - 2014-06-12 14:44 - 01068032 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 09:49 - 2014-06-12 14:44 - 01964544 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 09:40 - 2014-06-12 14:44 - 11725312 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 09:21 - 2014-06-12 14:44 - 01790976 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 09:15 - 2014-06-12 14:44 - 01143296 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 09:13 - 2014-06-12 14:44 - 00704512 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-28 12:58 - 2014-04-11 22:34 - 00000000 ____D () C:\Users\toshiba\dwhelper
2014-05-25 22:01 - 2014-05-25 22:01 - 00000000 ____D () C:\Users\toshiba\AppData\Local\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ___RD () C:\Program Files\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-25 22:00 - 2014-05-25 22:00 - 00000000 ____D () C:\Program Files\Common Files\Skype
2014-05-25 22:00 - 2010-12-10 16:47 - 00000000 ____D () C:\ProgramData\Skype

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-19 13:24

==================== End Of Log ============================

--- --- ---

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version:21-06-2014 01
Ran by toshiba at 2014-06-21 18:22:07
Running from C:\Users\toshiba\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Disabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Disabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

Adobe AIR (HKLM\...\Adobe AIR) (Version: 14.0.0.110 - Adobe Systems Incorporated)
Adobe AIR (Version: 14.0.0.110 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Reader 9.5.5 - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-A95000000001}) (Version: 9.5.5 - Adobe Systems Incorporated)
Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.0.0.564 - Amazon Services LLC)
Apple Application Support (HKLM\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{18D47FA1-0440-48D3-A7E0-DA09537FF471}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Atheros Bluetooth Filter Driver Package (HKLM\...\{5494B59E-6E82-499E-91AC-C53199955EC5}) (Version: 1.00.0004 - Atheros Communications)
Atheros Driver Installation Program (HKLM\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 9.0 - Atheros)
ATI Catalyst Install Manager (HKLM\...\{450A9893-DEF7-5DA9-7B71-229EC3F08CB3}) (Version: 3.0.804.0 - ATI Technologies, Inc.)
avast! Free Antivirus (HKLM\...\avast) (Version: 9.0.2018 - Avast Software)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (Version: 1.00.0000 - ATI) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2010.1110.1539.28046 - ATI) Hidden
Catalyst Control Center Localization All (Version: 2010.1110.1539.28046 - ATI) Hidden
CCC Help Chinese Standard (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Chinese Traditional (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Czech (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Danish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Dutch (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help English (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Finnish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help French (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help German (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Greek (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Hungarian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Italian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Japanese (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Korean (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Norwegian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Polish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Portuguese (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Russian (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Spanish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Swedish (Version: 2010.1110.1538.28046 - ATI) Hidden
CCC Help Thai (Version: 2010.1110.1538.28046 - ATI) Hidden
ccc-core-static (Version: 2010.1110.1539.28046 - Ihr Firmenname) Hidden
ccc-utility (Version: 2010.1110.1539.28046 - ATI) Hidden
