Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML

Antwort
Alt 12.08.2014, 12:29   #1
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Hallo,
ich habe eine Fake Mail von eBay bekommen. Den ZIP Anhang runtergeladen aber dann nicht mehr geöffnet. Dann Avira durchlaufen lassen, da ich erste zweifel an der Richtigkeit der Mail hatte. Avira zeigte 5 Viren an.
Hier nun meine Berichte:

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:10 on 12/08/2014 (Alina)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-08-2014 01
Ran by Alina at 2014-08-12 12:18:17
Running from C:\Users\Alina\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.1.85.3 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Advanced System Protector (HKLM-x32\...\00212D92-C5D8-4ff4-AE50-B20F0F85C40A_Systweak_Ad~B9F029BF_is1) (Version: 2.1.1000.10443 - Systweak Software) <==== ATTENTION
AMD APP SDK Runtime (Version: 2.5.775.2 - Advanced Micro Devices Inc.) Hidden
AMD AVIVO64 Codecs (Version: 11.7.0.10927 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{92015CBE-D397-C3EA-99FC-B03051DE69A4}) (Version: 3.0.847.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar (HKLM-x32\...\{86D4B82A-ABED-442A-BE86-96357B70F4FE}) (Version: 1.15.31.0 - Ask.com) <==== ATTENTION
Ask Toolbar Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.4.4.57710 - Ask.com) <==== ATTENTION
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.12.9.0 - Asmedia Technology)
ASUS AI Recovery (HKLM-x32\...\{D39F0676-163E-4595-A917-E28F99BBD4D2}) (Version: 1.0.16 - ASUS)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.27 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.0.7 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{33B98264-A889-4913-A0CA-C364A75032B3}) (Version: 1.1.45 - ASUS)
ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0011 - ASUS)
ASUS Sonic Focus (HKLM-x32\...\{B0002707-4F7E-4745-88A7-852DA8A88635}) (Version: 1.0.0.5 - Synopsys )
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.0.4 - ASUS)
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.23 - asus)
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 3.0.108.222 - eCareme Technologies, Inc.)
AsusScr_K3 Series_ENG (HKLM-x32\...\AsusScr_K3 Series_ENG) (Version: 1.0.0001 - ASUS)
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.7.142 - ASUSTEK)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0014 - ASUS)
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) Hidden
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2926 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2926 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 7.0.0.1126 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 7.0.0.1126 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deadtime Stories (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118716773}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
Dream Vacation Solitaire (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111249233}) (Version:  - Oberon Media)
Farm Frenzy 3 - Madagascar (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-119205603}) (Version:  - Oberon Media)
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.10 - ASUS)
Free YouTube to MP3 Converter version 3.12.39.604 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.39.604 - DVDVideoSoft Ltd.)
Galapago (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}) (Version:  - Oberon Media)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Game Park Console (HKLM-x32\...\Game Park Console) (Version: 1.2.4.431 - Oberon Media Inc.)
Go Go Gourmet Chef of the Year (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115290153}) (Version:  - Oberon Media)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
InstantOn for NB (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 2.1.5 - ASUS)
Intel PROSet Wireless (Version:  - ) Hidden
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3074 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{25FBDA9A-E868-4B3B-B9FF-D923818511A1}) (Version: 14.2.0000 - Intel Corporation)
Internet Updater (HKLM-x32\...\InternetUpdater) (Version: 2.6.57 - Parallel Lines Development, LLC) <==== ATTENTION
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
MAGIX Foto Designer 7 (HKLM-x32\...\MAGIX_{2DCD52EE-1AE1-4128-9819-A79F7D09B6B3}) (Version: 7.0.1.1 - MAGIX AG)
MAGIX Foto Designer 7 (Version: 7.0.1.1 - MAGIX AG) Hidden
Mahjong Memoirs (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117948443}) (Version:  - Oberon Media)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Mobogenie (HKLM-x32\...\Mobogenie) (Version:  - Mobogenie.com) <==== ATTENTION
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nuance PDF Reader (HKLM-x32\...\{B480904D-F73F-4673-B034-8A5F492C9184}) (Version: 6.00.0041 - Nuance Communications, Inc.)
Plants vs Zombies (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117080787}) (Version:  - Oberon Media)
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QQS version 2.9 (HKLM-x32\...\{C1BC705B-A7E6-48DE-8E41-66FB67A3FDCB}_is1) (Version: 2.9 - Alliance Win Online Network Technology Co., LTD)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6473 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10010 - Realtek Semiconductor Corp.)
SaveSense (HKCU\...\SaveSense) (Version:  - ) <==== ATTENTION
SaveSense (remove only) (HKLM-x32\...\SaveSense) (Version: 5.3.0.6 - SaveSense) <==== ATTENTION
simplitec simplicheck (HKLM-x32\...\{DF103EDA-7937-4966-8EFB-5EF5C38301F2}) (Version: 1.3.9.0 - simplitec GmbH)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.17.0 - Synaptics Incorporated)
Turbo Fiesta (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115320460}) (Version:  - Oberon Media)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883030) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{F5DCAB53-C2FD-4E5A-8C83-0F37485E5E89}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Updater (HKLM-x32\...\{D54E3D9F-FEB8-4D2D-A138-B69A5C80080B}) (Version: 2.6.48 - Creative Island Media, LLC) <==== ATTENTION
Websteroids (HKLM-x32\...\Websteroids) (Version: 2.6.48 - Creative Island Media, LLC) <==== ATTENTION
weDownload (HKLM-x32\...\weDownload) (Version: 1.31.153.0 - weDownload)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.32.0 - ASUS)
Wireless Console 3 (HKLM-x32\...\{C4BC5A5F-4A97-47CC-99C3-AB8E10572AFE}) (Version: 3.0.24 - ASUS)
World of Goo (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116672750}) (Version:  - Oberon Media)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (HKLM-x32\...\{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}) (Version: 15.4.5722.2 - Microsoft Corporation)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (HKLM-x32\...\{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}) (Version: 15.4.5722.2 - Microsoft Corporation)
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة (HKLM-x32\...\{E18B30AA-6E2D-480C-B918-AF61009F4010}) (Version: 15.4.5722.2 - Microsoft Corporation)
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

