Habe mir b eim Herunterladen von IrfanView von Netzwelt.de Malware (u.a. IMinent) eingefangen - Rechner langsam, ungewohnte Werbung im Brows

BRTom · 26.06.2014, 10:48

Guten morgen,

nachdem gestern der MS Picture Manager plötzlich nicht mehr korrekt gearbeitet hat, habe ich von Netzwelt.de das Programm IrfanView herunter geladen und installiert. Dabei hat sich für mich unbemerkt IMinent und evtl. Weiteres mit herunter geladen.

Nachdem im Browser (Firefox) alles nur noch sehr langsam ging, habe ich das System mit Avira gescannt (zunächst ohne Befund); da IMinent dann immer noch vorhanden war, habe ich zunächst versucht, Iminent über die Systemsteuerung zu entfernen, ohne Erfolg.
Deshalb habe ich adwclean von einem USB-Stick aus gestartet und das System gescant. Alle Funde habe ich gelöscht. IMinent ist nun aus den Programmen in der Systemsteuerung verschwunden, dennoch scheint noch etwas auf dem Rechner zu sein: Er ist immer noch spürbar langsamer und im Browser ist weiterhin ungewöhnliche Werbung zu sehen (zappelnde Fenster). Zudem erhalte ich gelegentliche Warnungen von Avira (über ein Programm ... APPL/BrowseFox.Gen ...).

Auf der verzweifelten Lösungssuche bin ich über Ihr Forum gestolpert, habe mich registriert und bin der Anleitung gefolgt.

1. Defogger hat geklappt, Loglile:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 10:47 on 26/06/2014 (TG)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

2. FRST hat geklappt, Logfiles:

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-06-2014
Ran by TG (administrator) on TG-LAPTOP on 26-06-2014 10:51:00
Running from C:\Users\TG\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
() C:\Program Files (x86)\ToggleMark\updateToggleMark.exe
(Acer) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
() C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Windows\twain_32\Samsung\CLX6200\Scan2Pc.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
() C:\Users\TG\Desktop\Defogger.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2012-06-11] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2009-10-02] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] => C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe [221728 2009-09-04] (Acer Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [RemoteControl8] => c:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => c:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348664 2012-08-08] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [6200 Scan2PC] => C:\Windows\Twain_32\Samsung\CLX6200\Scan2Pc.exe [491520 2008-01-09] ()
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [536576 2008-02-15] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [t4pc_en_7] => "C:\Program Files (x86)\t4pc_en_7\t4pc_en_7.exe"
HKLM-x32\...\RunOnce: [upt4pc_en_7.exe] - C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe -runonce [3354608 2014-06-19] ()
Winlogon\Notify\igfxcui: C:\Windows\SYSTEM32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3212772127-1644909334-2868257101-1000\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1086376 2012-08-03] (Nokia)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4810t&r=27360612t106l0358z125t49k1a147
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://start.iminent.com/?appId=14595F48-DB19-410A-96DC-38AF7F7C23E6&ref=toolbox&q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: ViewPassword - {C27A6CC0-EC7F-6C40-D81C-C2C0E86CB95B} - C:\Program Files (x86)\-ViewPassword-soft\174.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-11]
FF Extension: ToggleMark - C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\{af16abf4-eac1-49b4-93fc-58f6ca799135}.xpi [2014-06-25]
FF HKCU\...\Firefox\Extensions: [{C9A0BC53-382F-DCC9-F64E-2036D0B32251}] - C:\Program Files (x86)\-ViewPassword-soft\174.xpi
FF Extension: No Name - C:\Program Files (x86)\-ViewPassword-soft\174.xpi [2014-06-25]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-02] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [786976 2009-10-02] (Acer Incorporated)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [158240 2009-09-04] (Acer Incorporated)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Update ToggleMark; C:\Program Files (x86)\ToggleMark\updateToggleMark.exe [317728 2014-06-25] ()
R2 Util ToggleMark; C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe [317728 2014-06-26] ()
S2 servervo; C:\Users\TG\AppData\Roaming\VOPackage\VOsrv.exe [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-04-25] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-04-27] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-05-02] (Avira GmbH)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [54072 2007-03-23] (Samsung Electronics)
S2 DgiVecp; C:\Windows\SysWOW64\Drivers\DgiVecp.sys [41984 2007-03-23] (Samsung Electronics Co., Ltd.) [File not signed]
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-05-22] () [File not signed]
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys [61120 2014-06-09] (StdLib)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 10:51 - 2014-06-26 10:52 - 00016646 _____ () C:\Users\TG\Downloads\FRST.txt
2014-06-26 10:50 - 2014-06-26 10:51 - 00000000 ____D () C:\FRST
2014-06-26 10:50 - 2014-06-26 10:50 - 02082816 _____ (Farbar) C:\Users\TG\Downloads\FRST64.exe
2014-06-26 10:47 - 2014-06-26 10:48 - 00000466 _____ () C:\Users\TG\Desktop\defogger_disable.log
2014-06-26 10:47 - 2014-06-26 10:47 - 00000000 _____ () C:\Users\TG\defogger_reenable
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2014-06-26 10:40 - 2014-06-26 10:40 - 00000000 ___RD () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2014-06-26 09:54 - 2014-06-26 10:37 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:53 - 2014-06-09 12:15 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
2014-06-26 00:23 - 2014-06-26 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 23:49 - 2014-06-26 10:42 - 00000000 ____D () C:\Users\TG\AppData\Local\t4pc_en_7
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T4PC
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\t4pc_en_7
2014-06-25 23:48 - 2014-06-26 00:52 - 00000000 ____D () C:\Program Files (x86)\ToggleMark
2014-06-25 23:48 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\V-9.1HD
2014-06-25 23:37 - 2014-06-26 01:06 - 00003492 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2014-06-25 23:36 - 2014-06-25 23:36 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieUserList
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieSiteList
2014-06-25 23:26 - 2014-06-25 23:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Languages
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Help
2014-06-25 23:21 - 2014-06-25 23:21 - 00469032 _____ () C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Ashampoo
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Local\ashampoo
2014-06-25 23:07 - 2014-06-25 23:08 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-06-25 22:57 - 2014-06-25 23:01 - 154180952 _____ (Ashampoo GmbH & Co. KG ) C:\Users\TG\Downloads\ashampoo_photo_commander_10_10.2.1_13669.exe
2014-06-25 22:39 - 2014-06-25 22:46 - 288633368 _____ (Microsoft Corporation) C:\Users\TG\Downloads\SharePointDesigner.exe
2014-06-25 22:15 - 2014-06-25 22:15 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-06-21 22:25 - 2014-06-23 20:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-06-18 00:31 - 2014-06-18 00:31 - 00001175 _____ () C:\Users\TG\Desktop\Free YouTube to MP3 Converter Installation fortsetzen.lnk
2014-06-18 00:30 - 2014-06-18 00:30 - 00701808 _____ () C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
2014-06-05 22:20 - 2014-06-05 22:20 - 01707144 _____ () C:\Users\TG\Downloads\Adaware_Installer.exe
2014-05-28 22:53 - 2014-06-18 00:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-28 22:53 - 2014-05-28 22:55 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2014-05-28 22:53 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-28 22:51 - 2014-05-28 22:52 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\TG\Downloads\spybot-2.3.exe
2014-05-28 10:10 - 2014-06-25 23:30 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Lavasoft
2014-05-28 10:10 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\LavasoftStatistics
2014-05-28 09:31 - 2014-05-28 09:31 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-28 09:30 - 2014-06-25 23:30 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-05-28 09:27 - 2014-05-28 09:27 - 01727624 _____ () C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
2014-05-28 09:27 - 2014-05-28 09:27 - 00000000 ____D () C:\ProgramData\Lavasoft

==================== One Month Modified Files and Folders =======

2014-06-26 10:52 - 2014-06-26 10:51 - 00016646 _____ () C:\Users\TG\Downloads\FRST.txt
2014-06-26 10:51 - 2014-06-26 10:50 - 00000000 ____D () C:\FRST
2014-06-26 10:50 - 2014-06-26 10:50 - 02082816 _____ (Farbar) C:\Users\TG\Downloads\FRST64.exe
2014-06-26 10:48 - 2014-06-26 10:47 - 00000466 _____ () C:\Users\TG\Desktop\defogger_disable.log
2014-06-26 10:47 - 2014-06-26 10:47 - 00000000 _____ () C:\Users\TG\defogger_reenable
2014-06-26 10:47 - 2012-06-11 10:34 - 00000000 ____D () C:\Users\TG
2014-06-26 10:46 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 10:46 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2014-06-26 10:42 - 2014-06-25 23:49 - 00000000 ____D () C:\Users\TG\AppData\Local\t4pc_en_7
2014-06-26 10:42 - 2012-06-11 09:38 - 01077911 _____ () C:\Windows\WindowsUpdate.log
2014-06-26 10:40 - 2014-06-26 10:40 - 00000000 ___RD () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2014-06-26 10:40 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-26 10:38 - 2013-10-22 13:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-06-26 10:38 - 2009-10-29 05:23 - 00870100 _____ () C:\Windows\PFRO.log
2014-06-26 10:38 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 10:38 - 2009-07-14 06:51 - 00110328 _____ () C:\Windows\setupact.log
2014-06-26 10:37 - 2014-06-26 09:54 - 00000000 ____D () C:\AdwCleaner
2014-06-26 01:06 - 2014-06-25 23:37 - 00003492 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2014-06-26 01:02 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-06-26 00:52 - 2014-06-25 23:48 - 00000000 ____D () C:\Program Files (x86)\ToggleMark
2014-06-26 00:23 - 2014-06-26 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T4PC
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\t4pc_en_7
2014-06-25 23:49 - 2014-06-25 23:48 - 00000000 ____D () C:\Program Files (x86)\V-9.1HD
2014-06-25 23:47 - 2009-10-29 05:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-06-25 23:46 - 2009-10-29 05:38 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-06-25 23:42 - 2012-06-11 21:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-25 23:36 - 2014-06-25 23:36 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieUserList
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieSiteList
2014-06-25 23:30 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Lavasoft
2014-06-25 23:30 - 2014-05-28 09:30 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-06-25 23:27 - 2014-06-25 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Languages
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Help
2014-06-25 23:25 - 2009-10-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-25 23:21 - 2014-06-25 23:21 - 00469032 _____ () C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Ashampoo
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Local\ashampoo
2014-06-25 23:08 - 2014-06-25 23:07 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-06-25 23:01 - 2014-06-25 22:57 - 154180952 _____ (Ashampoo GmbH & Co. KG ) C:\Users\TG\Downloads\ashampoo_photo_commander_10_10.2.1_13669.exe
2014-06-25 23:00 - 2012-04-12 20:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP
2014-06-25 22:46 - 2014-06-25 22:39 - 288633368 _____ (Microsoft Corporation) C:\Users\TG\Downloads\SharePointDesigner.exe
2014-06-25 22:34 - 2013-03-20 22:24 - 00000000 ____D () C:\Users\TG\AppData\Local\Windows Live
2014-06-25 22:20 - 2012-06-11 10:45 - 00000000 ____D () C:\Users\TG\Documents\Bluetooth-Exchange-Ordner
2014-06-25 22:15 - 2014-06-25 22:15 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-06-23 20:22 - 2009-10-29 05:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-23 20:21 - 2009-10-29 05:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-23 20:20 - 2009-10-29 05:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-23 20:19 - 2009-10-28 20:41 - 00000000 ____D () C:\Windows\ShellNew
2014-06-23 20:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-06-23 20:08 - 2014-06-21 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-06-18 00:32 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-18 00:31 - 2014-06-18 00:31 - 00001175 _____ () C:\Users\TG\Desktop\Free YouTube to MP3 Converter Installation fortsetzen.lnk
2014-06-18 00:31 - 2013-11-17 17:49 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-06-18 00:30 - 2014-06-18 00:30 - 00701808 _____ () C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
2014-06-13 10:16 - 2012-06-11 19:14 - 00696870 _____ () C:\Windows\system32\perfh007.dat
2014-06-13 10:16 - 2012-06-11 19:14 - 00148134 _____ () C:\Windows\system32\perfc007.dat
2014-06-13 10:16 - 2009-07-14 07:13 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-13 09:52 - 2013-05-23 04:56 - 00000000 ____D () C:\Users\TG\AppData\Local\CrashDumps
2014-06-09 12:15 - 2014-06-26 00:53 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
2014-06-05 22:20 - 2014-06-05 22:20 - 01707144 _____ () C:\Users\TG\Downloads\Adaware_Installer.exe
2014-05-28 22:55 - 2014-05-28 22:53 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2014-05-28 22:53 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-28 22:52 - 2014-05-28 22:51 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\TG\Downloads\spybot-2.3.exe
2014-05-28 10:10 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\LavasoftStatistics
2014-05-28 09:31 - 2014-05-28 09:31 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-28 09:27 - 2014-05-28 09:27 - 01727624 _____ () C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
2014-05-28 09:27 - 2014-05-28 09:27 - 00000000 ____D () C:\ProgramData\Lavasoft