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
foobar2000 v1.3.1 (HKLM\...\foobar2000) (Version: 1.3.1 - Peter Pawlowski)
Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
iTunes (HKLM\...\{0718A90E-93AA-49AF-A4FE-0165ACD91DF0}) (Version: 11.2.2.3 - Apple Inc.)
Java 7 Update 60 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)
Java Auto Updater (Version: 2.1.60.19 - Oracle, Inc.) Hidden
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Last.fm Scrobbler 2.1.36 (HKLM\...\LastFM_is1) (Version:  - Last.fm)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Messenger Companion (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (HKLM\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - Deutsch (HKLM\...\{90140011-0066-0407-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM\...\{2C303EE0-A595-3543-A71A-931C7AC40EDE}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Partner (HKLM\...\Mobile Partner) (Version: 16.002.03.03.511 - Huawei Technologies Co.,Ltd)
Mozilla Firefox 30.0 (x86 de) (HKLM\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Mp3tag v2.58 (HKLM\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PhotoScape (HKLM\...\PhotoScape) (Version:  - )
Portrait Professional Studio 10.9 (HKLM\...\Portrait Professional Studio 10 PREACTIVATED by .:sHaRe:._is1) (Version: 10.9 - )
QuickTime 7 (HKLM\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.30.1019.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6246 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30123 - Realtek Semiconductor Corp.)
Recuva (HKLM\...\Recuva) (Version: 1.51 - Piriform)
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.8.1 - Synaptics Incorporated)
TOSHIBA Flash Cards Support Utility (HKLM\...\InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}) (Version: 1.63.1.3C - TOSHIBA CORPORATION)
TOSHIBA Flash Cards Support Utility (Version: 1.63.1.3C - TOSHIBA CORPORATION) Hidden
TOSHIBA Hardware Setup (HKLM\...\InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}) (Version: 1.63.0.31C - TOSHIBA CORPORATION)
TOSHIBA Hardware Setup (Version: 1.63.0.31C - TOSHIBA CORPORATION) Hidden
Toshiba Manuals (HKLM\...\{90FF4432-21B7-4AF6-BA6E-FB8C1FED9173}) (Version: 10.02 - TOSHIBA)
TOSHIBA Media Controller (HKLM\...\{C7A4F26F-F9B0-41B2-8659-99181108CDE3}) (Version: 1.0.85.4 - TOSHIBA CORPORATION)
TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.5 - TOSHIBA Corporation)
TOSHIBA Recovery Media Creator Reminder (HKLM\...\InstallShield_{773970F1-5EBA-4474-ADEE-1EA3B0A59492}) (Version: 1.00.0019 - TOSHIBA)
TOSHIBA Recovery Media Creator Reminder (Version: 1.00.0019 - TOSHIBA) Hidden
TOSHIBA ReelTime (HKLM\...\InstallShield_{8CD0B97D-46E9-4293-B467-A24DB96DB6DB}) (Version: 1.7.16.32 - TOSHIBA Corporation)
TOSHIBA ReelTime (Version: 1.7.16.32 - TOSHIBA Corporation) Hidden
TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.1.45 - TOSHIBA)
TOSHIBA Sleep Utility (HKLM\...\{654F7484-88C5-46DC-AB32-C66BCB0E2102}) (Version: 1.4.1.6 - TOSHIBA Corporation)
TOSHIBA Supervisor Password (Version: 1.63.51.2C - TOSHIBA CORPORATION) Hidden
TOSHIBA Supervisorkennwort (HKLM\...\InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}) (Version: 1.63.51.2C - TOSHIBA CORPORATION)
Toshiba TEMPRO (HKLM\...\{DBB7021A-3437-446F-ACE5-7261644A972C}) (Version: 3.33 - Toshiba Europe GmbH)
TOSHIBA Web Camera Application (HKLM\...\InstallShield_{6F3C8901-EBD3-470D-87F8-AC210F6E5E02}) (Version: 1.1.5.7 - TOSHIBA Corporation)
TOSHIBA Web Camera Application (Version: 1.1.5.7 - TOSHIBA Corporation) Hidden
Utility Common Driver (Version: 1.0.52.1C - TOSHIBA) Hidden
VLC media player 2.1.3 (HKLM\...\VLC media player) (Version: 2.1.3 - VideoLAN)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mail (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger Companion Core (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinRAR 5.10 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.10.0 - win.rar GmbH)
WMV9/VC-1 Video Playback (Version: 1.0.51110.1535 - ATI Technologies Inc.) Hidden
Wondershare Dr.Fone for Android(Build 4.2.1.76) (HKLM\...\{1DB91A95-C548-4BA5-9D4C-18C7DEAAC39F}_is1) (Version: 4.2.1.76 - Wondershare Software Co.,Ltd.)