07-07-2014 12:26:21 Windows Update
10-07-2014 12:28:25 Windows Update
15-07-2014 12:27:36 Windows Update
21-07-2014 10:58:51 Windows Update
24-07-2014 08:48:51 Windows Update
29-07-2014 10:19:20 Windows Update
01-08-2014 10:54:35 Windows Update
01-08-2014 11:02:04 Windows Update
05-08-2014 09:44:35 Windows Update
10-08-2014 12:51:17 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {2251BD99-FCFA-4BCB-98DC-96C987DC9737} - System32\Tasks\SaveSenseLiveUpdateTaskMachineUA => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2013-12-30] (SaveSense) <==== ATTENTION
Task: {270A9D56-2000-4395-ADFF-A1910D95310E} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2011-06-01] (ASUS)
Task: {2BD819A3-2A33-4386-A7B9-4A1A89B483A7} - System32\Tasks\Advanced System Protector => C:\Program Files (x86)\RegClean Pro\SystweakASP.exe <==== ATTENTION
Task: {39BB8806-4CFA-40D6-906F-EDA2F0AEF959} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
Task: {3DE3B729-0145-455A-8C7C-57F6132BD06E} - System32\Tasks\SaveSenseLiveUpdateTaskMachineCore => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [2013-12-30] (SaveSense) <==== ATTENTION
Task: {42565EA5-C880-4ED6-995D-F5DAEC2367E4} - System32\Tasks\USBChargerPlus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2011-09-20] (ASUSTek Computer Inc.)
Task: {6432813C-FA38-4B5A-8E41-678954541FF9} - System32\Tasks\weDownload-updater => C:\Program Files (x86)\weDownload\weDownload-updater.exe <==== ATTENTION
Task: {7353B56C-521F-4C43-B3AF-8CF5A7309231} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {87F9E635-9EFD-427B-8318-02036C4C7F07} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2010-11-15] (ASUS)
Task: {91BE2071-0CFC-4FE2-81C0-D908D822303E} - System32\Tasks\SaveSense => C:\Users\Alina\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {97FB1A7D-CC63-4C47-9B60-FAF01FF39B8C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-25] (Google Inc.)
Task: {B0B1ED6F-B28E-4F7D-87E2-27F9F5200F9F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-25] (Google Inc.)
Task: {BD4818B2-B76A-482B-83EC-E46000BA6FD4} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-07-22] (ASUS)
Task: {E5CD7632-0371-4ABD-A3FE-E402A638A8BB} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2014-01-31] () <==== ATTENTION
Task: {EA5F4C4D-C218-40C6-8FE7-79B41EE725F7} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2011-09-30] (ASUSTeK Computer Inc.)
Task: {F04456C9-2348-467E-9426-E8A5942FBFB6} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2013-11-20] (Apple Inc.)
Task: {F37DC888-2F74-4684-A7D7-0C1EAA5D1067} - System32\Tasks\Advanced System Protector_startup => C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe [2012-12-18] (Systweak) <==== ATTENTION
Task: {FFB54949-2CFC-4621-BFBC-87ED15E70FB3} - System32\Tasks\weDownload-chromeinstaller => C:\Program Files (x86)\weDownload\weDownload-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\SaveSense.job => C:\Users\Alina\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job => C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe <==== ATTENTION
Task: C:\Windows\Tasks\weDownload-chromeinstaller.job => C:\Program Files (x86)\weDownload\weDownload-chromeinstaller.exe <==== ATTENTION
Task: C:\Windows\Tasks\weDownload-updater.job => C:\Program Files (x86)\weDownload\weDownload-updater.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2011-07-28 06:07 - 2011-07-28 06:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2008-08-25 06:02 - 2008-08-25 06:02 - 00027648 _____ () C:\Windows\System32\DELG1L6.DLL
2014-03-05 13:29 - 2014-01-26 20:32 - 00712280 _____ () C:\Program Files (x86)\QQS\serverqqs.exe
2010-07-15 02:11 - 2010-07-15 02:11 - 00031360 _____ () C:\Program Files\P4G\DevMng.dll
2011-12-27 02:03 - 2011-08-09 01:44 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-10-13 08:19 - 2011-07-21 12:59 - 00057640 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2011-07-28 06:07 - 2011-07-28 06:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2013-11-18 15:09 - 2013-10-30 09:02 - 00746176 _____ () C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
2013-04-12 16:10 - 2013-04-12 16:10 - 00195072 _____ () C:\Users\Alina\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2013-01-02 18:52 - 2012-07-25 13:03 - 00886272 _____ () C:\Program Files (x86)\Advanced System Protector\System.Data.SQLite.dll
2013-01-02 18:52 - 2012-12-18 18:23 - 01731080 _____ () C:\Program Files (x86)\Advanced System Protector\aspsys.dll
2011-09-30 03:06 - 2011-09-30 03:06 - 00208384 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\alvupdt.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2011-09-13 23:33 - 2011-09-13 23:33 - 01163264 _____ () C:\Program Files (x86)\ASUS\Wireless Console 3\acAuth.dll
2014-08-05 13:09 - 2014-07-24 11:50 - 00049744 _____ () C:\Users\Alina\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2010-08-20 19:57 - 2010-08-20 19:57 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-08-20 19:57 - 2010-08-20 19:57 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-04-29 19:19 - 2014-04-24 02:33 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\chrome_elf.dll
2014-04-29 19:19 - 2014-04-24 02:33 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libglesv2.dll
2014-04-29 19:19 - 2014-04-24 02:33 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\libegl.dll
2014-04-29 19:19 - 2014-04-24 02:33 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\pdf.dll
2014-04-29 19:19 - 2014-04-24 02:33 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll
2014-04-29 19:19 - 2014-04-24 02:33 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.131\ffmpegsumo.dll
2013-07-10 18:07 - 2013-07-10 18:07 - 00756888 _____ () C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\MSPTLS.DLL

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:51E9F892
AlternateDataStreams: C:\ProgramData\Temp:676C1C69

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

==================== Faulty Device Manager Devices =============

Name: Lexmark X422
Description: Lexmark X422
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Lexmark
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Lexmark X422
Description: Lexmark X422
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Lexmark
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/10/2014 03:58:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 5710

Error: (08/10/2014 03:58:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 5710

Error: (08/10/2014 03:58:02 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/10/2014 03:58:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 4602

Error: (08/10/2014 03:58:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 4602

Error: (08/10/2014 03:58:01 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/10/2014 03:58:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 3385

Error: (08/10/2014 03:58:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 3385

Error: (08/10/2014 03:58:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/10/2014 03:57:59 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2293


System errors:
=============
Error: (08/10/2014 02:45:25 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst wlidsvc erreicht.

Error: (08/08/2014 09:24:31 AM) (Source: Service Control Manager) (EventID: 7031) (User: )
Description: Der Dienst "Avira Browser-Schutz" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 0 Millisekunden durchgeführt: Neustart des Diensts.

Error: (08/07/2014 10:34:23 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "serverqqs" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/05/2014 02:06:54 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "serverqqs" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (07/31/2014 09:49:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (07/31/2014 09:49:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (07/24/2014 10:49:18 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (07/24/2014 10:49:12 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {FE9617F6-E606-42AA-BECC-0E9CDA246D63}

Error: (07/11/2014 04:24:18 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {16D99191-6280-4B33-A2F5-04805A0FC582}