Some content of TEMP:
====================
C:\Users\TG\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\TG\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 22:15

==================== End Of Log ============================

Additional

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-06-2014
Ran by TG at 2014-06-26 10:52:57
Running from C:\Users\TG\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer PowerSmart Manager (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.07.3008 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0715 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Anki (HKLM-x32\...\Anki) (Version:  - )
Apple Application Support (HKLM-x32\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 12.1.9.2500 - Avira)
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bonjour-Druckdienste (HKLM\...\{0DA20600-6130-443B-9D4B-F30520315FA6}) (Version: 2.0.2.0 - Apple Inc.)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.1.3405.50 - CyberLink Corp.)
CyberLink PowerDVD 8 (x32 Version: 8.1.3405.50 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version:  - Softland)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Free Studio version 2013 (HKLM-x32\...\Free Studio_is1) (Version: 6.2.0.1029 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
GanttProject (HKLM-x32\...\GanttProject) (Version:  - )
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3002 - Acer Incorporated)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1892 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.03 - Acer Inc.)
Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version:  - Oberon Media)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
MindManager 4.0 (HKLM-x32\...\MindManager 4.0) (Version: 4.0.60 - Mindjet LLC)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
Nokia Connectivity Cable Driver (HKLM-x32\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.5.34.0 - Nokia)
Nokia Suite (x32 Version: 3.5.34.0 - Nokia) Hidden
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
OpenProj (HKLM-x32\...\{13702021-43FB-480C-912F-D9B74A538288}) (Version: 1.4.0 - Serena Software Inc.)
Optical Drive Power Management (HKLM-x32\...\{AE09C972-EEB2-4DA5-8090-0FCF54576854}) (Version: 1.01.3002 - Acer Incorporated)
PC Connectivity Solution (HKLM-x32\...\{7390478C-8581-415E-92E9-2997D9306B81}) (Version: 12.0.32.0 - Nokia)
PDF Split And Merge Basic (HKLM\...\{C91B24F6-1629-11E2-B696-21676188709B}) (Version: 2.2.2 - Andrea Vacondio)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Readiris Pro 10 (HKLM-x32\...\{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
Samsung CLX-6200 Series (HKLM-x32\...\Samsung CLX-6200 Series) (Version:  - Samsung Electronics CO.,LTD)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12054_18 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.2.12054_18 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.6 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.6.106 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
t4pc_en_7 (HKLM-x32\...\t4pc_en_7_is1) (Version:  - T4PC) <==== ATTENTION
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.20202 - TeamViewer)
ToggleMark (HKLM\...\ToggleMark) (Version: 2014.06.24.232306 - ToggleMark)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
V-9.1HD (HKLM-x32\...\V-9.1HD) (Version: 1.34.6.10 - V-9.1HD)
ViewPassword (HKLM-x32\...\B800FCEC-6357-A5E7-D27D-6834D5A7A88F) (Version:  - ViewPassword-software) <==== ATTENTION
VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.4100 - Broadcom Corporation)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (09/11/2009 6.2.0.9407) (HKLM\...\3932CA781A7894D20116FDF60F878301800EA8AB) (Version: 09/11/2009 6.2.0.9407 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
yEd Graph Editor 3.10.2 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.10.2 - yWorks GmbH)

==================== Restore Points  =========================

13-06-2014 08:38:11 Windows Update
23-06-2014 18:16:56 Removed Microsoft Office Home and Student 2007
25-06-2014 21:03:23 Installed Microsoft SharePoint Designer 2010
25-06-2014 21:05:21 Installed Microsoft SharePoint Designer 2010
25-06-2014 21:28:28 AA11

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0598810B-D992-41D8-91BD-59B7F93C0940} - \099c6c9e-8fbb-4604-9a19-02127ec36095-4 No Task File <==== ATTENTION
Task: {0A873B89-318F-48DF-A3C6-8EA628D82E6A} - \099c6c9e-8fbb-4604-9a19-02127ec36095-11 No Task File <==== ATTENTION
Task: {0CF33E94-623E-4B7D-8AFA-08C9F8A2EB6D} - \099c6c9e-8fbb-4604-9a19-02127ec36095-5 No Task File <==== ATTENTION
Task: {0F41783E-8034-42AA-9644-D3A10E7648B4} - \099c6c9e-8fbb-4604-9a19-02127ec36095-1 No Task File <==== ATTENTION
Task: {1AA5513A-937D-425C-8DA0-23C80B5DFEA7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {449B0794-88D5-4B63-8A01-D13946965A9F} - System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl => C:\Users\TG\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\minibarchrome.exe
Task: {52560D07-92E3-4F23-8E48-E836CBEB5567} - \099c6c9e-8fbb-4604-9a19-02127ec36095-2 No Task File <==== ATTENTION
Task: {75779615-C6E6-44A2-A2A6-BBD33A6534C3} - \099c6c9e-8fbb-4604-9a19-02127ec36095-3 No Task File <==== ATTENTION
Task: {88C4F206-2994-4AAB-8EAE-1AB977097341} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {ADE4E189-DB85-48DC-B423-1B9DCC36CF1E} - \ViewPassword Update No Task File <==== ATTENTION
Task: {BA711357-13D6-4C1E-A0C3-9AB11BC9CFDF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {BE5A024A-8133-45E4-9A7B-3DB45C98A54D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {D374CFB9-B833-41EB-9B0E-B61039C1BF8D} - System32\Tasks\McQcModifier-5c47-a7b0 => C:\ProgramData\McQcModifier-5c47-a7b0\McQcModifier-5c47-a7b0.cmd [2009-08-29] ()
Task: {EC5C55BF-61CC-422E-9BEE-EC1E5D16B5DD} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {F239A04C-330F-4601-8554-148BC181A23F} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {F3AD2C43-5D32-4C8E-A962-B8AD24920116} - \ViewPassword_wd No Task File <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2008-10-06 06:37 - 2008-10-06 06:37 - 00022016 _____ () C:\Windows\System32\c620cl6.dll
2014-06-25 01:23 - 2014-06-25 01:23 - 00317728 _____ () C:\Program Files (x86)\ToggleMark\updateToggleMark.exe
2014-06-26 00:52 - 2014-06-26 00:52 - 00317728 _____ () C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe
2014-06-25 23:49 - 2014-06-19 12:14 - 03354608 _____ () C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe
2012-06-11 10:47 - 2012-06-11 10:46 - 00200704 _____ () C:\Windows\PLFSetI.exe
2012-10-04 21:52 - 2008-01-09 06:41 - 00491520 ____R () C:\Windows\twain_32\Samsung\CLX6200\Scan2Pc.exe
2012-10-04 22:00 - 2008-02-15 17:12 - 00536576 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2012-10-04 22:00 - 2007-03-23 07:43 - 00327168 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2012-06-12 18:07 - 2012-04-16 23:11 - 00398288 _____ () C:\Program Files (x86)\Avira\AntiVir Desktop\sqlite3.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2014-05-28 22:53 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-05-28 22:53 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-05-28 22:53 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-05-28 22:53 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-05-28 22:53 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 08506792 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtGui4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 02353576 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtCore4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 01013672 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtNetwork4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00363944 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtXml4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 02480552 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtDeclarative4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 01346472 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtScript4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00205736 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtSql4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 02652584 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtXmlPatterns4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00032680 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qgif4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00035240 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qico4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00206760 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qjpeg4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 11166120 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtWebKit4.dll
2012-08-03 16:07 - 2012-08-03 16:07 - 00276392 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\phonon4.dll
2012-07-02 11:29 - 2012-07-02 11:29 - 00391600 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\ssoengine.dll
2012-07-02 11:29 - 2012-07-02 11:29 - 00059280 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\securestorage.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00437672 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\NService.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00445864 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00520104 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtMultimediaKit1.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00720296 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtOpenGL4.dll
2012-08-03 16:05 - 2012-08-03 16:05 - 00604072 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\CommonUpdateChecker.dll
2012-07-02 11:28 - 2012-07-02 11:28 - 00110080 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\mediaservice\dsengine.dll
2012-10-04 21:52 - 2007-09-20 07:14 - 00184320 ____R () C:\Windows\twain_32\Samsung\CLX6200\IMFilter.dll
2012-10-04 21:52 - 2007-09-20 07:15 - 01384520 ____R () C:\Windows\twain_32\Samsung\CLX6200\ssole.dll
2014-06-25 23:26 - 2014-06-25 23:27 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-18 13:36 - 2014-05-18 13:36 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk => C:\Windows\pss\Acer VCM.lnk.CommonStartup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPDLR => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/26/2014 08:29:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 29110

Error: (06/26/2014 08:29:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 29110

Error: (06/26/2014 08:29:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/26/2014 08:29:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 28081

Error: (06/26/2014 08:29:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 28081

Error: (06/26/2014 08:29:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/26/2014 08:29:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 27051

Error: (06/26/2014 08:29:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 27051

Error: (06/26/2014 08:29:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/26/2014 08:29:32 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 25990


System errors:
=============
Error: (06/26/2014 10:39:01 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (06/26/2014 10:39:01 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\Drivers\SSPORT.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/26/2014 10:39:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "VO Service component" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/26/2014 10:38:36 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (06/26/2014 09:58:50 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (06/26/2014 09:58:50 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\Drivers\SSPORT.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/26/2014 09:58:50 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "VO Service component" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (06/26/2014 09:58:27 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%20

Error: (06/26/2014 01:01:40 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SSPORT" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275

Error: (06/26/2014 01:01:40 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \??\C:\Windows\system32\Drivers\SSPORT.sys nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.


Microsoft Office Sessions:
=========================
Error: (06/26/2014 08:29:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 29110

Error: (06/26/2014 08:29:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 29110

Error: (06/26/2014 08:29:35 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/26/2014 08:29:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 28081

Error: (06/26/2014 08:29:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 28081

Error: (06/26/2014 08:29:34 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/26/2014 08:29:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 27051

Error: (06/26/2014 08:29:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 27051

Error: (06/26/2014 08:29:33 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/26/2014 08:29:32 AM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 25990


CodeIntegrity Errors:
===================================
  Date: 2013-06-20 21:51:19.052
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:18.859
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:15.945
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:15.755
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:13.252
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:13.060
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:10.757
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:10.567
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:08.012
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:07.824
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 4027.79 MB
Available physical RAM: 2187.52 MB
Total Pagefile: 8053.76 MB
Available Pagefile: 5812.85 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:453.94 GB) (Free:257.58 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 0AC50AC4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)

==================== End Of Log ============================

3. GMER
Hat zunächst funktioniert, dann stürzte Rechner ab und folgende Fehlermeldung erschien: "Windows wurde nach unerwartetem Herunterfahren wieder ausgeführt"

Ich hoffe, ich habe alles richtig gemacht - danke für die Hilfe

Tom

cosinus · 26.06.2014, 10:54

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

BRTom · 26.06.2014, 13:07

Danke für die schnelle Antwort.

1. adwcleaner

Code:

ATTFilter

# AdwCleaner v3.213 - Bericht erstellt am 26/06/2014 um 12:44:52
# Aktualisiert 23/06/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : TG - TG-LAPTOP
# Gestartet von : C:\Users\TG\Desktop\adwcleaner_3.213.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}
Schlüssel Gelöscht : HKCU\Software\Tutorials
Schlüssel Gelöscht : HKLM\Software\Tutorials

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v30.0 (de)

[ Datei : C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [17008 octets] - [26/06/2014 09:54:52]
AdwCleaner[R1].txt - [1705 octets] - [26/06/2014 10:17:17]
AdwCleaner[R2].txt - [1842 octets] - [26/06/2014 12:41:27]
AdwCleaner[S0].txt - [15360 octets] - [26/06/2014 09:56:27]
AdwCleaner[S1].txt - [1714 octets] - [26/06/2014 10:37:32]
AdwCleaner[S2].txt - [1703 octets] - [26/06/2014 12:44:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1763 octets] ##########

2. JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by TG on 26.06.2014 at 12:51:32,56
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110411891124}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110411891124}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"



~~~ FireFox

Emptied folder: C:\Users\TG\AppData\Roaming\mozilla\firefox\profiles\oqsg4t4l.default\minidumps [59 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 26.06.2014 at 13:03:06,92
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3. FRST
Es wurde nur eine FRST.txt-Datei generiert, keine Addition.txt wie bei ersten Scan (s. Ursprungspost)

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-06-2014
Ran by TG (administrator) on TG-LAPTOP on 26-06-2014 14:00:12
Running from C:\Users\TG\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
() C:\Windows\twain_32\Samsung\CLX6200\Scan2Pc.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
() C:\Program Files (x86)\ToggleMark\updateToggleMark.exe
() C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Farbar) C:\Users\TG\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2012-06-11] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2009-10-02] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] => C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe [221728 2009-09-04] (Acer Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [RemoteControl8] => c:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => c:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [6200 Scan2PC] => C:\Windows\Twain_32\Samsung\CLX6200\Scan2Pc.exe [491520 2008-01-09] ()
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [536576 2008-02-15] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [t4pc_en_7] => "C:\Program Files (x86)\t4pc_en_7\t4pc_en_7.exe"
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [upt4pc_en_7.exe] - C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe -runonce [3354608 2014-06-19] ()
Winlogon\Notify\igfxcui: C:\Windows\SYSTEM32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3212772127-1644909334-2868257101-1000\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1086376 2012-08-03] (Nokia)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4810t&r=27360612t106l0358z125t49k1a147
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: ViewPassword - {C27A6CC0-EC7F-6C40-D81C-C2C0E86CB95B} - C:\Program Files (x86)\-ViewPassword-soft\174.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-11]
FF Extension: ToggleMark - C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\{af16abf4-eac1-49b4-93fc-58f6ca799135}.xpi [2014-06-25]
FF HKCU\...\Firefox\Extensions: [{C9A0BC53-382F-DCC9-F64E-2036D0B32251}] - C:\Program Files (x86)\-ViewPassword-soft\174.xpi
FF Extension: No Name - C:\Program Files (x86)\-ViewPassword-soft\174.xpi [2014-06-25]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-17] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [786976 2009-10-02] (Acer Incorporated)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [158240 2009-09-04] (Acer Incorporated)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Update ToggleMark; C:\Program Files (x86)\ToggleMark\updateToggleMark.exe [317728 2014-06-25] ()
R2 Util ToggleMark; C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe [317728 2014-06-26] ()
S2 servervo; C:\Users\TG\AppData\Roaming\VOPackage\VOsrv.exe [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-06-17] (Avira Operations GmbH & Co. KG)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [54072 2007-03-23] (Samsung Electronics)
S2 DgiVecp; C:\Windows\SysWOW64\Drivers\DgiVecp.sys [41984 2007-03-23] (Samsung Electronics Co., Ltd.) [File not signed]
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-05-22] () [File not signed]
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys [61120 2014-06-09] (StdLib)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 14:00 - 2014-06-26 14:00 - 00016679 _____ () C:\Users\TG\Desktop\FRST.txt
2014-06-26 13:55 - 2014-06-26 13:57 - 00033989 _____ () C:\Users\TG\Downloads\FRST.txt
2014-06-26 13:17 - 2014-06-26 13:17 - 02082816 _____ (Farbar) C:\Users\TG\Desktop\FRST64(1).exe
2014-06-26 13:03 - 2014-06-26 13:03 - 00001481 _____ () C:\Users\TG\Desktop\JRT.txt
2014-06-26 12:51 - 2014-06-26 12:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-26 12:50 - 2014-06-26 12:50 - 01016261 _____ (Thisisu) C:\Users\TG\Downloads\JRT.exe
2014-06-26 12:47 - 2014-06-26 12:47 - 00001851 _____ () C:\Users\TG\Desktop\AdwCleaner[S2].txt
2014-06-26 12:46 - 2014-06-26 12:46 - 00000000 ___RD () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2014-06-26 12:40 - 2014-06-26 12:40 - 01342659 _____ () C:\Users\TG\Desktop\adwcleaner_3.213.exe
2014-06-26 12:38 - 2014-06-26 12:36 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-06-26 12:36 - 2014-06-26 12:36 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Avira
2014-06-26 12:34 - 2014-06-26 12:34 - 00001998 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\ProgramData\Avira
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-06-26 12:33 - 2014-06-17 16:25 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-26 12:33 - 2014-06-17 16:25 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-26 12:33 - 2014-06-17 16:25 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-06-26 12:24 - 2014-06-26 12:27 - 140310000 _____ () C:\Users\TG\Downloads\avira_free_antivirus_de444.exe
2014-06-26 11:09 - 2014-06-26 11:09 - 00277056 _____ () C:\Windows\Minidump\062614-17425-01.dmp
2014-06-26 10:59 - 2014-06-26 10:59 - 00380416 _____ () C:\Users\TG\Desktop\Gmer-19357.exe
2014-06-26 10:50 - 2014-06-26 14:00 - 00000000 ____D () C:\FRST
2014-06-26 10:50 - 2014-06-26 10:50 - 02082816 _____ (Farbar) C:\Users\TG\Downloads\FRST64.exe
2014-06-26 10:47 - 2014-06-26 10:48 - 00000466 _____ () C:\Users\TG\Desktop\defogger_disable.log
2014-06-26 10:47 - 2014-06-26 10:47 - 00000000 _____ () C:\Users\TG\defogger_reenable
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2014-06-26 09:54 - 2014-06-26 12:44 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:53 - 2014-06-09 12:15 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
2014-06-26 00:23 - 2014-06-26 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 23:49 - 2014-06-26 12:49 - 00000000 ____D () C:\Users\TG\AppData\Local\t4pc_en_7
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T4PC
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\t4pc_en_7
2014-06-25 23:48 - 2014-06-26 00:52 - 00000000 ____D () C:\Program Files (x86)\ToggleMark
2014-06-25 23:48 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\V-9.1HD
2014-06-25 23:37 - 2014-06-26 01:06 - 00003492 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2014-06-25 23:36 - 2014-06-25 23:36 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieUserList
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieSiteList
2014-06-25 23:26 - 2014-06-25 23:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Languages
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Help
2014-06-25 23:21 - 2014-06-25 23:21 - 00469032 _____ () C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Ashampoo
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Local\ashampoo
2014-06-25 23:07 - 2014-06-25 23:08 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-06-25 22:57 - 2014-06-25 23:01 - 154180952 _____ (Ashampoo GmbH & Co. KG ) C:\Users\TG\Downloads\ashampoo_photo_commander_10_10.2.1_13669.exe
2014-06-25 22:39 - 2014-06-25 22:46 - 288633368 _____ (Microsoft Corporation) C:\Users\TG\Downloads\SharePointDesigner.exe
2014-06-25 22:15 - 2014-06-25 22:15 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-06-21 22:25 - 2014-06-23 20:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-06-18 00:31 - 2014-06-18 00:31 - 00001175 _____ () C:\Users\TG\Desktop\Free YouTube to MP3 Converter Installation fortsetzen.lnk
2014-06-18 00:30 - 2014-06-18 00:30 - 00701808 _____ () C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
2014-06-05 22:20 - 2014-06-05 22:20 - 01707144 _____ () C:\Users\TG\Downloads\Adaware_Installer.exe
2014-05-28 22:53 - 2014-06-18 00:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-28 22:53 - 2014-05-28 22:55 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2014-05-28 22:53 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-28 22:51 - 2014-05-28 22:52 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\TG\Downloads\spybot-2.3.exe
2014-05-28 10:10 - 2014-06-25 23:30 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Lavasoft
2014-05-28 10:10 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\LavasoftStatistics
2014-05-28 09:31 - 2014-05-28 09:31 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-28 09:30 - 2014-06-25 23:30 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-05-28 09:27 - 2014-05-28 09:27 - 01727624 _____ () C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
2014-05-28 09:27 - 2014-05-28 09:27 - 00000000 ____D () C:\ProgramData\Lavasoft

==================== One Month Modified Files and Folders =======

2014-06-26 14:00 - 2014-06-26 14:00 - 00016679 _____ () C:\Users\TG\Desktop\FRST.txt
2014-06-26 14:00 - 2014-06-26 10:50 - 00000000 ____D () C:\FRST
2014-06-26 13:57 - 2014-06-26 13:55 - 00033989 _____ () C:\Users\TG\Downloads\FRST.txt
2014-06-26 13:56 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-26 13:17 - 2014-06-26 13:17 - 02082816 _____ (Farbar) C:\Users\TG\Desktop\FRST64(1).exe
2014-06-26 13:03 - 2014-06-26 13:03 - 00001481 _____ () C:\Users\TG\Desktop\JRT.txt
2014-06-26 12:55 - 2013-05-23 04:56 - 00000000 ____D () C:\Users\TG\AppData\Local\CrashDumps
2014-06-26 12:54 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 12:54 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 12:51 - 2014-06-26 12:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-26 12:50 - 2014-06-26 12:50 - 01016261 _____ (Thisisu) C:\Users\TG\Downloads\JRT.exe
2014-06-26 12:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Users\TG\AppData\Local\t4pc_en_7
2014-06-26 12:49 - 2012-06-11 09:38 - 01087838 _____ () C:\Windows\WindowsUpdate.log
2014-06-26 12:47 - 2014-06-26 12:47 - 00001851 _____ () C:\Users\TG\Desktop\AdwCleaner[S2].txt
2014-06-26 12:46 - 2014-06-26 12:46 - 00000000 ___RD () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2014-06-26 12:45 - 2013-10-22 13:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-06-26 12:45 - 2009-10-29 05:23 - 01020170 _____ () C:\Windows\PFRO.log
2014-06-26 12:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 12:45 - 2009-07-14 06:51 - 00110496 _____ () C:\Windows\setupact.log
2014-06-26 12:44 - 2014-06-26 09:54 - 00000000 ____D () C:\AdwCleaner
2014-06-26 12:40 - 2014-06-26 12:40 - 01342659 _____ () C:\Users\TG\Desktop\adwcleaner_3.213.exe
2014-06-26 12:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-06-26 12:36 - 2014-06-26 12:38 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-06-26 12:36 - 2014-06-26 12:36 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Avira
2014-06-26 12:34 - 2014-06-26 12:34 - 00001998 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-06-26 12:34 - 2010-03-21 23:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\ProgramData\Avira
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-06-26 12:27 - 2014-06-26 12:24 - 140310000 _____ () C:\Users\TG\Downloads\avira_free_antivirus_de444.exe
2014-06-26 11:09 - 2014-06-26 11:09 - 00277056 _____ () C:\Windows\Minidump\062614-17425-01.dmp
2014-06-26 11:09 - 2012-07-10 13:06 - 534764401 _____ () C:\Windows\MEMORY.DMP
2014-06-26 11:09 - 2012-07-10 13:06 - 00000000 ____D () C:\Windows\Minidump
2014-06-26 10:59 - 2014-06-26 10:59 - 00380416 _____ () C:\Users\TG\Desktop\Gmer-19357.exe
2014-06-26 10:50 - 2014-06-26 10:50 - 02082816 _____ (Farbar) C:\Users\TG\Downloads\FRST64.exe
2014-06-26 10:48 - 2014-06-26 10:47 - 00000466 _____ () C:\Users\TG\Desktop\defogger_disable.log
2014-06-26 10:47 - 2014-06-26 10:47 - 00000000 _____ () C:\Users\TG\defogger_reenable
2014-06-26 10:47 - 2012-06-11 10:34 - 00000000 ____D () C:\Users\TG
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2014-06-26 01:06 - 2014-06-25 23:37 - 00003492 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2014-06-26 00:52 - 2014-06-25 23:48 - 00000000 ____D () C:\Program Files (x86)\ToggleMark
2014-06-26 00:23 - 2014-06-26 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T4PC
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\t4pc_en_7
2014-06-25 23:49 - 2014-06-25 23:48 - 00000000 ____D () C:\Program Files (x86)\V-9.1HD
2014-06-25 23:47 - 2009-10-29 05:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-06-25 23:46 - 2009-10-29 05:38 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-06-25 23:42 - 2012-06-11 21:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-25 23:36 - 2014-06-25 23:36 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieUserList
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieSiteList
2014-06-25 23:30 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Lavasoft
2014-06-25 23:30 - 2014-05-28 09:30 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-06-25 23:27 - 2014-06-25 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Languages
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Help