==================== Restore Points  =========================

17-06-2014 12:26:15 Windows Update
20-06-2014 13:59:07 Installed STOPzilla
20-06-2014 14:33:28 STOPzilla Restore Point.
20-06-2014 15:15:58 Removed STOPzilla
21-06-2014 15:38:21 zoek.exe restore point

==================== Hosts content: ==========================

2009-07-14 04:04 - 2014-06-21 12:22 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {29626820-35C1-4624-9217-1D5C743EB035} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-05-02] (AVAST Software)
Task: {383BEDD2-B8B6-43E5-9F74-D0D2093833BF} - System32\Tasks\toshiba Local Autobackup 5 4 => C:\Program Files\Nero\Nero 10\Nero BackItUp\NBCore.exe
Task: {4FACB137-D8F7-4F96-B3D0-0AA255084A82} - System32\Tasks\toshiba NBAgent 5 4 => C:\Program Files\Nero\Nero 10\Nero BackItUp\NBAgent.exe
Task: {613AB6F5-4CC6-4095-93CE-10D91D82A240} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-20] (Adobe Systems Incorporated)
Task: {68233134-9468-4614-98AC-6ACA1A05A708} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-24] (Google Inc.)
Task: {892599D8-FB8B-4730-BD4D-9E8A134E2CC3} - System32\Tasks\Games\UpdateCheck_S-1-5-21-3911603531-60462317-1733039333-1000
Task: {91CD4CE7-AD84-4A5C-9FDB-0A4F43FE6190} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A346D0F6-CEDF-46E2-AB94-94B6655CAB59} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-07-24] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2014-06-21 11:44 - 2014-06-21 11:44 - 02783744 _____ () C:\Program Files\AVAST Software\Avast\defs\14062100\algo.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2014-04-09 14:36 - 2014-04-09 14:36 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2014-06-13 00:19 - 2014-06-05 00:18 - 03162944 _____ () C:\Users\toshiba\AppData\Local\Amazon Music\Amazon Music Helper.exe
2014-06-18 11:40 - 2014-06-18 11:41 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"

==================== EXE Association (whitelisted) =============



HKU\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Classes\exefile:  <===== ATTENTION!

==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: HWSetup => C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KeNotify => C:\Program Files\TOSHIBA\Utilities\KeNotify.exe
MSCONFIG\startupreg: Spotify => "C:\Users\toshiba\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\toshiba\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
MSCONFIG\startupreg: StartCCC => "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
MSCONFIG\startupreg: SVPWUTIL => C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
MSCONFIG\startupreg: SynTPEnh => %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
MSCONFIG\startupreg: Toshiba Registration => C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
MSCONFIG\startupreg: Toshiba TEMPRO => C:\Program Files\Toshiba TEMPRO\TemproTray.exe
MSCONFIG\startupreg: ToshibaServiceStation => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe /hide:60
MSCONFIG\startupreg: TosReelTimeMonitor => %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
MSCONFIG\startupreg: TosVolRegulator => C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
MSCONFIG\startupreg: TSleepSrv => %ProgramFiles%\TOSHIBA\TOSHIBA Sleep Utility\TSleepSrv.exe
MSCONFIG\startupreg: TWebCamera => "C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/20/2014 04:10:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x10d0
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/20/2014 04:02:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"1".
Die abhängige Assemblierung "Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/19/2014 09:39:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 30.0.0.5269, Zeitstempel: 0x53914233
Name des fehlerhaften Moduls: mozalloc.dll, Version: 30.0.0.5269, Zeitstempel: 0x53911393
Ausnahmecode: 0x80000003
Fehleroffset: 0x0000141b
ID des fehlerhaften Prozesses: 0x1394
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (06/13/2014 08:20:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/13/2014 01:34:54 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/11/2014 05:21:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (06/11/2014 11:12:45 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
Error: XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml. Type: 94::InvalidSignature.

Error: (06/11/2014 11:12:44 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml.

Error: (06/11/2014 08:58:21 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Nur zur Information.
(Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/06/2014 06:51:46 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"1".
Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (06/21/2014 06:14:11 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (06/21/2014 06:13:52 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/21/2014 06:13:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "sbapifs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/21/2014 06:02:46 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/21/2014 06:02:45 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/21/2014 06:02:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/21/2014 06:02:43 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/21/2014 06:02:42 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.

Error: (06/21/2014 04:49:21 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
cdrom

Error: (06/21/2014 04:49:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (06/20/2014 04:10:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b10d001cf8c8a063f5650C:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dlla87eabf2-f884-11e3-9027-1c75087a7c42

Error: (06/20/2014 04:02:09 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.MFC,processorArchitecture="x86",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.6195"C:\Program Files\STOPzilla!\STOPzilla.exe

Error: (06/19/2014 09:39:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: plugin-container.exe30.0.0.526953914233mozalloc.dll30.0.0.526953911393800000030000141b139401cf8bed0add92bdC:\Program Files\Mozilla Firefox\plugin-container.exeC:\Program Files\Mozilla Firefox\mozalloc.dll5f8d1ff4-f7e9-11e3-bea0-1c75087a7c42

Error: (06/13/2014 08:20:10 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/13/2014 01:34:54 PM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/11/2014 05:21:48 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"c:\program files\TOSHIBA\toshiba sleep utility\SetupProp64.exe

Error: (06/11/2014 11:12:45 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: Error: XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml. Type: 94::InvalidSignature.

Error: (06/11/2014 11:12:44 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: XmlSignature Verification failed for C:\ProgramData\VirtualizedApplications\Patch_working\{90140011-0066-0407-0000-0000000FF1CE}\descriptor.xml.