Error: (07/10/2014 02:33:59 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (06/10/2014 07:46:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 105 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2012-08-20 13:00:13.652
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 13:00:13.356
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 13:00:13.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 13:00:12.778
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:03.147
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:02.835
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:02.429
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:02.008
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:55:16.440
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\fveapibase.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:55:16.035
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\fveapibase.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 8096.05 MB
Available physical RAM: 5125.45 MB
Total Pagefile: 16190.29 MB
Available Pagefile: 12785.82 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:186.3 GB) (Free:96.46 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:254.46 GB) (Free:235.79 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E3102A4B)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=186 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=254 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-08-2014 01
Ran by Alina (administrator) on ALINA-PC on 12-08-2014 12:11:50
Running from C:\Users\Alina\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUS) C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\QQS\serverqqs.exe
(ASUS) C:\Program Files (x86)\Common Files\InstantOn\InsOnWMI.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Systweak) C:\Program Files (x86)\Advanced System Protector\AdvancedSystemProtector.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Updater) C:\ProgramData\Updater\updater.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
() C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(WatchDog) C:\ProgramData\RHelpers\ChromeHelper\ChromeHelper.exe
(WatchDog) C:\ProgramData\RHelpers\FirefoxHelper\FirefoxHelper.exe
(WatchDog) C:\ProgramData\RHelpers\IeHelper\IeHelper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Farbar) C:\Users\Alina\Downloads\FRST64 (1).exe
() C:\Users\Alina\AppData\Roaming\SaveSense\UpdateProc\UpdateTask.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2278504 2011-09-19] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2816808 2011-07-21] (Synaptics Incorporated)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-28] (Intel(R) Corporation)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [98088 2011-07-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2011-10-19] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-22] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-08] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [ApnUpdater] => C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648056 2014-01-31] (Ask)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Updater] => C:\ProgramData\Updater\Updater.exe [313208 2013-10-22] (Updater)
HKLM-x32\...\Run: [mobilegeni daemon] => C:\Program Files (x86)\Mobogenie\DaemonProcess.exe [746176 2013-10-30] ()
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [QqsnTerminal] => C:\Program Files (x86)\QQS\qvodterminal.exe [1027672 2013-04-15] (Shenzhen QVOD Technology Co.,Ltd)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [190032 2014-07-24] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [com.apple.dav.bookmarks.daemon] => C:\Program Files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [Updater] => C:\ProgramData\Updater\updater.exe [313208 2013-10-22] (Updater)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe (ASUSTeK Computer Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\simplicheck.lnk
ShortcutTarget: simplicheck.lnk -> C:\Program Files (x86)\simplitec\simplicheck\simplicheck.exe (simplitec)
ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://aartemis.com/?type=hp&ts=1388428453&from=s32&uid=WDCXWD5000BPVT-80HXZT3_WD-WXF1A81P4366P4366
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://aartemis.com/?type=hp&ts=1388428453&from=s32&uid=WDCXWD5000BPVT-80HXZT3_WD-WXF1A81P4366P4366
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
URLSearchHook: HKCU - UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKLM - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKLM-x32 - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1388428453&from=s32&uid=WDCXWD5000BPVT-80HXZT3_WD-WXF1A81P4366P4366&q={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://www.aartemis.com/web/?type=ds&ts=1388428453&from=s32&uid=WDCXWD5000BPVT-80HXZT3_WD-WXF1A81P4366P4366&q={searchTerms}
SearchScopes: HKCU - {8FD5747A-3AB3-44DB-9625-AF77E3633166} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=e8755884-b9f1-4447-9efb-65fbed0bfb47&apn_sauid=5295E3B0-7467-4281-B9D8-25A597117AF0
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll (DVDVideoSoft Ltd.)
BHO-x32: Websteroids -> {44ed99e2-16a6-4b89-80d6-5b21cf42e78b} -> C:\ProgramData\Websteroids\IE\common.dll (Creative Island Media, LLC)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Ask Toolbar -> {D4027C7F-154A-4066-A1AD-4243D8127440} -> C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: DVDVideoSoft IE Extension -> {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} -> C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @qqsn.com/QqsnInsert -> C:\Program Files (x86)\QQS\NpqqsnInsert.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @qqsp.com/QvodInsert -> C:\Program Files (x86)\QQS\npqqsp.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @qvod.com/QvodInsert -> C:\Program Files (x86)\QQS\npqplus.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=3 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF Plugin-x32: @tools.updaterss.com/SaveSenseLive Update;version=9 -> C:\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll (SaveSense)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-11]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Extension: (Google Docs) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-02]
CHR Extension: (Google Drive) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-02]
CHR Extension: (YouTube) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-25]
CHR Extension: (Google-Suche) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-25]
CHR Extension: (Websteroids) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\igjjkeeamkpihpncmmbgdkhdnjpcfmfb [2014-08-04]
CHR Extension: (Google Wallet) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Citavi Picker) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-05-25]
CHR Extension: (Google Mail) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-25]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx [2014-06-11]
CHR HKLM-x32\...\Chrome\Extension: [igjjkeeamkpihpncmmbgdkhdnjpcfmfb] - C:\ProgramData\\Chrome\common.crx [2014-06-11]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - D:\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [141392 2014-07-24] (Avira Operations GmbH & Co. KG)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-28] ()
S2 savesenselive; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2013-12-30] (SaveSense)
S3 savesenselivem; C:\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe [146920 2013-12-30] (SaveSense)
R2 serverqqs; C:\Program Files (x86)\QQS\serverqqs.exe [712280 2014-01-26] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiCharger; C:\Windows\SysWOW64\DRIVERS\AiCharger.sys [16768 2011-09-20] (ASUSTek Computer Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-12 11:40 - 2014-08-12 12:11 - 00043712 _____ () C:\Users\Alina\Downloads\Addition.txt
2014-08-12 11:32 - 2014-08-12 12:18 - 00020893 _____ () C:\Users\Alina\Downloads\FRST.txt
2014-08-12 11:32 - 2014-08-12 12:11 - 00000000 ____D () C:\FRST
2014-08-12 11:28 - 2014-08-12 11:28 - 02099712 _____ (Farbar) C:\Users\Alina\Downloads\FRST64 (1).exe
2014-08-12 11:13 - 2014-08-12 11:13 - 02099712 _____ (Farbar) C:\Users\Alina\Downloads\FRST64.exe
2014-08-12 11:01 - 2014-08-12 11:10 - 00000472 _____ () C:\Users\Alina\Downloads\defogger_disable.log
2014-08-12 11:01 - 2014-08-12 11:01 - 00000000 _____ () C:\Users\Alina\defogger_reenable
2014-08-12 10:54 - 2014-08-12 10:55 - 00050477 _____ () C:\Users\Alina\Downloads\Defogger.exe
2014-08-12 10:32 - 2014-08-12 10:32 - 00005128 _____ () C:\Users\Alina\Downloads\Logs.zip
2014-08-05 13:09 - 2014-08-06 10:47 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-05 13:09 - 2014-08-06 10:47 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-01 12:56 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 12:56 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 12:56 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 12:56 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 12:55 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 12:55 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 12:55 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 12:55 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 12:55 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 12:55 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-07-21 13:02 - 2014-07-21 13:02 - 00021593 _____ () C:\Users\Alina\Downloads\2014 06 06_50_FP Veranstaltungen Jugendpflege.xlsx