2014-06-25 23:25 - 2009-10-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-25 23:21 - 2014-06-25 23:21 - 00469032 _____ () C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Ashampoo
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Local\ashampoo
2014-06-25 23:08 - 2014-06-25 23:07 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-06-25 23:01 - 2014-06-25 22:57 - 154180952 _____ (Ashampoo GmbH & Co. KG ) C:\Users\TG\Downloads\ashampoo_photo_commander_10_10.2.1_13669.exe
2014-06-25 23:00 - 2012-04-12 20:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP
2014-06-25 22:46 - 2014-06-25 22:39 - 288633368 _____ (Microsoft Corporation) C:\Users\TG\Downloads\SharePointDesigner.exe
2014-06-25 22:34 - 2013-03-20 22:24 - 00000000 ____D () C:\Users\TG\AppData\Local\Windows Live
2014-06-25 22:20 - 2012-06-11 10:45 - 00000000 ____D () C:\Users\TG\Documents\Bluetooth-Exchange-Ordner
2014-06-25 22:15 - 2014-06-25 22:15 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-06-23 20:22 - 2009-10-29 05:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-23 20:21 - 2009-10-29 05:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-23 20:20 - 2009-10-29 05:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-23 20:19 - 2009-10-28 20:41 - 00000000 ____D () C:\Windows\ShellNew
2014-06-23 20:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-06-23 20:08 - 2014-06-21 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-06-18 00:32 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-18 00:31 - 2014-06-18 00:31 - 00001175 _____ () C:\Users\TG\Desktop\Free YouTube to MP3 Converter Installation fortsetzen.lnk
2014-06-18 00:31 - 2013-11-17 17:49 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-06-18 00:30 - 2014-06-18 00:30 - 00701808 _____ () C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
2014-06-17 16:25 - 2014-06-26 12:33 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-17 16:25 - 2014-06-26 12:33 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-17 16:25 - 2014-06-26 12:33 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-06-13 10:16 - 2012-06-11 19:14 - 00696870 _____ () C:\Windows\system32\perfh007.dat
2014-06-13 10:16 - 2012-06-11 19:14 - 00148134 _____ () C:\Windows\system32\perfc007.dat
2014-06-13 10:16 - 2009-07-14 07:13 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-09 12:15 - 2014-06-26 00:53 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
2014-06-05 22:20 - 2014-06-05 22:20 - 01707144 _____ () C:\Users\TG\Downloads\Adaware_Installer.exe
2014-05-28 22:55 - 2014-05-28 22:53 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2014-05-28 22:53 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-28 22:52 - 2014-05-28 22:51 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\TG\Downloads\spybot-2.3.exe
2014-05-28 10:10 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\LavasoftStatistics
2014-05-28 09:31 - 2014-05-28 09:31 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-28 09:27 - 2014-05-28 09:27 - 01727624 _____ () C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
2014-05-28 09:27 - 2014-05-28 09:27 - 00000000 ____D () C:\ProgramData\Lavasoft

Some content of TEMP:
====================
C:\Users\TG\AppData\Local\Temp\AskSLib.dll
C:\Users\TG\AppData\Local\Temp\avgnt.exe
C:\Users\TG\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\TG\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 22:15

==================== End Of Log ============================

--- --- ---

cosinus · 26.06.2014, 14:29

Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.

BRTom · 26.06.2014, 14:58

Hier die FRST logfiles:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-06-2014
Ran by TG (administrator) on TG-LAPTOP on 26-06-2014 15:53:56
Running from C:\Users\TG\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\MDM.EXE
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
() C:\Windows\PLFSetI.exe
(Acer Incorporated) C:\Program Files\Acer\Optical Drive Power Management\ODDPWR.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(NewTech Infosystems, Inc.) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe
() C:\Windows\twain_32\Samsung\CLX6200\Scan2Pc.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
() C:\Program Files (x86)\ToggleMark\updateToggleMark.exe
() C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Farbar) C:\Users\TG\Desktop\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [mwlDaemon] => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [349480 2009-09-11] (Egis Technology Inc.)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8060960 2009-08-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1842472 2009-09-18] (Synaptics Incorporated)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2012-06-11] ()
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [496160 2009-10-02] (Acer Incorporated)
HKLM\...\Run: [ODDPwr] => C:\Program Files\Acer\Optical Drive Power Management\ODDPwr.exe [221728 2009-09-04] (Acer Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] => C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [261888 2009-09-25] (NewTech Infosystems, Inc.)
HKLM-x32\...\Run: [EgisTecLiveUpdate] => C:\Program Files (x86)\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-08-04] (Egis Technology Inc.)
HKLM-x32\...\Run: [LManager] => C:\Program Files (x86)\Launch Manager\LManager.exe [1094736 2009-11-02] (Dritek System Inc.)
HKLM-x32\...\Run: [RemoteControl8] => c:\Program Files (x86)\CyberLink\PowerDVD8\PDVD8Serv.exe [91432 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [PDVD8LanguageShortcut] => c:\Program Files (x86)\CyberLink\PowerDVD8\Language\Language.exe [50472 2009-04-15] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [6200 Scan2PC] => C:\Windows\Twain_32\Samsung\CLX6200\Scan2Pc.exe [491520 2008-01-09] ()
HKLM-x32\...\Run: [Samsung PanelMgr] => C:\Windows\Samsung\PanelMgr\SSMMgr.exe [536576 2008-02-15] ()
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [t4pc_en_7] => "C:\Program Files (x86)\t4pc_en_7\t4pc_en_7.exe"
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [750160 2014-06-17] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [upt4pc_en_7.exe] - C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe -runonce [3354608 2014-06-19] ()
Winlogon\Notify\igfxcui: C:\Windows\SYSTEM32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-3212772127-1644909334-2868257101-1000\...\Run: [NokiaSuite.exe] => C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1086376 2012-08-03] (Nokia)
Lsa: [Notification Packages] scecli C:\Program Files\WIDCOMM\Bluetooth Software\BtwProximityCP.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
ShellIconOverlayIdentifiers: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x64\psdprotect.dll (Egis Technology Inc.)
ShellIconOverlayIdentifiers-x32: egisPSDP -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_4810t&r=27360612t106l0358z125t49k1a147
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACAW
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: ViewPassword - {C27A6CC0-EC7F-6C40-D81C-C2C0E86CB95B} - C:\Program Files (x86)\-ViewPassword-soft\174.dll ()
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.1 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-09-11]
FF Extension: ToggleMark - C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\{af16abf4-eac1-49b4-93fc-58f6ca799135}.xpi [2014-06-25]
FF HKCU\...\Firefox\Extensions: [{C9A0BC53-382F-DCC9-F64E-2036D0B32251}] - C:\Program Files (x86)\-ViewPassword-soft\174.xpi
FF Extension: No Name - C:\Program Files (x86)\-ViewPassword-soft\174.xpi [2014-06-25]

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-06-17] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-06-17] (Avira Operations GmbH & Co. KG)
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [786976 2009-10-02] (Acer Incorporated)
S3 MWLService; C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-09-11] (Egis Technology Inc.)
R2 ODDPwrSvc; C:\Program Files\Acer\Optical Drive Power Management\ODDPWRSvc.exe [158240 2009-09-04] (Acer Incorporated)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [253952 2009-07-10] (Acer Incorporated) [File not signed]
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 Update ToggleMark; C:\Program Files (x86)\ToggleMark\updateToggleMark.exe [317728 2014-06-25] ()
R2 Util ToggleMark; C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe [317728 2014-06-26] ()
S2 servervo; C:\Users\TG\AppData\Roaming\VOPackage\VOsrv.exe [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-06-17] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-17] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-06-17] (Avira Operations GmbH & Co. KG)
S2 DgiVecp; C:\Windows\system32\Drivers\DgiVecp.sys [54072 2007-03-23] (Samsung Electronics)
S2 DgiVecp; C:\Windows\SysWOW64\Drivers\DgiVecp.sys [41984 2007-03-23] (Samsung Electronics Co., Ltd.) [File not signed]
S3 FsUsbExDisk; C:\Windows\SysWOW64\FsUsbExDisk.SYS [37344 2013-05-22] () [File not signed]
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys [61120 2014-06-09] (StdLib)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-06-26 14:00 - 2014-06-26 15:54 - 00016622 _____ () C:\Users\TG\Desktop\FRST.txt
2014-06-26 13:55 - 2014-06-26 13:57 - 00033989 _____ () C:\Users\TG\Downloads\FRST.txt
2014-06-26 13:17 - 2014-06-26 13:17 - 02082816 _____ (Farbar) C:\Users\TG\Desktop\FRST64(1).exe
2014-06-26 13:03 - 2014-06-26 13:03 - 00001481 _____ () C:\Users\TG\Desktop\JRT.txt
2014-06-26 12:51 - 2014-06-26 12:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-26 12:50 - 2014-06-26 12:50 - 01016261 _____ (Thisisu) C:\Users\TG\Downloads\JRT.exe
2014-06-26 12:47 - 2014-06-26 12:47 - 00001851 _____ () C:\Users\TG\Desktop\AdwCleaner[S2].txt
2014-06-26 12:46 - 2014-06-26 12:46 - 00000000 ___RD () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2014-06-26 12:40 - 2014-06-26 12:40 - 01342659 _____ () C:\Users\TG\Desktop\adwcleaner_3.213.exe
2014-06-26 12:38 - 2014-06-26 12:36 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-06-26 12:36 - 2014-06-26 12:36 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Avira
2014-06-26 12:34 - 2014-06-26 12:34 - 00001998 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\ProgramData\Avira
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-06-26 12:33 - 2014-06-17 16:25 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-26 12:33 - 2014-06-17 16:25 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-26 12:33 - 2014-06-17 16:25 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-06-26 12:24 - 2014-06-26 12:27 - 140310000 _____ () C:\Users\TG\Downloads\avira_free_antivirus_de444.exe
2014-06-26 11:09 - 2014-06-26 11:09 - 00277056 _____ () C:\Windows\Minidump\062614-17425-01.dmp
2014-06-26 10:59 - 2014-06-26 10:59 - 00380416 _____ () C:\Users\TG\Desktop\Gmer-19357.exe
2014-06-26 10:50 - 2014-06-26 15:53 - 00000000 ____D () C:\FRST
2014-06-26 10:50 - 2014-06-26 10:50 - 02082816 _____ (Farbar) C:\Users\TG\Downloads\FRST64.exe
2014-06-26 10:47 - 2014-06-26 10:48 - 00000466 _____ () C:\Users\TG\Desktop\defogger_disable.log
2014-06-26 10:47 - 2014-06-26 10:47 - 00000000 _____ () C:\Users\TG\defogger_reenable
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2014-06-26 09:54 - 2014-06-26 12:44 - 00000000 ____D () C:\AdwCleaner
2014-06-26 00:53 - 2014-06-09 12:15 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
2014-06-26 00:23 - 2014-06-26 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 23:49 - 2014-06-26 15:52 - 00000000 ____D () C:\Users\TG\AppData\Local\t4pc_en_7
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T4PC
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\t4pc_en_7
2014-06-25 23:48 - 2014-06-26 00:52 - 00000000 ____D () C:\Program Files (x86)\ToggleMark
2014-06-25 23:48 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\V-9.1HD
2014-06-25 23:37 - 2014-06-26 01:06 - 00003492 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2014-06-25 23:36 - 2014-06-25 23:36 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieUserList
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieSiteList
2014-06-25 23:26 - 2014-06-25 23:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Languages
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Help
2014-06-25 23:21 - 2014-06-25 23:21 - 00469032 _____ () C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Ashampoo
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Local\ashampoo
2014-06-25 23:07 - 2014-06-25 23:08 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-06-25 22:57 - 2014-06-25 23:01 - 154180952 _____ (Ashampoo GmbH & Co. KG ) C:\Users\TG\Downloads\ashampoo_photo_commander_10_10.2.1_13669.exe
2014-06-25 22:39 - 2014-06-25 22:46 - 288633368 _____ (Microsoft Corporation) C:\Users\TG\Downloads\SharePointDesigner.exe
2014-06-25 22:15 - 2014-06-25 22:15 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-06-21 22:25 - 2014-06-23 20:08 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-06-18 00:31 - 2014-06-18 00:31 - 00001175 _____ () C:\Users\TG\Desktop\Free YouTube to MP3 Converter Installation fortsetzen.lnk
2014-06-18 00:30 - 2014-06-18 00:30 - 00701808 _____ () C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
2014-06-05 22:20 - 2014-06-05 22:20 - 01707144 _____ () C:\Users\TG\Downloads\Adaware_Installer.exe