Error: (06/11/2014 08:58:21 AM) (Source: CVHSVC) (EventID: 100) (User: )
Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt.

Error: (06/06/2014 06:51:46 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50608.0"c:\program files\TOSHIBA\toshiba sleep utility\SetupProp64.exe


==================== Memory info =========================== 

Percentage of memory in use: 67%
Total physical RAM: 747.64 MB
Available physical RAM: 242 MB
Total Pagefile: 1771.64 MB
Available Pagefile: 903.32 MB
Total Virtual: 2047.88 MB
Available Virtual: 1933.98 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:116.44 GB) (Free:78.8 GB) NTFS
Drive d: (Data) (Fixed) (Total:116.05 GB) (Free:30.28 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 4126374A)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=116 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=116 GB) - (Type=07 NTFS)

==================== End Of Log ============================

M-K-D-B · 22.06.2014, 11:43

Noch Probleme mit Ilivid nach den folgenden Schritten? Wenn ja, in welchem Browser?

Wir entfernen die letzten Reste und kontrollieren nochmal alles. ESET kann länger (> 3 h) dauern.
Im Anschluss entfernen wir alle verwendeten Tools und ich gebe dir noch ein paar Tipps mit auf den Weg.

Schritt 1
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

start
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*'))%20%7B%20return%20'PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us07.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Classes\exefile:  <===== ATTENTION!
Reboot:
end

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Schritt 3
Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

Bitte poste mit deiner nächsten Antwort

die Logdatei von FRST,
die Logdatei von ESET,
die Logdatei von SecurityCheck.

Phill23 · 22.06.2014, 12:45

Okay, werde ich dann später noch tun.

ja, das Ilivid-Problem besteht immer noch. Frage mich inzwischen auch ob das nicht einfach ein Problem der betroffenen Internetseite ist und nicht von meinem Netbook.

Seit ich diese ganzen Programme wie Malwarebytes und Adwcleaner benutzt habe geht mein Proxmate-Add-On nicht mehr? Hängt das damit zusammen?

M-K-D-B · 22.06.2014, 13:11

Zitat:

Zitat von Phill23

Okay, werde ich dann später noch tun.

ja, das Ilivid-Problem besteht immer noch. Frage mich inzwischen auch ob das nicht einfach ein Problem der betroffenen Internetseite ist und nicht von meinem Netbook.

Ja gut möglich, dass es an der Seite liegt, aber solltest die Frage ja erst beantworten, wenn du die Schritte durchgeführt hast...

Zitat:

Zitat von Phill23

Seit ich diese ganzen Programme wie Malwarebytes und Adwcleaner benutzt habe geht mein Proxmate-Add-On nicht mehr? Hängt das damit zusammen?

Einfach neu installieren.

Phill23 · 22.06.2014, 13:24

Zitat:

Zitat von M-K-D-B

Ja gut möglich, dass es an der Seite liegt, aber solltest die Frage ja erst beantworten, wenn du die Schritte durchgeführt hast...

Einfach neu installieren.

Achso, dann hab ich das falsch verstanden xD

Hab ich schon, geht trotzdem irgendwie nicht.

M-K-D-B · 22.06.2014, 13:31

Zitat:

Zitat von Phill23

Hab ich schon, geht trotzdem irgendwie nicht.

in welchem Browser?

Versuch mal deinstallieren und dann neu installieren.

Anderen Schritte noch ausführen.

Phill23 · 22.06.2014, 20:05

Das mit dem de- und neuinstallieren bei Proxmate hat auch nichts gebracht.