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-12 12:18 - 2014-08-12 11:32 - 00020893 _____ () C:\Users\Alina\Downloads\FRST.txt
2014-08-12 12:11 - 2014-08-12 11:40 - 00043712 _____ () C:\Users\Alina\Downloads\Addition.txt
2014-08-12 12:11 - 2014-08-12 11:32 - 00000000 ____D () C:\FRST
2014-08-12 12:04 - 2011-12-27 02:01 - 01529444 _____ () C:\Windows\WindowsUpdate.log
2014-08-12 11:39 - 2013-12-30 20:34 - 00000930 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineUA.job
2014-08-12 11:34 - 2013-12-30 21:34 - 00000182 _____ () C:\Users\Alina\AppData\Roaming\WB.CFG
2014-08-12 11:34 - 2013-12-30 20:34 - 00000292 _____ () C:\Windows\Tasks\SaveSense.job
2014-08-12 11:28 - 2014-08-12 11:28 - 02099712 _____ (Farbar) C:\Users\Alina\Downloads\FRST64 (1).exe
2014-08-12 11:28 - 2014-03-05 13:40 - 00000172 _____ () C:\Windows\qqsserver.ini
2014-08-12 11:26 - 2012-10-25 14:41 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-12 11:26 - 2012-10-25 14:41 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-12 11:26 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-12 11:26 - 2009-07-14 06:45 - 00009696 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-12 11:21 - 2013-01-02 18:52 - 00003118 _____ () C:\Windows\System32\Tasks\Advanced System Protector_startup
2014-08-12 11:18 - 2013-12-30 20:35 - 00001324 _____ () C:\Windows\Tasks\weDownload-updater.job
2014-08-12 11:18 - 2013-12-30 20:34 - 00000926 _____ () C:\Windows\Tasks\SaveSenseLiveUpdateTaskMachineCore.job
2014-08-12 11:18 - 2011-12-27 02:13 - 00000000 ____D () C:\ProgramData\Temp
2014-08-12 11:17 - 2013-12-30 20:35 - 00001932 _____ () C:\Windows\Tasks\weDownload-chromeinstaller.job
2014-08-12 11:17 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-12 11:17 - 2009-07-14 06:51 - 00106214 _____ () C:\Windows\setupact.log
2014-08-12 11:16 - 2013-11-18 15:10 - 00033827 _____ () C:\Users\Alina\daemonprocess.txt
2014-08-12 11:13 - 2014-08-12 11:13 - 02099712 _____ (Farbar) C:\Users\Alina\Downloads\FRST64.exe
2014-08-12 11:10 - 2014-08-12 11:01 - 00000472 _____ () C:\Users\Alina\Downloads\defogger_disable.log
2014-08-12 11:01 - 2014-08-12 11:01 - 00000000 _____ () C:\Users\Alina\defogger_reenable
2014-08-12 11:01 - 2012-08-20 12:43 - 00000000 ____D () C:\Users\Alina
2014-08-12 10:55 - 2014-08-12 10:54 - 00050477 _____ () C:\Users\Alina\Downloads\Defogger.exe
2014-08-12 10:32 - 2014-08-12 10:32 - 00005128 _____ () C:\Users\Alina\Downloads\Logs.zip
2014-08-08 09:24 - 2013-11-18 15:09 - 00000000 ____D () C:\ProgramData\Updater
2014-08-07 22:48 - 2013-11-18 15:10 - 00000000 ____D () C:\Users\Alina\AppData\Local\Mobogenie
2014-08-06 15:27 - 2011-02-19 06:24 - 00711078 _____ () C:\Windows\system32\perfh007.dat
2014-08-06 15:27 - 2011-02-19 06:24 - 00153526 _____ () C:\Windows\system32\perfc007.dat
2014-08-06 15:27 - 2009-07-14 07:13 - 01651372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-06 10:47 - 2014-08-05 13:09 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-06 10:47 - 2014-08-05 13:09 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-06 10:47 - 2013-08-09 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-06 10:47 - 2013-08-09 13:24 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-06 10:42 - 2011-12-27 02:10 - 00002248 _____ () C:\Windows\system32\AutoRunFilter.ini
2014-08-06 10:42 - 2011-12-27 02:10 - 00001447 _____ () C:\Windows\system32\ServiceFilter.ini
2014-08-05 13:09 - 2013-08-09 13:24 - 00000000 ____D () C:\ProgramData\Avira
2014-08-04 13:45 - 2014-05-25 13:23 - 00000000 ____D () C:\Users\Alina\Documents\Citavi 4
2014-08-04 13:00 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-24 17:46 - 2013-03-16 14:25 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 17:46 - 2013-03-16 14:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 10:50 - 2013-03-16 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2014-07-22 10:33 - 2013-01-27 19:22 - 00000000 ____D () C:\Users\Alina\Documents\Studium
2014-07-21 13:35 - 2013-12-30 20:35 - 00000000 ____D () C:\Program Files (x86)\weDownload
2014-07-21 13:02 - 2014-07-21 13:02 - 00021593 _____ () C:\Users\Alina\Downloads\2014 06 06_50_FP Veranstaltungen Jugendpflege.xlsx

Some content of TEMP:
====================
C:\Users\Alina\AppData\Local\Temp\1385723378_wedownload.exe
C:\Users\Alina\AppData\Local\Temp\AskSLib.dll
C:\Users\Alina\AppData\Local\Temp\avgnt.exe
C:\Users\Alina\AppData\Local\Temp\ose00000.exe
C:\Users\Alina\AppData\Local\Temp\sas.exe
C:\Users\Alina\AppData\Local\Temp\setup.exe
C:\Users\Alina\AppData\Local\Temp\setup{91CED0C9-647E-471D-8B32-F699FFA4E5A4}.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-01 13:21

==================== End Of Log ============================
         
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-12 12:51:15
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: Gmer-19357.exe; Driver: C:\Users\Alina\AppData\Local\Temp\uglorpog.sys


---- User code sections - GMER 2.1 ----

.text    C:\Program Files (x86)\QQS\serverqqs.exe[2108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                          0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\QQS\serverqqs.exe[2108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                         00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                    0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe[2340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                   00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                 0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe[1284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\ProgramData\Updater\updater.exe[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                0000000075991465 2 bytes [99, 75]
.text    C:\ProgramData\Updater\updater.exe[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                               00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                               00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Mobogenie\DaemonProcess.exe[3812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Mobogenie\DaemonProcess.exe[3812] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                               00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4128] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                        0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[4128] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                       00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Windows\AsScrPro.exe[4340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                           0000000075991465 2 bytes [99, 75]
.text    C:\Windows\AsScrPro.exe[4340] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                                          00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                         0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe[4980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                        00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe[6580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000075991465 2 bytes [99, 75]
.text    C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe[6580] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000759914bb 2 bytes [99, 75]
.text    ...                                                                                                                                                                             * 2
---- Processes - GMER 2.1 ----

Process  C:\Users\Alina\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE (*** suspicious ***) @ C:\Users\Alina\AppData\Roaming\SAVESE~1\UPDATE~1\UPDATE~1.EXE [3392](2013-04-12 14:10:43)  0000000000400000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e                                                                                                     
Reg      HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet)                                                                                 

---- EOF - GMER 2.1 ----
         
Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 7. August 2014  17:41


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira Antivirus Free
Seriennummer   : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Home Premium
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus     : Normal gebootet
Benutzername   : SYSTEM
Computername   : ALINA-PC