2014-05-28 22:53 - 2014-06-18 00:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-28 22:53 - 2014-05-28 22:55 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2014-05-28 22:53 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-28 22:51 - 2014-05-28 22:52 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\TG\Downloads\spybot-2.3.exe
2014-05-28 10:10 - 2014-06-25 23:30 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Lavasoft
2014-05-28 10:10 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\LavasoftStatistics
2014-05-28 09:31 - 2014-05-28 09:31 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-28 09:30 - 2014-06-25 23:30 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-05-28 09:27 - 2014-05-28 09:27 - 01727624 _____ () C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
2014-05-28 09:27 - 2014-05-28 09:27 - 00000000 ____D () C:\ProgramData\Lavasoft

==================== One Month Modified Files and Folders =======

2014-06-26 15:54 - 2014-06-26 14:00 - 00016622 _____ () C:\Users\TG\Desktop\FRST.txt
2014-06-26 15:53 - 2014-06-26 10:50 - 00000000 ____D () C:\FRST
2014-06-26 15:52 - 2014-06-25 23:49 - 00000000 ____D () C:\Users\TG\AppData\Local\t4pc_en_7
2014-06-26 14:56 - 2009-07-14 04:34 - 00000612 _____ () C:\Windows\win.ini
2014-06-26 13:57 - 2014-06-26 13:55 - 00033989 _____ () C:\Users\TG\Downloads\FRST.txt
2014-06-26 13:17 - 2014-06-26 13:17 - 02082816 _____ (Farbar) C:\Users\TG\Desktop\FRST64(1).exe
2014-06-26 13:03 - 2014-06-26 13:03 - 00001481 _____ () C:\Users\TG\Desktop\JRT.txt
2014-06-26 12:55 - 2013-05-23 04:56 - 00000000 ____D () C:\Users\TG\AppData\Local\CrashDumps
2014-06-26 12:54 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-26 12:54 - 2009-07-14 06:45 - 00017376 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-26 12:51 - 2014-06-26 12:51 - 00000000 ____D () C:\Windows\ERUNT
2014-06-26 12:50 - 2014-06-26 12:50 - 01016261 _____ (Thisisu) C:\Users\TG\Downloads\JRT.exe
2014-06-26 12:49 - 2012-06-11 09:38 - 01087838 _____ () C:\Windows\WindowsUpdate.log
2014-06-26 12:47 - 2014-06-26 12:47 - 00001851 _____ () C:\Users\TG\Desktop\AdwCleaner[S2].txt
2014-06-26 12:46 - 2014-06-26 12:46 - 00000000 ___RD () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 8
2014-06-26 12:45 - 2013-10-22 13:28 - 00065536 _____ () C:\Windows\system32\Ikeext.etl
2014-06-26 12:45 - 2009-10-29 05:23 - 01020170 _____ () C:\Windows\PFRO.log
2014-06-26 12:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-26 12:45 - 2009-07-14 06:51 - 00110496 _____ () C:\Windows\setupact.log
2014-06-26 12:44 - 2014-06-26 09:54 - 00000000 ____D () C:\AdwCleaner
2014-06-26 12:40 - 2014-06-26 12:40 - 01342659 _____ () C:\Users\TG\Desktop\adwcleaner_3.213.exe
2014-06-26 12:38 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\tracing
2014-06-26 12:36 - 2014-06-26 12:38 - 00084720 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2014-06-26 12:36 - 2014-06-26 12:36 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Avira
2014-06-26 12:34 - 2014-06-26 12:34 - 00001998 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-06-26 12:34 - 2010-03-21 23:25 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\ProgramData\Avira
2014-06-26 12:33 - 2014-06-26 12:33 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-06-26 12:27 - 2014-06-26 12:24 - 140310000 _____ () C:\Users\TG\Downloads\avira_free_antivirus_de444.exe
2014-06-26 11:09 - 2014-06-26 11:09 - 00277056 _____ () C:\Windows\Minidump\062614-17425-01.dmp
2014-06-26 11:09 - 2012-07-10 13:06 - 534764401 _____ () C:\Windows\MEMORY.DMP
2014-06-26 11:09 - 2012-07-10 13:06 - 00000000 ____D () C:\Windows\Minidump
2014-06-26 10:59 - 2014-06-26 10:59 - 00380416 _____ () C:\Users\TG\Desktop\Gmer-19357.exe
2014-06-26 10:50 - 2014-06-26 10:50 - 02082816 _____ (Farbar) C:\Users\TG\Downloads\FRST64.exe
2014-06-26 10:48 - 2014-06-26 10:47 - 00000466 _____ () C:\Users\TG\Desktop\defogger_disable.log
2014-06-26 10:47 - 2014-06-26 10:47 - 00000000 _____ () C:\Users\TG\defogger_reenable
2014-06-26 10:47 - 2012-06-11 10:34 - 00000000 ____D () C:\Users\TG
2014-06-26 10:45 - 2014-06-26 10:45 - 00050477 _____ () C:\Users\TG\Desktop\Defogger.exe
2014-06-26 01:06 - 2014-06-25 23:37 - 00003492 _____ () C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl
2014-06-26 00:52 - 2014-06-25 23:48 - 00000000 ____D () C:\Program Files (x86)\ToggleMark
2014-06-26 00:23 - 2014-06-26 00:23 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FREE_SOFTTODAY
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\T4PC
2014-06-25 23:49 - 2014-06-25 23:49 - 00000000 ____D () C:\Program Files (x86)\t4pc_en_7
2014-06-25 23:49 - 2014-06-25 23:48 - 00000000 ____D () C:\Program Files (x86)\V-9.1HD
2014-06-25 23:47 - 2009-10-29 05:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acer GameZone
2014-06-25 23:46 - 2009-10-29 05:38 - 00000000 ____D () C:\Program Files (x86)\Acer GameZone
2014-06-25 23:42 - 2012-06-11 21:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-06-25 23:36 - 2014-06-25 23:36 - 00000000 ____D () C:\Program Files (x86)\-ViewPassword-soft
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieUserList
2014-06-25 23:31 - 2014-06-25 23:31 - 00000000 __SHD () C:\Users\TG\AppData\Local\EmieSiteList
2014-06-25 23:30 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Lavasoft
2014-06-25 23:30 - 2014-05-28 09:30 - 00000000 ____D () C:\Program Files (x86)\Lavasoft
2014-06-25 23:27 - 2014-06-25 23:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Languages
2014-06-25 23:26 - 2014-06-25 23:26 - 00000000 ____D () C:\Help
2014-06-25 23:25 - 2009-10-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Google
2014-06-25 23:21 - 2014-06-25 23:21 - 00469032 _____ () C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Ashampoo
2014-06-25 23:08 - 2014-06-25 23:08 - 00000000 ____D () C:\Users\TG\AppData\Local\ashampoo
2014-06-25 23:08 - 2014-06-25 23:07 - 00000000 ____D () C:\ProgramData\Ashampoo
2014-06-25 23:01 - 2014-06-25 22:57 - 154180952 _____ (Ashampoo GmbH & Co. KG ) C:\Users\TG\Downloads\ashampoo_photo_commander_10_10.2.1_13669.exe
2014-06-25 23:00 - 2012-04-12 20:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP
2014-06-25 22:46 - 2014-06-25 22:39 - 288633368 _____ (Microsoft Corporation) C:\Users\TG\Downloads\SharePointDesigner.exe
2014-06-25 22:34 - 2013-03-20 22:24 - 00000000 ____D () C:\Users\TG\AppData\Local\Windows Live
2014-06-25 22:20 - 2012-06-11 10:45 - 00000000 ____D () C:\Users\TG\Documents\Bluetooth-Exchange-Ordner
2014-06-25 22:15 - 2014-06-25 22:15 - 00000000 ____D () C:\Users\TG\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bluetooth-Geräte
2014-06-23 20:22 - 2009-10-29 05:26 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-23 20:21 - 2009-10-29 05:27 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-23 20:20 - 2009-10-29 05:27 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-23 20:19 - 2009-10-28 20:41 - 00000000 ____D () C:\Windows\ShellNew
2014-06-23 20:18 - 2009-07-14 05:20 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-06-23 20:08 - 2014-06-21 22:25 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-06-18 00:32 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-06-18 00:31 - 2014-06-18 00:31 - 00001175 _____ () C:\Users\TG\Desktop\Free YouTube to MP3 Converter Installation fortsetzen.lnk
2014-06-18 00:31 - 2013-11-17 17:49 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-06-18 00:30 - 2014-06-18 00:30 - 00701808 _____ () C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
2014-06-17 16:25 - 2014-06-26 12:33 - 00130584 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-06-17 16:25 - 2014-06-26 12:33 - 00117712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-06-17 16:25 - 2014-06-26 12:33 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-06-13 10:16 - 2012-06-11 19:14 - 00696870 _____ () C:\Windows\system32\perfh007.dat
2014-06-13 10:16 - 2012-06-11 19:14 - 00148134 _____ () C:\Windows\system32\perfc007.dat
2014-06-13 10:16 - 2009-07-14 07:13 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-09 12:15 - 2014-06-26 00:53 - 00061120 _____ (StdLib) C:\Windows\system32\Drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
2014-06-05 22:20 - 2014-06-05 22:20 - 01707144 _____ () C:\Users\TG\Downloads\Adaware_Installer.exe
2014-05-28 22:55 - 2014-05-28 22:53 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-28 22:53 - 2014-05-28 22:53 - 00001399 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00001387 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-28 22:53 - 2014-05-28 22:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-28 22:52 - 2014-05-28 22:51 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\TG\Downloads\spybot-2.3.exe
2014-05-28 10:10 - 2014-05-28 10:10 - 00000000 ____D () C:\Users\TG\AppData\Roaming\LavasoftStatistics
2014-05-28 09:31 - 2014-05-28 09:31 - 00000000 ____D () C:\Program Files\Lavasoft
2014-05-28 09:27 - 2014-05-28 09:27 - 01727624 _____ () C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
2014-05-28 09:27 - 2014-05-28 09:27 - 00000000 ____D () C:\ProgramData\Lavasoft

Some content of TEMP:
====================
C:\Users\TG\AppData\Local\Temp\AskSLib.dll
C:\Users\TG\AppData\Local\Temp\avgnt.exe
C:\Users\TG\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\TG\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-21 22:15

==================== End Of Log ============================

--- --- ---

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-06-2014
Ran by TG at 2014-06-26 15:54:53
Running from C:\Users\TG\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

==================== Installed Programs ======================

7-Zip 9.22 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0922-000001000000}) (Version: 9.22.00.0 - Igor Pavlov)
Acer Backup Manager (HKLM-x32\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 2.0.0.29 - NewTech Infosystems)
Acer Crystal Eye webcam Ver:1.1.124.1120 (HKLM-x32\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.124.1120 - Chicony Electronics Co.,Ltd.)
Acer eRecovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.05.3005 - Acer Incorporated)
Acer GameZone Console (HKLM-x32\...\{8ed9688e-4f79-4308-91ca-f1c37ca142b4}_is1) (Version: 5.1.0.2 - Oberon Media, Inc.)
Acer GridVista (HKLM-x32\...\GridVista) (Version: 3.01.0730 - Acer Inc.)
Acer PowerSmart Manager (HKLM-x32\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.07.3008 - Acer Incorporated)
Acer Registration (HKLM-x32\...\Acer Registration) (Version: 1.02.3006 - Acer Incorporated)
Acer ScreenSaver (HKLM-x32\...\Acer Screensaver) (Version: 1.1.0715 - Acer Incorporated)
Acer Updater (HKLM-x32\...\{EE171732-BEB4-4576-887D-CB62727F01CA}) (Version: 1.01.3017 - Acer Incorporated)
Acer VCM (HKLM-x32\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.05.3000 - Acer Incorporated)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.5.0.7220 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.5.0.7220 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader X (10.1.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)
Alice Greenfingers (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112920767}) (Version:  - Oberon Media)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version:  - Amazon)
Amazonia (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11273477}) (Version:  - Oberon Media)
Anki (HKLM-x32\...\Anki) (Version:  - )
Apple Application Support (HKLM-x32\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{7446FE8D-C1F9-4D42-AAAE-5DBCE58605A6}) (Version: 6.0.0.59 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.5.450 - Avira)
Backup Manager Basic (x32 Version: 2.0.0.29 - NewTech Infosystems) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bonjour-Druckdienste (HKLM\...\{0DA20600-6130-443B-9D4B-F30520315FA6}) (Version: 2.0.2.0 - Apple Inc.)
Compatibility Pack für 2007 Office System (HKLM-x32\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink PowerDVD 8 (HKLM-x32\...\InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}) (Version: 8.1.3405.50 - CyberLink Corp.)
CyberLink PowerDVD 8 (x32 Version: 8.1.3405.50 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dairy Dash (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115053100}) (Version:  - Oberon Media)
doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version:  - Softland)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
eSobi v2 (HKLM-x32\...\InstallShield_{15D967B5-A4BE-42AE-9E84-64CD062B25AA}) (Version: 2.0.4.000274 - esobi Inc.)
eSobi v2 (x32 Version: 2.0.4.000274 - esobi Inc.) Hidden
Farm Frenzy 2 (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11531173}) (Version:  - Oberon Media)
First Class Flurry (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115208410}) (Version:  - Oberon Media)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Free Studio version 2013 (HKLM-x32\...\Free Studio_is1) (Version: 6.2.0.1029 - DVDVideoSoft Ltd.)
FreeMind (HKLM-x32\...\B991B020-2968-11D8-AF23-444553540000_is1) (Version: 0.9.0 - )
GanttProject (HKLM-x32\...\GanttProject) (Version:  - )
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
Granny In Paradise (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110551697}) (Version:  - Oberon Media)
Heroes of Hellas (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113786380}) (Version:  - Oberon Media)