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:21-06-2014 01
Ran by toshiba at 2014-06-22 17:36:12 Run:1
Running from C:\Users\toshiba\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
start
FF NetworkProxy: "autoconfig_url", "data:text/javascript,function%20FindProxyForURL(url%2C%20host)%20%7Bif%20(shExpMatch(url%2C%20'http%3A%2F%2Fwww.crunchyroll.com*')%20%7C%7C%20host%20%3D%3D%20'www.pandora.com'%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Faccount.beatsmusic.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.beatsmusic.com*')%20%7C%7C%20url.indexOf('play.google.com')%20!%3D%20-1%20%7C%7C%20(url.indexOf('youtube.com%2Fvideoplayback')%20!%3D%20-1%20%26%26%20url.indexOf('%26gcr%3Dus')%20!%3D%20-1%20%26%26%20url.indexOf('%26ptchn')%20!%3D%20-1)%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fgrooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fretro.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fhtml5.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Flisten.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpreview.grooveshark.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fsecure.funimation.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.rdio.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.last.fm*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fext.last.fm*')%20%7C%7C%20(url.indexOf('proxmate%3Dactive')%20!%3D%20-1%20%26%26%20url.indexOf('amazonaws.com')%20%3D%3D%20-1)%20%7C%7C%20(url.indexOf('proxmate%3Dus')%20!%3D%20-1)%20%7C%7C%20host%20%3D%3D%20's.hulu.com'%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fsongza.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fnew.songza.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.daisuki.net*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.mtv.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fmedia.mtvnservices.com*')%20%7C%7C%20url.indexOf('discoverymedia.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fdsc.discovery.com%2F*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.iheart.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fpiki.fm*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fpiki.fm*')%20%7C%7C%20url.indexOf('southparkstudios.com')%20!%3D%20-1%20%7C%7C%20url.indexOf('vevo.com')%20!%3D%20-1%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fplay.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'https%3A%2F%2Fwww.spotify.com*')%20%7C%7C%20shExpMatch(url%2C%20'http%3A%2F%2Fwww.spotify.com*'))%20%7B%20return%20'PROXY%20nq-us05.personalitycores.com%3A8000%3B%20PROXY%20nq-us10.personalitycores.com%3A8000%3B%20PROXY%20nq-us08.personalitycores.com%3A8000%3B%20PROXY%20nq-us04.personalitycores.com%3A8000%3B%20PROXY%20nq-us09.personalitycores.com%3A8000%3B%20PROXY%20nq-us06.personalitycores.com%3A8000%3B%20PROXY%20nq-us12.personalitycores.com%3A8000%3B%20PROXY%20nq-us11.personalitycores.com%3A8000%3B%20PROXY%20nq-us07.personalitycores.com%3A8000'%3B%7D%20%20else%20%7B%20return%20'DIRECT'%3B%20%7D%7D"
FF NetworkProxy: "type", 2
HKU\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Classes\exefile:  <===== ATTENTION!
Reboot:
end
*****************

Firefox Proxy settings were reset.
Firefox Proxy settings were reset.
'HKU\S-1-5-21-3911603531-60462317-1733039333-1000\Software\Classes\exefile' => Key deleted successfully.


The system needed a reboot. 

==== End of Fixlog ====

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=033ac623ae5e47499246c7f81e9b65d3
# engine=18825
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2014-06-22 06:21:32
# local_time=2014-06-22 08:21:32 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='avast! Antivirus'
# compatibility_mode=783 16777213 100 97 1336700 167885382 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 202148 155092483 0 0
# scanned=167525
# found=3
# cleaned=0
# scan_time=8813
sh=8E03B6FA573E64F8EF1299F5B86A278235E43708 ft=1 fh=cd32865c98420d6d vn="Variante von Win32/Packed.VMProtect.ABA Trojaner" ac=I fn="C:\Program Files\Portrait Professional Studio 10\PortraitProfessionalStudio.exe"
sh=F74DEFC00820BA00880E018936AD16226C301A4E ft=1 fh=af16ef21883d2d4c vn="Variante von Win32/Bundled.Toolbar.Ask.D potenziell unsichere Anwendung" ac=I fn="G:\Programme\m4a-to-mp3-converter_7.2.exe"
sh=22D9994949C883B0943ADC676FCEDE9C8975111A ft=1 fh=f0ccb68246711ea9 vn="Variante von Win32/Packed.VMProtect.ABA Trojaner" ac=I fn="G:\Programme\Anthropic.Technology.Portrait.Professional.Studio.v10.9.3.PreActivated.Final-FL\PortraitProfessionalStudio PreActivated 10.exe"

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
avast! Antivirus   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 7 Update 60  
 Java version out of Date! 
 Adobe Flash Player 	14.0.0.125  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox (30.0) 
 Google Chrome 35.0.1916.114  
 Google Chrome 35.0.1916.153  
````````Process Check: objlist.exe by Laurent````````  
 AVAST Software Avast AvastSvc.exe  
 AVAST Software Avast avastui.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

20.06.2014, 17:49	#6
M-K-D-B /// TB-Ausbilder	Ich werde immer auf ILivid weitergeleitet ok, bis morgen.

Ich werde immer auf ILivid weitergeleitet

Plagegeister aller Art und deren Bekämpfung: Ich werde immer auf ILivid weitergeleitet