Versionsinformationen:
BUILD.DAT      : 14.0.6.552     92022 Bytes  23.07.2014 13:29:00
AVSCAN.EXE     : 14.0.6.548   1046608 Bytes  05.08.2014 09:44:37
AVSCANRC.DLL   : 14.0.6.522     62544 Bytes  05.08.2014 09:44:37
LUKE.DLL       : 14.0.6.522     57936 Bytes  05.08.2014 09:45:13
AVSCPLR.DLL    : 14.0.6.548     92752 Bytes  05.08.2014 09:44:37
AVREG.DLL      : 14.0.6.522    262224 Bytes  05.08.2014 09:44:33
avlode.dll     : 14.0.6.526    603728 Bytes  05.08.2014 09:44:32
avlode.rdf     : 14.0.4.42      65114 Bytes  21.07.2014 10:57:13
XBV00009.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00010.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00011.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00012.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00013.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00014.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00015.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00016.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00017.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00018.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00019.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00020.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:46
XBV00021.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00022.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00023.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00024.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00025.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00026.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00027.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00028.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00029.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00030.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00031.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00032.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00033.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00034.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00035.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00036.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00037.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00038.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:47
XBV00039.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:48
XBV00040.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:48
XBV00041.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 15:11:48
XBV00043.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:48
XBV00044.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:48
XBV00045.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:48
XBV00046.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:48
XBV00047.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00048.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00049.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00050.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00051.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00052.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00053.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00054.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00055.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00056.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00057.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00058.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00059.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:49
XBV00060.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00061.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00062.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00063.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00064.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00065.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00066.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00067.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00068.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00069.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:50
XBV00070.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00071.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00072.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00073.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00074.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00075.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00076.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00077.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00078.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00079.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00080.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00081.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00082.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00083.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00084.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00085.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00086.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00087.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00088.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00089.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:51
XBV00090.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00091.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00092.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00093.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00094.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00095.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00096.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00097.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00098.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00099.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00100.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00101.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00102.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00103.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00104.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:52
XBV00105.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00106.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00107.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00108.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00109.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00110.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00111.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00112.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00113.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00114.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00115.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00116.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00117.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00118.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00119.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00120.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00121.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00122.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00123.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00124.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00125.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00126.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:53
XBV00127.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00128.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00129.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00130.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00131.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00132.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00133.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00134.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00135.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00136.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00137.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00138.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00139.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00140.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00141.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00142.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00143.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00144.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00145.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:54
XBV00146.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00147.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00148.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00149.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00150.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00151.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00152.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00153.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00154.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00155.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00156.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00157.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00158.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:55
XBV00159.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00160.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00161.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00162.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00163.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00164.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00165.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00166.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00167.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00168.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00169.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00170.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00171.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00172.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00173.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00174.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00175.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00176.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00177.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00178.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00179.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00180.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00181.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00182.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:56
XBV00183.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00184.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00185.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00186.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00187.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00188.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00189.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00190.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00191.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00192.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00193.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00194.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00195.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00196.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00197.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00198.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00199.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00200.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00201.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00202.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00203.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00204.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00205.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00206.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00207.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00208.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:57
XBV00209.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00210.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00211.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00212.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00213.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00214.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00215.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00216.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00217.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00218.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00219.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00220.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00221.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00222.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00223.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00224.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00225.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00226.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00227.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00228.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00229.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00230.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00231.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00232.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00233.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:58
XBV00234.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00235.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00236.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00237.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00238.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00239.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00240.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00241.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00242.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00243.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00244.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00245.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00246.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00247.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00248.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00249.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00250.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00251.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00252.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:11:59
XBV00253.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:12:00
XBV00254.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:12:00
XBV00255.VDF   : 8.11.165.192     2048 Bytes  07.08.2014 15:12:00
XBV00000.VDF   : 7.11.70.0   66736640 Bytes  04.04.2013 11:28:33
XBV00001.VDF   : 7.11.74.226  2201600 Bytes  30.04.2013 12:08:12
XBV00002.VDF   : 7.11.80.60   2751488 Bytes  28.05.2013 12:57:33
XBV00003.VDF   : 7.11.85.214  2162688 Bytes  21.06.2013 21:39:38
XBV00004.VDF   : 7.11.91.176  3903488 Bytes  23.07.2013 11:24:58
XBV00005.VDF   : 7.11.98.186  6822912 Bytes  29.08.2013 17:46:20
XBV00006.VDF   : 7.11.139.38 15708672 Bytes  27.03.2014 16:12:44
XBV00007.VDF   : 7.11.152.100  4193792 Bytes  02.06.2014 14:50:11
XBV00008.VDF   : 8.11.165.192  4251136 Bytes  07.08.2014 15:11:45
XBV00042.VDF   : 8.11.165.218   217600 Bytes  07.08.2014 15:11:48
LOCAL000.VDF   : 8.11.165.218 108005888 Bytes  07.08.2014 15:13:24
Engineversion  : 8.3.24.6  
AEVDF.DLL      : 8.3.1.2       133024 Bytes  07.08.2014 15:11:38
AESCRIPT.DLL   : 8.2.0.14      428032 Bytes  01.08.2014 10:56:12
AESCN.DLL      : 8.3.2.2       139456 Bytes  21.07.2014 10:57:12
AESBX.DLL      : 8.2.20.24    1409224 Bytes  09.05.2014 10:21:03
AERDL.DLL      : 8.2.0.138     704888 Bytes  04.12.2013 10:15:48
AEPACK.DLL     : 8.4.0.50      792488 Bytes  07.08.2014 15:11:38
AEOFFICE.DLL   : 8.3.0.16      213192 Bytes  29.07.2014 10:18:00
AEHEUR.DLL     : 8.1.4.1210   7380008 Bytes  07.08.2014 15:11:37
AEHELP.DLL     : 8.3.1.0       278728 Bytes  28.05.2014 15:06:28
AEGEN.DLL      : 8.1.7.28      450752 Bytes  06.06.2014 11:04:30
AEEXP.DLL      : 8.4.2.22      244584 Bytes  01.08.2014 10:56:13
AEEMU.DLL      : 8.1.3.4       399264 Bytes  07.08.2014 15:11:32
AEDROID.DLL    : 8.4.2.24      442568 Bytes  05.06.2014 09:47:24
AECORE.DLL     : 8.3.2.6       243712 Bytes  07.08.2014 15:11:32
AEBB.DLL       : 8.1.2.0        60448 Bytes  07.08.2014 15:11:31
AVWINLL.DLL    : 14.0.6.522     24144 Bytes  05.08.2014 09:44:27
AVPREF.DLL     : 14.0.6.522     50256 Bytes  05.08.2014 09:44:33
AVREP.DLL      : 14.0.6.522    219216 Bytes  05.08.2014 09:44:34
AVARKT.DLL     : 14.0.5.368    226384 Bytes  07.07.2014 12:04:09
AVEVTLOG.DLL   : 14.0.6.522    182352 Bytes  05.08.2014 09:44:30
SQLITE3.DLL    : 14.0.6.522    452176 Bytes  05.08.2014 09:45:21
AVSMTP.DLL     : 14.0.6.522     76368 Bytes  05.08.2014 09:44:37
NETNT.DLL      : 14.0.6.522     13392 Bytes  05.08.2014 09:45:14
RCIMAGE.DLL    : 14.0.6.544   4863568 Bytes  05.08.2014 09:44:27
RCTEXT.DLL     : 14.0.6.536     74320 Bytes  05.08.2014 09:44:27

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Vollständige Systemprüfung
Konfigurationsdatei...................: C:\Program Files (x86)\Avira\AntiVir Desktop\sysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, D:, 
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: ein
Prüfe alle Dateien....................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert

Beginn des Suchlaufs: Donnerstag, 7. August 2014  17:41

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'HDD0(C:, D:)'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf nach versteckten Objekten wird begonnen.