Identity Card (HKLM-x32\...\Identity Card) (Version: 1.00.3002 - Acer Incorporated)
Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: 8.15.10.1892 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Launch Manager (HKLM-x32\...\LManager) (Version: 3.0.03 - Acer Inc.)
Merriam Websters Spell Jam (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112662477}) (Version:  - Oberon Media)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile DEU Language Pack (HKLM\...\Microsoft .NET Framework 4 Client Profile DEU Language Pack) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Language Pack 2007 - German/Deutsch (HKLM-x32\...\OMUI.de-de) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office O MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM-x32\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office SharePoint Designer MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Standard Edition 2003 (HKLM-x32\...\{91120407-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office X MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411 (HKLM-x32\...\{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}) (Version: 9.0.30411 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1 - Nokia) Hidden
MindManager 4.0 (HKLM-x32\...\MindManager 4.0) (Version: 4.0.60 - Mindjet LLC)
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 30.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 de)) (Version: 30.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 24.6.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.6.0 (x86 de)) (Version: 24.6.0 - Mozilla)
MSVC80_x64_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC80_x86_v2 (x32 Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x64 (Version: 1.0.1.2 - Nokia) Hidden
MSVC90_x86 (x32 Version: 1.0.1.2 - Nokia) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.5 - F.J. Wechselberger)
MyWinLocker (HKLM-x32\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.76.0 - Egis Technology Inc.)
Nokia Connectivity Cable Driver (HKLM-x32\...\{A57025CC-5F2E-4D01-B387-06DB10500D43}) (Version: 7.1.78.0 - Nokia)
Nokia Suite (HKLM-x32\...\Nokia Suite) (Version: 3.5.34.0 - Nokia)
Nokia Suite (x32 Version: 3.5.34.0 - Nokia) Hidden
NTI Backup Now 5 (HKLM-x32\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.627 - NewTech Infosystems)
NTI Backup Now Standard (x32 Version: 5.1.2.627 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM-x32\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.12.6623 - NewTech Infosystems)
NTI Media Maker 8 (x32 Version: 8.0.12.6623 - NewTech Infosystems) Hidden
OpenOffice.org 3.4 (HKLM-x32\...\{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}) (Version: 3.4.9590 - OpenOffice.org)
OpenProj (HKLM-x32\...\{13702021-43FB-480C-912F-D9B74A538288}) (Version: 1.4.0 - Serena Software Inc.)
Optical Drive Power Management (HKLM-x32\...\{AE09C972-EEB2-4DA5-8090-0FCF54576854}) (Version: 1.01.3002 - Acer Incorporated)
PC Connectivity Solution (HKLM-x32\...\{7390478C-8581-415E-92E9-2997D9306B81}) (Version: 12.0.32.0 - Nokia)
PDF Split And Merge Basic (HKLM\...\{C91B24F6-1629-11E2-B696-21676188709B}) (Version: 2.2.2 - Andrea Vacondio)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Readiris Pro 10 (HKLM-x32\...\{14D08502-FEE4-40E5-90D3-8A967A1D8BA2}) (Version:  - )
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5911 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7100.30093 - Realtek Semiconductor Corp.)
Samsung CLX-6200 Series (HKLM-x32\...\Samsung CLX-6200 Series) (Version:  - Samsung Electronics CO.,LTD)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.2.12054_18 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.2.12054_18 - Samsung Electronics Co., Ltd.) Hidden
Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)
Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.6 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.6.106 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 14.0.6.0 - Synaptics Incorporated)
t4pc_en_7 (HKLM-x32\...\t4pc_en_7_is1) (Version:  - T4PC) <==== ATTENTION
TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.20202 - TeamViewer)
ToggleMark (HKLM\...\ToggleMark) (Version: 2014.06.24.232306 - ToggleMark)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (HKLM-x32\...\{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (HKLM-x32\...\{8E34682C-8118-31F1-BC4C-98CD9675E1C2}.KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
V-9.1HD (HKLM-x32\...\V-9.1HD) (Version: 1.34.6.10 - V-9.1HD)
ViewPassword (HKLM-x32\...\B800FCEC-6357-A5E7-D27D-6834D5A7A88F) (Version:  - ViewPassword-software) <==== ATTENTION
VLC media player 2.0.1 (HKLM\...\VLC media player) (Version: 2.0.1 - VideoLAN)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Welcome Center (HKLM-x32\...\Acer Welcome Center) (Version: 1.00.3008 - Acer Incorporated)
WIDCOMM Bluetooth Software (HKLM\...\{A1439D4F-FD46-47F2-A1D3-FEE097C29A09}) (Version: 6.5.1.4100 - Broadcom Corporation)
Windows Driver Package - Broadcom Bluetooth  (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom)
Windows Driver Package - Broadcom Bluetooth  (09/11/2009 6.2.0.9407) (HKLM\...\3932CA781A7894D20116FDF60F878301800EA8AB) (Version: 09/11/2009 6.2.0.9407 - Broadcom)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{76618402-179D-4699-A66B-D351C59436BC}) (Version: 14.0.8089.726 - Microsoft Corporation)
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Nokia pccsmcfd LegacyDriver  (05/31/2012 7.1.2.0) (HKLM\...\62BBD193ADFDBB228C7E1ADB56463F5732FF7F6F) (Version: 05/31/2012 7.1.2.0 - Nokia)
yEd Graph Editor 3.10.2 (HKLM-x32\...\3309-7404-0599-8908) (Version: 3.10.2 - yWorks GmbH)

==================== Restore Points  =========================

13-06-2014 08:38:11 Windows Update
23-06-2014 18:16:56 Removed Microsoft Office Home and Student 2007
25-06-2014 21:03:23 Installed Microsoft SharePoint Designer 2010
25-06-2014 21:05:21 Installed Microsoft SharePoint Designer 2010
25-06-2014 21:28:28 AA11

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0598810B-D992-41D8-91BD-59B7F93C0940} - \099c6c9e-8fbb-4604-9a19-02127ec36095-4 No Task File <==== ATTENTION
Task: {0A873B89-318F-48DF-A3C6-8EA628D82E6A} - \099c6c9e-8fbb-4604-9a19-02127ec36095-11 No Task File <==== ATTENTION
Task: {0CF33E94-623E-4B7D-8AFA-08C9F8A2EB6D} - \099c6c9e-8fbb-4604-9a19-02127ec36095-5 No Task File <==== ATTENTION
Task: {0F41783E-8034-42AA-9644-D3A10E7648B4} - \099c6c9e-8fbb-4604-9a19-02127ec36095-1 No Task File <==== ATTENTION
Task: {1AA5513A-937D-425C-8DA0-23C80B5DFEA7} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDScan.exe
Task: {449B0794-88D5-4B63-8A01-D13946965A9F} - System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl => C:\Users\TG\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl\minibarchrome.exe
Task: {52560D07-92E3-4F23-8E48-E836CBEB5567} - \099c6c9e-8fbb-4604-9a19-02127ec36095-2 No Task File <==== ATTENTION
Task: {75779615-C6E6-44A2-A2A6-BBD33A6534C3} - \099c6c9e-8fbb-4604-9a19-02127ec36095-3 No Task File <==== ATTENTION
Task: {88C4F206-2994-4AAB-8EAE-1AB977097341} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDUpdate.exe
Task: {ADE4E189-DB85-48DC-B423-1B9DCC36CF1E} - \ViewPassword Update No Task File <==== ATTENTION
Task: {BA711357-13D6-4C1E-A0C3-9AB11BC9CFDF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {BE5A024A-8133-45E4-9A7B-3DB45C98A54D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search &amp; Destroy 2\SDImmunize.exe
Task: {D374CFB9-B833-41EB-9B0E-B61039C1BF8D} - System32\Tasks\McQcModifier-5c47-a7b0 => C:\ProgramData\McQcModifier-5c47-a7b0\McQcModifier-5c47-a7b0.cmd [2009-08-29] ()
Task: {EC5C55BF-61CC-422E-9BEE-EC1E5D16B5DD} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {F239A04C-330F-4601-8554-148BC181A23F} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {F3AD2C43-5D32-4C8E-A962-B8AD24920116} - \ViewPassword_wd No Task File <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2008-10-06 06:37 - 2008-10-06 06:37 - 00022016 _____ () C:\Windows\System32\c620cl6.dll
2014-06-25 23:49 - 2014-06-19 12:14 - 03354608 _____ () C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe
2012-06-11 10:47 - 2012-06-11 10:46 - 00200704 _____ () C:\Windows\PLFSetI.exe
2012-10-04 21:52 - 2008-01-09 06:41 - 00491520 ____R () C:\Windows\twain_32\Samsung\CLX6200\Scan2Pc.exe
2012-10-04 22:00 - 2008-02-15 17:12 - 00536576 _____ () C:\Windows\Samsung\PanelMgr\SSMMgr.exe
2012-10-04 22:00 - 2007-03-23 07:43 - 00327168 _____ () C:\Windows\Samsung\PanelMgr\caller64.exe
2014-06-25 01:23 - 2014-06-25 01:23 - 00317728 _____ () C:\Program Files (x86)\ToggleMark\updateToggleMark.exe
2014-06-26 00:52 - 2014-06-26 00:52 - 00317728 _____ () C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe
2012-08-27 21:33 - 2012-08-27 21:33 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-08-27 21:33 - 2012-08-27 21:33 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2009-02-03 02:33 - 2009-02-03 02:33 - 00460199 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2008-09-29 02:55 - 2008-09-29 02:55 - 01076224 _____ () C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\ACE.dll
2014-05-28 22:53 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-05-28 22:53 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-05-28 22:53 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-05-28 22:53 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-05-28 22:53 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 08506792 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtGui4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 02353576 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtCore4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 01013672 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtNetwork4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00363944 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtXml4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 02480552 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtDeclarative4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 01346472 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtScript4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00205736 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtSql4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 02652584 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtXmlPatterns4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00032680 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qgif4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00035240 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qico4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00206760 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\imageformats\qjpeg4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 11166120 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtWebKit4.dll
2012-08-03 16:07 - 2012-08-03 16:07 - 00276392 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\phonon4.dll
2012-07-02 11:29 - 2012-07-02 11:29 - 00391600 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\ssoengine.dll
2012-07-02 11:29 - 2012-07-02 11:29 - 00059280 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\securestorage.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00437672 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\NService.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00445864 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\sqldrivers\qsqlite4.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00520104 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtMultimediaKit1.dll
2012-08-03 16:06 - 2012-08-03 16:06 - 00720296 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\QtOpenGL4.dll
2012-08-03 16:05 - 2012-08-03 16:05 - 00604072 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\CommonUpdateChecker.dll
2012-07-02 11:28 - 2012-07-02 11:28 - 00110080 _____ () C:\Program Files (x86)\Nokia\Nokia Suite\mediaservice\dsengine.dll
2012-10-04 21:52 - 2007-09-20 07:14 - 00184320 ____R () C:\Windows\twain_32\Samsung\CLX6200\IMFilter.dll
2012-10-04 21:52 - 2007-09-20 07:15 - 01384520 ____R () C:\Windows\twain_32\Samsung\CLX6200\ssole.dll
2014-06-21 22:25 - 2014-06-21 22:25 - 03022960 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2014-06-21 22:25 - 2014-06-21 22:25 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2014-06-21 22:25 - 2014-06-21 22:25 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-06-25 23:26 - 2014-06-25 23:27 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-05-18 13:36 - 2014-05-18 13:36 - 16361136 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:AB689DEA
AlternateDataStreams: C:\ProgramData\Temp:E1F04E8D

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcmscsvc => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MCODS => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Acer VCM.lnk => C:\Windows\pss\Acer VCM.lnk.CommonStartup
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPDLR => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (06/26/2014 02:28:52 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR" des "version"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (06/26/2014 01:55:13 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (06/26/2014 02:28:52 PM) (Source: SideBySide) (EventID: 63) (User: )