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'atiesrxx.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '94' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '98' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '84' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '165' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'FBAgent.exe' - '41' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLANExt.exe' - '82' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'ASLDRSrv.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'GFNEXSrv.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'wprotectmanager.exe' - '60' Modul(e) wurden durchsucht
Durchsuche Prozess 'atieclxx.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTHSAmpPalService.exe' - '20' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '133' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleMobileDeviceService.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnSrv.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'mDNSResponder.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'BTHSSecurityMgr.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'EvtEng.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'RegSrvc.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'serverqqs.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSVC.EXE' - '77' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.ServiceHost.exe' - '132' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '48' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLIDSvcM.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'AVWEBGRD.EXE' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'LMS.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '62' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'UNS.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmiprvse.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'InsOnWMI.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'AdvancedSystemProtector.exe' - '171' Modul(e) wurden durchsucht
Durchsuche Prozess 'BatteryLife.exe' - '53' Modul(e) wurden durchsucht
Durchsuche Prozess 'USBChargerPlus.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'sensorsrv.exe' - '32' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '191' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD2.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'LiveUpdate.exe' - '124' Modul(e) wurden durchsucht
Durchsuche Prozess 'AsScrPro.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxtray.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'hkcmd.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'igfxpers.exe' - '49' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVBg64.exe' - '55' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPEnh.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'iFrmewrk.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'iCloudServices.exe' - '78' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApplePhotoStreams.exe' - '127' Modul(e) wurden durchsucht
Durchsuche Prozess 'AppleIEDAV.exe' - '65' Modul(e) wurden durchsucht
Durchsuche Prozess 'updater.exe' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'CLMLSvc.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControl.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'ATKOSD.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'KBFiltr.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'WDC.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'RAVCpl64.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'SynTPHelper.exe' - '17' Modul(e) wurden durchsucht
Durchsuche Prozess 'SonicFocusTray.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'DMedia.exe' - '30' Modul(e) wurden durchsucht
Durchsuche Prozess 'HControlUser.exe' - '22' Modul(e) wurden durchsucht
Durchsuche Prozess 'wcourier.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'Updater.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '101' Modul(e) wurden durchsucht
Durchsuche Prozess 'DaemonProcess.exe' - '80' Modul(e) wurden durchsucht
Durchsuche Prozess 'iTunesHelper.exe' - '79' Modul(e) wurden durchsucht
Durchsuche Prozess 'Avira.OE.Systray.exe' - '142' Modul(e) wurden durchsucht
Durchsuche Prozess 'APSDaemon.exe' - '96' Modul(e) wurden durchsucht
Durchsuche Prozess 'ChromeHelper.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'FireFoxHelper.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'unsecapp.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'IeHelper.exe' - '42' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '67' Modul(e) wurden durchsucht
Durchsuche Prozess 'iPodService.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'ApplePhotoStreamsDownloader.exe' - '115' Modul(e) wurden durchsucht
Durchsuche Prozess 'PresentationFontCache.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'UPDATE~1.EXE' - '81' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '129' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '119' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'mgusb.exe' - '8' Modul(e) wurden durchsucht
Durchsuche Prozess 'conhost.exe' - '14' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '36' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '32' Modul(e) wurden durchsucht

Untersuchung der Systemdateien wird begonnen:
Signiert -> 'C:\Windows\system32\svchost.exe'
Signiert -> 'C:\Windows\system32\winlogon.exe'
Signiert -> 'C:\Windows\explorer.exe'
Signiert -> 'C:\Windows\system32\smss.exe'
Signiert -> 'C:\Windows\system32\wininet.DLL'
Signiert -> 'C:\Windows\system32\wsock32.DLL'
Signiert -> 'C:\Windows\system32\ws2_32.DLL'
Signiert -> 'C:\Windows\system32\services.exe'
Signiert -> 'C:\Windows\system32\lsass.exe'
Signiert -> 'C:\Windows\system32\csrss.exe'
Signiert -> 'C:\Windows\system32\drivers\kbdclass.sys'
Signiert -> 'C:\Windows\system32\spoolsv.exe'
Signiert -> 'C:\Windows\system32\alg.exe'
Signiert -> 'C:\Windows\system32\wuauclt.exe'
Signiert -> 'C:\Windows\system32\advapi32.DLL'
Signiert -> 'C:\Windows\system32\user32.DLL'
Signiert -> 'C:\Windows\system32\gdi32.DLL'
Signiert -> 'C:\Windows\system32\kernel32.DLL'
Signiert -> 'C:\Windows\system32\ntdll.DLL'
Signiert -> 'C:\Windows\system32\ntoskrnl.exe'
Signiert -> 'C:\Windows\system32\drivers\beep.sys'
Signiert -> 'C:\Windows\system32\ctfmon.exe'
Signiert -> 'C:\Windows\system32\imm32.dll'
Signiert -> 'C:\Windows\system32\dsound.dll'
Signiert -> 'C:\Windows\system32\aclui.dll'
Signiert -> 'C:\Windows\system32\msvcrt.dll'
Signiert -> 'C:\Windows\system32\d3d9.dll'
Signiert -> 'C:\Windows\system32\dnsapi.dll'
Signiert -> 'C:\Windows\system32\mshtml.dll'
Signiert -> 'C:\Windows\system32\regsvr32.exe'
Signiert -> 'C:\Windows\system32\rundll32.exe'
Signiert -> 'C:\Windows\system32\userinit.exe'
Signiert -> 'C:\Windows\system32\reg.exe'
Signiert -> 'C:\Windows\regedit.exe'
Die Systemdateien wurden durchsucht ('34' Dateien)

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '1741' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\' <OS>
C:\ProgramData\Updater\Uninstall.exe
    [0] Archivtyp: NSIS
    --> ProgramFilesDir/Helper.dll
        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alina\AppData\Local\Temp\s4a8\Setup.exe
    [0] Archivtyp: NSIS
    --> ProgramFilesDir/Helper.dll
        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden
    --> ProgramFilesDir/InternetUpdaterService.exe
        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden
C:\Users\Alina\AppData\Local\Temp\s9m8\Setup.exe
    [0] Archivtyp: NSIS
    --> ProgramFilesDir/Helper.dll
        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden
    --> ProgramFilesDir/InternetUpdaterService.exe
        [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
        [WARNUNG]   Infizierte Dateien in Archiven können nicht repariert werden
Beginne mit der Suche in 'D:\' <DATA>

Beginne mit der Desinfektion:
C:\Users\Alina\AppData\Local\Temp\s9m8\Setup.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5121df26.qua' verschoben!
C:\Users\Alina\AppData\Local\Temp\s4a8\Setup.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '49b6f082.qua' verschoben!
C:\ProgramData\Updater\Uninstall.exe
  [FUND]      Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1bfcaa53.qua' verschoben!