Description: assemblyIdentityversionMAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINORc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dllc:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll3


CodeIntegrity Errors:
===================================
  Date: 2013-06-20 21:51:19.052
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:18.859
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:15.945
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:15.755
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:13.252
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:13.060
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:10.757
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:10.567
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:08.012
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-06-20 21:51:07.824
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\SysWOW64\FsUsbExDisk.Sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 4027.79 MB
Available physical RAM: 1994.06 MB
Total Pagefile: 8053.76 MB
Available Pagefile: 5557.05 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (ACER) (Fixed) (Total:453.94 GB) (Free:254.06 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 0AC50AC4)
Partition 1: (Not Active) - (Size=12 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=454 GB) - (Type=07 NTFS)

==================== End Of Log ============================

cosinus · 26.06.2014, 15:21

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKLM-x32\...\Run: [t4pc_en_7] => "C:\Program Files (x86)\t4pc_en_7\t4pc_en_7.exe"
HKLM-x32\...\RunOnce: [upt4pc_en_7.exe] - C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe -runonce [3354608 2014-06-19] ()
FF HKCU\...\Firefox\Extensions: [{C9A0BC53-382F-DCC9-F64E-2036D0B32251}] - C:\Program Files (x86)\-ViewPassword-soft\174.xpi
FF Extension: No Name - C:\Program Files (x86)\-ViewPassword-soft\174.xpi [2014-06-25]
S2 servervo; C:\Users\TG\AppData\Roaming\VOPackage\VOsrv.exe [X]
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys [61120 2014-06-09] (StdLib)
Task: {0598810B-D992-41D8-91BD-59B7F93C0940} - \099c6c9e-8fbb-4604-9a19-02127ec36095-4 No Task File <==== ATTENTION
Task: {0A873B89-318F-48DF-A3C6-8EA628D82E6A} - \099c6c9e-8fbb-4604-9a19-02127ec36095-11 No Task File <==== ATTENTION
Task: {0CF33E94-623E-4B7D-8AFA-08C9F8A2EB6D} - \099c6c9e-8fbb-4604-9a19-02127ec36095-5 No Task File <==== ATTENTION
Task: {0F41783E-8034-42AA-9644-D3A10E7648B4} - \099c6c9e-8fbb-4604-9a19-02127ec36095-1 No Task File <==== ATTENTION
Task: {52560D07-92E3-4F23-8E48-E836CBEB5567} - \099c6c9e-8fbb-4604-9a19-02127ec36095-2 No Task File <==== ATTENTION
Task: {75779615-C6E6-44A2-A2A6-BBD33A6534C3} - \099c6c9e-8fbb-4604-9a19-02127ec36095-3 No Task File <==== ATTENTION
Task: {ADE4E189-DB85-48DC-B423-1B9DCC36CF1E} - \ViewPassword Update No Task File <==== ATTENTION
Task: {EC5C55BF-61CC-422E-9BEE-EC1E5D16B5DD} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {F239A04C-330F-4601-8554-148BC181A23F} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {F3AD2C43-5D32-4C8E-A962-B8AD24920116} - \ViewPassword_wd No Task File <==== ATTENTION
C:\Users\TG\AppData\Local\t4pc_en_7
C:\Program Files (x86)\-ViewPassword-soft
C:\Users\TG\AppData\Roaming\VOPackage
C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
C:\Users\TG\AppData\Local\Temp\AskSLib.dll
C:\Users\TG\AppData\Local\Temp\avgnt.exe
C:\Users\TG\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\TG\AppData\Local\Temp\Quarantine.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

BRTom · 26.06.2014, 21:09

Hier die Fixlog-Datei:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-06-2014
Ran by TG at 2014-06-26 22:07:24 Run:1
Running from C:\Users\TG\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKLM-x32\...\Run: [t4pc_en_7] => "C:\Program Files (x86)\t4pc_en_7\t4pc_en_7.exe"
HKLM-x32\...\RunOnce: [upt4pc_en_7.exe] - C:\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe -runonce [3354608 2014-06-19] ()
FF HKCU\...\Firefox\Extensions: [{C9A0BC53-382F-DCC9-F64E-2036D0B32251}] - C:\Program Files (x86)\-ViewPassword-soft\174.xpi
FF Extension: No Name - C:\Program Files (x86)\-ViewPassword-soft\174.xpi [2014-06-25]
S2 servervo; C:\Users\TG\AppData\Roaming\VOPackage\VOsrv.exe [X]
R1 {af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64; C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys [61120 2014-06-09] (StdLib)
Task: {0598810B-D992-41D8-91BD-59B7F93C0940} - \099c6c9e-8fbb-4604-9a19-02127ec36095-4 No Task File <==== ATTENTION
Task: {0A873B89-318F-48DF-A3C6-8EA628D82E6A} - \099c6c9e-8fbb-4604-9a19-02127ec36095-11 No Task File <==== ATTENTION
Task: {0CF33E94-623E-4B7D-8AFA-08C9F8A2EB6D} - \099c6c9e-8fbb-4604-9a19-02127ec36095-5 No Task File <==== ATTENTION
Task: {0F41783E-8034-42AA-9644-D3A10E7648B4} - \099c6c9e-8fbb-4604-9a19-02127ec36095-1 No Task File <==== ATTENTION
Task: {52560D07-92E3-4F23-8E48-E836CBEB5567} - \099c6c9e-8fbb-4604-9a19-02127ec36095-2 No Task File <==== ATTENTION
Task: {75779615-C6E6-44A2-A2A6-BBD33A6534C3} - \099c6c9e-8fbb-4604-9a19-02127ec36095-3 No Task File <==== ATTENTION
Task: {ADE4E189-DB85-48DC-B423-1B9DCC36CF1E} - \ViewPassword Update No Task File <==== ATTENTION
Task: {EC5C55BF-61CC-422E-9BEE-EC1E5D16B5DD} - \globalUpdateUpdateTaskMachineCore No Task File <==== ATTENTION
Task: {F239A04C-330F-4601-8554-148BC181A23F} - \globalUpdateUpdateTaskMachineUA No Task File <==== ATTENTION
Task: {F3AD2C43-5D32-4C8E-A962-B8AD24920116} - \ViewPassword_wd No Task File <==== ATTENTION
C:\Users\TG\AppData\Local\t4pc_en_7
C:\Program Files (x86)\-ViewPassword-soft
C:\Users\TG\AppData\Roaming\VOPackage
C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys
C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe
C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe
C:\Users\TG\AppData\Local\Temp\AskSLib.dll
C:\Users\TG\AppData\Local\Temp\avgnt.exe
C:\Users\TG\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\TG\AppData\Local\Temp\Quarantine.exe
         
*****************

HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\t4pc_en_7 => value deleted successfully.
HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\\upt4pc_en_7.exe => value deleted successfully.
HKCU\Software\Mozilla\Firefox\Extensions\\{C9A0BC53-382F-DCC9-F64E-2036D0B32251} => value deleted successfully.
C:\Program Files (x86)\-ViewPassword-soft\174.xpi => Moved successfully.
servervo => Service deleted successfully.
{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64 => Service stopped successfully.
{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64 => Service deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0598810B-D992-41D8-91BD-59B7F93C0940}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0598810B-D992-41D8-91BD-59B7F93C0940}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\099c6c9e-8fbb-4604-9a19-02127ec36095-4' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0A873B89-318F-48DF-A3C6-8EA628D82E6A}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0A873B89-318F-48DF-A3C6-8EA628D82E6A}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\099c6c9e-8fbb-4604-9a19-02127ec36095-11' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0CF33E94-623E-4B7D-8AFA-08C9F8A2EB6D}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0CF33E94-623E-4B7D-8AFA-08C9F8A2EB6D}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\099c6c9e-8fbb-4604-9a19-02127ec36095-5' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{0F41783E-8034-42AA-9644-D3A10E7648B4}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{0F41783E-8034-42AA-9644-D3A10E7648B4}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\099c6c9e-8fbb-4604-9a19-02127ec36095-1' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{52560D07-92E3-4F23-8E48-E836CBEB5567}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{52560D07-92E3-4F23-8E48-E836CBEB5567}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\099c6c9e-8fbb-4604-9a19-02127ec36095-2' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{75779615-C6E6-44A2-A2A6-BBD33A6534C3}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{75779615-C6E6-44A2-A2A6-BBD33A6534C3}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\099c6c9e-8fbb-4604-9a19-02127ec36095-3' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{ADE4E189-DB85-48DC-B423-1B9DCC36CF1E}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADE4E189-DB85-48DC-B423-1B9DCC36CF1E}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ViewPassword Update' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EC5C55BF-61CC-422E-9BEE-EC1E5D16B5DD}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EC5C55BF-61CC-422E-9BEE-EC1E5D16B5DD}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\globalUpdateUpdateTaskMachineCore' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{F239A04C-330F-4601-8554-148BC181A23F}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F239A04C-330F-4601-8554-148BC181A23F}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\globalUpdateUpdateTaskMachineUA' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{F3AD2C43-5D32-4C8E-A962-B8AD24920116}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F3AD2C43-5D32-4C8E-A962-B8AD24920116}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\ViewPassword_wd' => Key deleted successfully.
C:\Users\TG\AppData\Local\t4pc_en_7 => Moved successfully.
C:\Program Files (x86)\-ViewPassword-soft => Moved successfully.
"C:\Users\TG\AppData\Roaming\VOPackage" => File/Directory not found.
C:\Windows\System32\drivers\{af16abf4-eac1-49b4-93fc-58f6ca799135}Gw64.sys => Moved successfully.
C:\Users\TG\Downloads\soft32_IrfanView_1.0.exe => Moved successfully.
C:\Users\TG\Downloads\Adaware_Installer_11.1.5354.exe => Moved successfully.
C:\Users\TG\AppData\Local\Temp\AskSLib.dll => Moved successfully.
C:\Users\TG\AppData\Local\Temp\avgnt.exe => Moved successfully.
C:\Users\TG\AppData\Local\Temp\NOSEventMessages.dll => Moved successfully.
C:\Users\TG\AppData\Local\Temp\Quarantine.exe => Moved successfully.

==== End of Fixlog ====

cosinus · 26.06.2014, 22:08

Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

BRTom · 27.06.2014, 11:48

Danke für die Super-Unterstützung, hier die Files

mbam.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 27.06.2014
Suchlauf-Zeit: 07:54:11
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.2.1012
Malware Datenbank: v2014.06.27.02
Rootkit Datenbank: v2014.06.23.02
Lizenz: Testversion
Malware Schutz: Aktiviert
Bösartiger Webseiten Schutz: Aktiviert
Self-protection: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: TG

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 286946
Verstrichene Zeit: 21 Min, 45 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristics: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 2
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\updateToggleMark.exe, 2460, Löschen bei Neustart, [2d413e3f0d6e1e18087be0907190d828]
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe, 2760, Löschen bei Neustart, [0d61eb920f6cc472097aa9c7d62bfd03]

Module: 0
(No malicious items detected)

Registrierungsschlüssel: 20
PUP.Optional.ToggleMark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Update ToggleMark, In Quarantäne, [2d413e3f0d6e1e18087be0907190d828], 
PUP.Optional.ToggleMark.A, HKLM\SYSTEM\CURRENTCONTROLSET\SERVICES\Util ToggleMark, In Quarantäne, [0d61eb920f6cc472097aa9c7d62bfd03], 
PUP.Optional.BrowseFox.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}, In Quarantäne, [fe70403dc3b8989efd062d531de50df3], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ToggleMark, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{5A4E3A41-FA55-4BDA-AED7-CEBE6E7BCB52}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{4E6354DE-9115-4AEE-BD21-C46C3E8A49DB}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{FC073BDA-C115-4A1D-9DF9-9B5C461482E5}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{A2D733A7-73B0-4C6B-B0C7-06A432950B66}, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, HKLM\SOFTWARE\WOW6432NODE\ToggleMark, In Quarantäne, [7bf3fb82afccef472d27319242c0db25], 
PUP.Optional.IMGUpdater.A, HKLM\SOFTWARE\WOW6432NODE\IMGUPDATER, In Quarantäne, [a7c76a131a611c1a27dcd5db0df5748c], 
PUP.Optional.ToggleMark.A, HKU\S-1-5-21-3212772127-1644909334-2868257101-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\ToggleMark, In Quarantäne, [c8a6abd24239df5798bd18ab5fa353ad], 
PUP.Optional.Iminent.A, HKU\S-1-5-21-3212772127-1644909334-2868257101-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\LOWREGISTRY\Iminent, In Quarantäne, [cba304794833ff374369299241c1cd33], 
PUP.Optional.ViewPassword.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{C27A6CC0-EC7F-6C40-D81C-C2C0E86CB95B}, In Quarantäne, [beb0750804773ef82f23b9d4937159a7], 
PUP.Optional.ViewPassword.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{C27A6CC0-EC7F-6C40-D81C-C2C0E86CB95B}, In Quarantäne, [beb0750804773ef82f23b9d4937159a7], 
PUP.Optional.ViewPassword.A, HKLM\SOFTWARE\CLASSES\TYPELIB\{DD9AC078-326F-5AB1-57C3-3B8EFE00B05B}, In Quarantäne, [beb0750804773ef82f23b9d4937159a7], 
PUP.Optional.ViewPassword.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{E3270255-EB96-FE1A-77AB-26BE249E1CFF}, In Quarantäne, [beb0750804773ef82f23b9d4937159a7], 