Ende des Suchlaufs: Freitag, 8. August 2014  09:24
Benötigte Zeit:  5:18:45 Stunde(n)

Der Suchlauf wurde vollständig durchgeführt.

  35752 Verzeichnisse wurden überprüft
 408507 Dateien wurden geprüft
      5 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      3 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 408502 Dateien ohne Befall
   3706 Archive wurden durchsucht
      5 Warnungen
      3 Hinweise
 901323 Objekte wurden beim Rootkitscan durchsucht
      0 Versteckte Objekte wurden gefunden
         

Alt 12.08.2014, 12:38   #2
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



hi,

Adware & Co. deinstallieren
  • Lade Dir bitte von hier Revo Uninstaller herunter.
  • Installiere und starte das Programm.
  • Suche im Uninstallerfeld nach den Programmen, die unter:

    diesen Zusatz haben:
  • Wähle die Programme nacheinander aus und klicke jedesmal auf Uninstall.
  • Wähle anschließend den Modus "Moderat" aus.
  • Reste löschen:
    Klicke auf dann auf und dann auf .




Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

__________________

__________________

Alt 12.08.2014, 17:16   #3
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Danke für die Hilfe! In dem Uninstallerfeld finde ich aber keine Programme die so heißen oder den Zusatz haben. Wie muss ich dann weiter fortfahren?
__________________

Alt 12.08.2014, 18:47   #4
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Richtig lesen

Den Zusatz findest du in der Addition.txt von FRST
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 12.08.2014, 21:45   #5
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Ah! Gefunden