PUP.Optional.ViewPassword.A, HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{DD9AC078-326F-5AB1-57C3-3B8EFE00B05B}, In Quarantäne, [beb0750804773ef82f23b9d4937159a7], 

Registrierungswerte: 1
PUP.Optional.IMGUpdater.A, HKLM\SOFTWARE\WOW6432NODE\IMGUPDATER|ConfigBlockJSN, {
   "MAIN_SWITCH" : true,
   "UPDATABLE" : {
      "064A36CC-4404-42F9-B26E-3BFD515F2447" : {
         "lastupdated" : 0,
         "mindeltatime" : 259200
      },
      "2C200CBA-D536-40C8-902D-9C34FD10AD85" : {
         "lastupdated" : 0,
         "localversion" : "0",
         "mindeltatime" : 259200
      },
      "4C973056-22D8-488C-A358-AEA00CC2EC7D" : {
         "lastupdated" : 0,
         "mindeltatime" : 259200
      }
   }
}
, In Quarantäne, [a7c76a131a611c1a27dcd5db0df5748c]

Registrierungsdaten: 0
(No malicious items detected)

Ordner: 4
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark, Löschen bei Neustart, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin, Löschen bei Neustart, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.Conduit.A, C:\Users\TG\AppData\Local\Temp\CT3323737, In Quarantäne, [8de16617186338fe0268f2a1b949d828], 

Dateien: 26
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\updateToggleMark.exe, Löschen bei Neustart, [2d413e3f0d6e1e18087be0907190d828], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.exe, Löschen bei Neustart, [0d61eb920f6cc472097aa9c7d62bfd03], 
PUP.Optional.Conduit.A, C:\Users\TG\Downloads\MyPhoneExplorer_TSV21YHIN.exe, In Quarantäne, [620cfc81e09b0f273a576de2d8293cc4], 
PUP.Optional.Softonic.A, C:\Users\TG\Downloads\SoftonicDownloader_fuer_anki.exe, In Quarantäne, [35396815285386b086aa28fd6e9334cc], 
PUP.Optional.Iminent.A, C:\Windows\System32\Tasks\FinishInstall igdhbblpcellaljokkpfhcjlagemhgjl, In Quarantäne, [9fcffd80c3b8a393b5549715b44edb25], 
PUP.Optional.ToggleMark.A, C:\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\extensions\{af16abf4-eac1-49b4-93fc-58f6ca799135}.xpi, In Quarantäne, [3d31dca15f1c290df0d103aa5da548b8], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\ToggleMark.ico, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\0, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\7za.exe, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\ToggleMarkUninstall.exe, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\updateToggleMark.InstallState, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\7za.exe, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\BrowserAdapterS.7z, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\sqlite3.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\ToggleMark.BrowserAdapter.exe, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\ToggleMark.PurBrowse64.exe, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\ToggleMark.PurBrowseG.zip, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\utilToggleMark.InstallState, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\{af16abf4-eac1-49b4-93fc-58f6ca799135}.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.Bromon.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.BroStats.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.BrowserAdapterS.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.CompatibilityChecker.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.FFUpdate.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.IEUpdate.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 
PUP.Optional.ToggleMark.A, C:\Program Files (x86)\ToggleMark\bin\plugins\ToggleMark.PurBrowseG.dll, In Quarantäne, [bcb2502d8bf0c175f3608b38956dc53b], 

Physische Sektoren: 0
(No malicious items detected)


(end)

ESET log.txt

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7587
# api_version=3.0.2
# EOSSerial=82612d0e74126c478223b63a20b4595d
# engine=18911
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-06-27 10:36:58
# local_time=2014-06-27 12:36:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 99 21676 850260 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 95957 155495268 0 0
# scanned=259514
# found=29
# cleaned=0
# scan_time=11814
sh=103A2F97E88142DBC3A02536C9D6B0555DD8437C ft=1 fh=c71c0011389f51a3 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_64\freeSoftToday_widget.exe.vir"
sh=21414F593C1EB6166307C94CAB88771DD7E1A93D ft=1 fh=648870a43ff7a269 vn="Variante von Win32/AdWare.EoRezo.AU Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_64\fst_de_64.exe.vir"
sh=5B54E24892C8E7F424AF273E0F051B89858C89AE ft=1 fh=570f49fa3b076b35 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\fst_de_64\predm.exe.vir"
sh=91C45E16A830548CC423AA01C18E456844DBB6B6 ft=1 fh=0d441bdf7e3fb258 vn="Win32/Toolbar.Iminent.C evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Iminent\inst\Bootstrapper\IminentUninstall.exe.vir"
sh=DEF85D609AF52A0F878CA80F53264C1524E48A4A ft=1 fh=c41213f667b13f46 vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\TG\AppData\Local\fst_de_64\upfst_de_64.exe.vir"
sh=7A2589020E1532105EA0B3845BAEDA0271AA2F42 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\TG\AppData\Roaming\Mozilla\Firefox\Profiles\oqsg4t4l.default\Extensions\a54e453c-130a-4769-9333-c5ec2aa914c5@9bd7cc89-9c7c-44e9-a03b-042b92d363f0.com\extensionData\plugins\91.js.vir"
sh=EF4C3D5EB1BE1CE32E78F93BFF98BE1F01229DF2 ft=1 fh=c71c0011f85d84c1 vn="Variante von Win32/AdWare.AddLyrics.AQ Anwendung" ac=I fn="C:\FRST\Quarantine\C\Program Files (x86)\-ViewPassword-soft\-ViewPassword-soft\ViewPasswordon174.exe"
sh=D5226170F67ECC3C885DB42A6AEA025B02B26F29 ft=1 fh=e2c3ceef38f4554c vn="Variante von Win32/Adware.EoRezo.AJ Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\TG\AppData\Local\t4pc_en_7\upt4pc_en_7.exe"
sh=E6087C460ACDF7239A62125C067B883112D4616F ft=1 fh=1da6c5dcda1c8a45 vn="Win32/InstallMonetizer.AX evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\TG\AppData\Local\t4pc_en_7\Download\majt4pc.exe"
sh=320E06DF666307CFF4637F6204F0572C12E032DB ft=1 fh=709a833c8f49e980 vn="Variante von Win32/DownloadGuide.A evtl. unerwünschte Anwendung" ac=I fn="C:\FRST\Quarantine\C\Users\TG\Downloads\soft32_IrfanView_1.0.exe.xBAD"
sh=5B54E24892C8E7F424AF273E0F051B89858C89AE ft=1 fh=570f49fa3b076b35 vn="Win32/Adware.EoRezo.AS Anwendung" ac=I fn="C:\Program Files (x86)\t4pc_en_7\predm.exe"
sh=1B0CF29B09D476117F5C2806196FBB62A5E4E10E ft=1 fh=4d87c7c4203bf4eb vn="Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\099c6c9e-8fbb-4604-9a19-02127ec36095-11.exe"
sh=564C07690513A7BAE3D6127FA50234EEB9E1F778 ft=1 fh=77937b4620ea03ac vn="Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\099c6c9e-8fbb-4604-9a19-02127ec36095-2.exe"
sh=1B0CF29B09D476117F5C2806196FBB62A5E4E10E ft=1 fh=4d87c7c4203bf4eb vn="Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\099c6c9e-8fbb-4604-9a19-02127ec36095-3.exe"
sh=F63655DD6FA7B9D8D142D3C94B4FA89AF9DEC743 ft=1 fh=3a5fee453a8f2280 vn="Variante von Win32/Toolbar.CrossRider.AK evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\099c6c9e-8fbb-4604-9a19-02127ec36095-4.exe"
sh=C6F52C51DA33D21D3F39AE6DEC649643820EB810 ft=1 fh=dbd212c17bdfbf54 vn="Variante von Win32/Toolbar.CrossRider.AH evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\099c6c9e-8fbb-4604-9a19-02127ec36095-5.exe"
sh=9BCA94138A2F2C00C904A8F2387C84983E2432E5 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\099c6c9e-8fbb-4604-9a19-02127ec36095.crx"
sh=F98677D17197080AD61E60F348F174B8AF278D19 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\360-52916.crx"
sh=9BCA94138A2F2C00C904A8F2387C84983E2432E5 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\52916.crx"
sh=21215683BBF89A50CDA5EF6DBFE178F265F462BC ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\52916.xpi"
sh=9B7D74F7390B1772BD8BFC477E2F3FE26DE68858 ft=1 fh=faa8610cb87cb02a vn="Variante von Win32/Packed.VMDetector.E evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\utils.exe"
sh=9D70B64C507D4C0A7C34FF9761945F7935335DAB ft=1 fh=a8f287a81dddaadf vn="Variante von Win32/Toolbar.CrossRider.AL evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\V-9.1HD-bg.exe"
sh=ED358E82A61C731E5457D98E00D097248E691EE7 ft=1 fh=9602663caef5aa15 vn="Variante von Win32/Toolbar.CrossRider.AF evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\V-9.1HD-bho.dll"
sh=C369B82EDAB6AFE203A8A508F846083E547A40E9 ft=1 fh=a1daa6089797bc27 vn="Variante von Win64/Toolbar.Crossrider.F evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\V-9.1HD-bho64.dll"
sh=56ED1444A872906F39D62A83410FD3706F2F53B7 ft=1 fh=061b25ba32c75145 vn="Variante von Win32/Toolbar.CrossRider.AJ evtl. unerwünschte Anwendung" ac=I fn="C:\Program Files (x86)\V-9.1HD\V-9.1HD-codedownloader.exe"
sh=534ED9D4A175A415E49E53E063A7A55B015CF229 ft=1 fh=d2172c34719c6886 vn="Variante von Win32/InstallCore.PK evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TG\AppData\Local\Temp\ICReinstall_nsmDD48.tmp"
sh=13287F94C77CE22E0C11855F6DD07512CC74C105 ft=1 fh=080273d70ec48dd3 vn="Win32/Toolbar.Conduit evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TG\Downloads\FreeStudio590.exe"
sh=B9623FD3460649E450A80DB5FA1FB013B93307BB ft=1 fh=c71c00112871741b vn="Variante von Win32/InstallCore.OZ evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe"
sh=76C19267783B1C3FBE78C7EDFB19EEE1CA020E5B ft=1 fh=24f1c525cd32bc9c vn="Win32/DownWare.L evtl. unerwünschte Anwendung" ac=I fn="C:\Users\TG\Downloads\MyPhoneExplorer_TSV21YHIN\0e8a8fc29a4f3fa38247ff96cc95e649_MyPhoneExplorer_Setup_1.8.5.exe"

cosinus · 27.06.2014, 12:41

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Program Files (x86)\t4pc_en_7\predm.exe
C:\Program Files (x86)\V-9.1HD
C:\Users\TG\Downloads\FreeStudio590.exe
C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
C:\Users\TG\Downloads\MyPhoneExplorer_TSV21YHIN\0e8a8fc29a4f3fa38247ff96cc95e649_MyPhoneExplorer_Setup_1.8.5.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

BRTom · 27.06.2014, 13:30

Hier das Fixlog

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-06-2014
Ran by TG at 2014-06-27 14:29:14 Run:2
Running from C:\Users\TG\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Program Files (x86)\t4pc_en_7\predm.exe
C:\Program Files (x86)\V-9.1HD
C:\Users\TG\Downloads\FreeStudio590.exe
C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe
C:\Users\TG\Downloads\MyPhoneExplorer_TSV21YHIN\0e8a8fc29a4f3fa38247ff96cc95e649_MyPhoneExplorer_Setup_1.8.5.exe
         
*****************

C:\Program Files (x86)\t4pc_en_7\predm.exe => Moved successfully.
C:\Program Files (x86)\V-9.1HD => Moved successfully.
C:\Users\TG\Downloads\FreeStudio590.exe => Moved successfully.
C:\Users\TG\Downloads\FreeYouTubeToMP3Converter.exe => Moved successfully.
C:\Users\TG\Downloads\MyPhoneExplorer_TSV21YHIN\0e8a8fc29a4f3fa38247ff96cc95e649_MyPhoneExplorer_Setup_1.8.5.exe => Moved successfully.

==== End of Fixlog ====

cosinus · 27.06.2014, 13:53

TFC - Temp File Cleaner

Lade dir

TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.

Öffne die TFC.exe.
Vista und Win 7 User mit Rechtsklick "als Administrator starten".
Schließe alle anderen Programme.
Drücke auf den Button Start.
Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.

Sieht soweit ok aus

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ist aber nur optional. Um Usertracking zu verhindern kann man gut die Firefox-Erweiterung Ghostery verwenden.

Info: Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

BRTom · 27.06.2014, 16:46

Derzeit wirkt alles o.k. - das war eine Super-Sache, ganz herzliches Dankeschön.

Schnell, kompetent und vor allem für mich als 3/8-Profi jederzeit zu verstehen.

Dickes Danke schön an alle

Tom

cosinus · 28.06.2014, 19:47

Dann wären wir durch!

Falls du noch Lob oder Kritik loswerden möchtest => Lob, Kritik und Wünsche - Trojaner-Board

Die Programme, die hier zum Einsatz kamen, können alle deinstalliert werden. Es empfiehlt sich Malwarebytes Anti-Malware zu behalten und damit wöchentlich nach Malware zu scannen.

Helfen kann dir dabei delfix:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Bitte abschließend noch die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.

Microsoftupdate
Windows XP:Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.
Windows Vista/7: Start, Systemsteuerung, Windows-Update

PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks findest du hier => Browsers and Plugins - FilePony.de

Alle Plugins im Firefox-Browser kannst du auch ganz einfach hier auf Aktualität prüfen => https://www.mozilla.org/de/plugincheck

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.

Java-Update
Veraltete Java-Installationen sind ein großes Sicherheitsrisiko, daher solltest Du die alten Versionen deinstallieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software (bzw. Programme und Funktionen) und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

26.06.2014, 14:29	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Habe mir b eim Herunterladen von IrfanView von Netzwelt.de Malware (u.a. IMinent) eingefangen - Rechner langsam, ungewohnte Werbung im Brows Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. __________________ Logfiles bitte immer in CODE-Tags posten

Habe mir b eim Herunterladen von IrfanView von Netzwelt.de Malware (u.a. IMinent) eingefangen - Rechner langsam, ungewohnte Werbung im Brows

Log-Analyse und Auswertung: Habe mir b eim Herunterladen von IrfanView von Netzwelt.de Malware (u.a. IMinent) eingefangen - Rechner langsam, ungewohnte Werbung im Brows