Code:
ATTFilter
ComboFix 14-08-12.01 - Alina 12.08.2014  22:21:56.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.8096.5148 [GMT 2:00]
ausgeführt von:: c:\users\Alina\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\SaveSense
c:\program files (x86)\SaveSense\icon.ico
c:\program files (x86)\SaveSense\SaveSense.crx
c:\program files (x86)\SaveSense\SaveSense.xpi
c:\program files (x86)\SaveSense\SaveSenseIE.dll
c:\program files (x86)\SaveSense\SaveSenseIE64.dll
c:\program files (x86)\SaveSense\SaveSenseUpdateVer.exe
c:\program files (x86)\SaveSense\uninst.exe
c:\program files (x86)\SaveSenseLive
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdate.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_am.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ar.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bg.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_bn.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ca.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_cs.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_da.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_de.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_el.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en-GB.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_en.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es-419.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_es.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_et.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fa.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fi.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fil.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_fr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_gu.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hi.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_hu.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_id.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_is.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_it.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_iw.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ja.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_kn.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ko.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lt.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_lv.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ml.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_mr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ms.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_nl.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_no.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pl.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-BR.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_pt-PT.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ro.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ru.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sk.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sl.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sv.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_sw.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ta.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_te.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_th.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_tr.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_uk.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_ur.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_vi.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-CN.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\goopdateres_zh-TW.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\psuser.dll
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHelper.msi
c:\program files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe
c:\program files (x86)\SaveSenseLive\Update\SaveSenseLive.exe
c:\programdata\Roaming
c:\programdata\SaveSenseLive
c:\programdata\SaveSenseLive\Update\Log\SaveSenseLive.log
c:\users\Alina\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\users\Alina\AppData\Roaming\SaveSense
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_savesenselive
-------\Service_savesenselivem
-------\Service_savesenselivem
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-07-12 bis 2014-08-12  ))))))))))))))))))))))))))))))
.
.
2014-08-12 09:32 . 2014-08-12 10:19	--------	d-----w-	C:\FRST
2014-08-12 08:16 . 2014-07-02 03:09	10924376	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{DB69D870-27CA-463D-8316-DB1B6FBD5A18}\mpengine.dll
2014-08-05 11:09 . 2014-08-06 08:47	--------	d-----w-	c:\programdata\Package Cache
2014-08-01 10:56 . 2014-05-14 16:23	44512	----a-w-	c:\windows\system32\wups2.dll
2014-08-01 10:56 . 2014-05-14 16:23	58336	----a-w-	c:\windows\system32\wuauclt.exe
2014-08-01 10:56 . 2014-05-14 16:23	2477536	----a-w-	c:\windows\system32\wuaueng.dll
2014-08-01 10:56 . 2014-05-14 16:21	2620928	----a-w-	c:\windows\system32\wucltux.dll
2014-08-01 10:55 . 2014-05-14 16:23	38880	----a-w-	c:\windows\system32\wups.dll
2014-08-01 10:55 . 2014-05-14 16:23	36320	----a-w-	c:\windows\SysWow64\wups.dll
2014-08-01 10:55 . 2014-05-14 16:23	700384	----a-w-	c:\windows\system32\wuapi.dll
2014-08-01 10:55 . 2014-05-14 16:23	581600	----a-w-	c:\windows\SysWow64\wuapi.dll
2014-08-01 10:55 . 2014-05-14 16:20	97792	----a-w-	c:\windows\system32\wudriver.dll
2014-08-01 10:55 . 2014-05-14 16:17	92672	----a-w-	c:\windows\SysWow64\wudriver.dll
2014-08-01 10:55 . 2014-05-14 07:23	198600	----a-w-	c:\windows\system32\wuwebv.dll
2014-08-01 10:55 . 2014-05-14 07:23	179656	----a-w-	c:\windows\SysWow64\wuwebv.dll
2014-08-01 10:55 . 2014-05-14 07:20	36864	----a-w-	c:\windows\system32\wuapp.exe
2014-08-01 10:55 . 2014-05-14 07:17	33792	----a-w-	c:\windows\SysWow64\wuapp.exe
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-07-10 12:30 . 2012-08-28 19:49	96441528	----a-w-	c:\windows\system32\MRT.exe
2014-07-10 10:07 . 2013-08-09 18:41	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-07-07 12:04 . 2013-08-09 11:24	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-06-30 02:09 . 2014-07-10 10:20	519168	----a-w-	c:\windows\system32\aepdu.dll
2014-06-30 02:04 . 2014-07-10 10:20	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-06-20 20:14 . 2014-07-10 10:20	266424	----a-w-	c:\windows\system32\iedkcs32.dll
2014-06-19 01:39 . 2014-07-10 10:20	23464448	----a-w-	c:\windows\system32\mshtml.dll
2014-06-19 01:06 . 2014-07-10 10:20	2724864	----a-w-	c:\windows\system32\mshtml.tlb
2014-06-19 01:06 . 2014-07-10 10:20	4096	----a-w-	c:\windows\system32\ieetwcollectorres.dll
2014-06-19 00:48 . 2014-07-10 10:20	2768384	----a-w-	c:\windows\system32\iertutil.dll
2014-06-19 00:42 . 2014-07-10 10:20	548352	----a-w-	c:\windows\system32\vbscript.dll
2014-06-19 00:42 . 2014-07-10 10:20	66048	----a-w-	c:\windows\system32\iesetup.dll
2014-06-19 00:41 . 2014-07-10 10:20	48640	----a-w-	c:\windows\system32\ieetwproxystub.dll
2014-06-19 00:41 . 2014-07-10 10:20	83968	----a-w-	c:\windows\system32\MshtmlDac.dll
2014-06-19 00:32 . 2014-07-10 10:20	51200	----a-w-	c:\windows\system32\jsproxy.dll
2014-06-19 00:31 . 2014-07-10 10:20	33792	----a-w-	c:\windows\system32\iernonce.dll
2014-06-19 00:26 . 2014-07-10 10:20	598016	----a-w-	c:\windows\system32\ieui.dll
2014-06-19 00:24 . 2014-07-10 10:20	139264	----a-w-	c:\windows\system32\ieUnatt.exe
2014-06-19 00:24 . 2014-07-10 10:20	111616	----a-w-	c:\windows\system32\ieetwcollector.exe
2014-06-19 00:23 . 2014-07-10 10:20	752640	----a-w-	c:\windows\system32\jscript9diag.dll
2014-06-19 00:14 . 2014-07-10 10:20	940032	----a-w-	c:\windows\system32\MsSpellCheckingFacility.exe
2014-06-19 00:09 . 2014-07-10 10:20	452608	----a-w-	c:\windows\system32\dxtmsft.dll
2014-06-18 23:59 . 2014-07-10 10:20	38400	----a-w-	c:\windows\system32\JavaScriptCollectionAgent.dll
2014-06-18 23:56 . 2014-07-10 10:20	2724864	----a-w-	c:\windows\SysWow64\mshtml.tlb
2014-06-18 23:53 . 2014-07-10 10:20	195584	----a-w-	c:\windows\system32\msrating.dll
2014-06-18 23:51 . 2014-07-10 10:20	5721088	----a-w-	c:\windows\system32\jscript9.dll
2014-06-18 23:50 . 2014-07-10 10:20	85504	----a-w-	c:\windows\system32\mshtmled.dll
2014-06-18 23:48 . 2014-07-10 10:20	292864	----a-w-	c:\windows\system32\dxtrans.dll
2014-06-18 23:39 . 2014-07-10 10:20	608768	----a-w-	c:\windows\system32\ie4uinit.exe
2014-06-18 23:38 . 2014-07-10 10:20	455168	----a-w-	c:\windows\SysWow64\vbscript.dll
2014-06-18 23:37 . 2014-07-10 10:20	61952	----a-w-	c:\windows\SysWow64\iesetup.dll
2014-06-18 23:36 . 2014-07-10 10:20	51200	----a-w-	c:\windows\SysWow64\ieetwproxystub.dll
2014-06-18 23:35 . 2014-07-10 10:20	62464	----a-w-	c:\windows\SysWow64\MshtmlDac.dll
2014-06-18 23:33 . 2014-07-10 10:20	631808	----a-w-	c:\windows\system32\msfeeds.dll
2014-06-18 23:27 . 2014-07-10 10:20	1249280	----a-w-	c:\windows\system32\mshtmlmedia.dll
2014-06-18 23:27 . 2014-07-10 10:20	2040832	----a-w-	c:\windows\system32\inetcpl.cpl
2014-06-18 23:23 . 2014-07-10 10:20	112128	----a-w-	c:\windows\SysWow64\ieUnatt.exe
2014-06-18 23:22 . 2014-07-10 10:20	592896	----a-w-	c:\windows\SysWow64\jscript9diag.dll
2014-06-18 23:06 . 2014-07-10 10:20	32256	----a-w-	c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2014-06-18 22:58 . 2014-07-10 10:20	2266112	----a-w-	c:\windows\system32\wininet.dll
2014-06-18 22:52 . 2014-07-10 10:20	4254720	----a-w-	c:\windows\SysWow64\jscript9.dll
2014-06-18 22:51 . 2014-07-10 10:20	13527040	----a-w-	c:\windows\system32\ieframe.dll
2014-06-18 22:46 . 2014-07-10 10:20	1068032	----a-w-	c:\windows\SysWow64\mshtmlmedia.dll
2014-06-18 22:45 . 2014-07-10 10:20	1964544	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2014-06-18 22:34 . 2014-07-10 10:20	1393664	----a-w-	c:\windows\system32\urlmon.dll
2014-06-18 22:15 . 2014-07-10 10:20	846336	----a-w-	c:\windows\system32\ieapfltr.dll
2014-06-18 22:13 . 2014-07-10 10:20	1791488	----a-w-	c:\windows\SysWow64\wininet.dll
2014-06-18 02:18 . 2014-07-10 10:20	692736	----a-w-	c:\windows\system32\osk.exe
2014-06-18 01:51 . 2014-07-10 10:20	646144	----a-w-	c:\windows\SysWow64\osk.exe
2014-06-18 01:10 . 2014-07-10 10:20	3157504	----a-w-	c:\windows\system32\win32k.sys
2014-06-06 10:10 . 2014-07-10 10:20	624128	----a-w-	c:\windows\system32\qedit.dll
2014-06-06 09:44 . 2014-07-10 10:20	509440	----a-w-	c:\windows\SysWow64\qedit.dll
2014-06-05 14:45 . 2014-07-10 10:17	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-06-05 14:26 . 2014-07-10 10:17	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-06-05 14:25 . 2014-07-10 10:17	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-06-03 18:31 . 2013-08-09 11:24	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-05-30 08:08 . 2014-07-10 10:20	210944	----a-w-	c:\windows\system32\wdigest.dll
2014-05-30 08:08 . 2014-07-10 10:20	86528	----a-w-	c:\windows\system32\TSpkg.dll
2014-05-30 08:08 . 2014-07-10 10:20	340992	----a-w-	c:\windows\system32\schannel.dll
2014-05-30 08:08 . 2014-07-10 10:20	314880	----a-w-	c:\windows\system32\msv1_0.dll
2014-05-30 08:08 . 2014-07-10 10:20	307200	----a-w-	c:\windows\system32\ncrypt.dll
2014-05-30 08:08 . 2014-07-10 10:20	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-05-30 08:08 . 2014-07-10 10:20	22016	----a-w-	c:\windows\system32\credssp.dll
2014-05-30 07:52 . 2014-07-10 10:20	172032	----a-w-	c:\windows\SysWow64\wdigest.dll
2014-05-30 07:52 . 2014-07-10 10:20	65536	----a-w-	c:\windows\SysWow64\TSpkg.dll
2014-05-30 07:52 . 2014-07-10 10:20	247808	----a-w-	c:\windows\SysWow64\schannel.dll
2014-05-30 07:52 . 2014-07-10 10:20	220160	----a-w-	c:\windows\SysWow64\ncrypt.dll
2014-05-30 07:52 . 2014-07-10 10:20	259584	----a-w-	c:\windows\SysWow64\msv1_0.dll
2014-05-30 07:52 . 2014-07-10 10:20	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-05-30 07:52 . 2014-07-10 10:20	17408	----a-w-	c:\windows\SysWow64\credssp.dll
2014-05-30 06:45 . 2014-07-10 10:20	497152	----a-w-	c:\windows\system32\drivers\afd.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-06-06 13:07	297128	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iCloudServices"="c:\program files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe" [2013-11-20 59720]
"ApplePhotoStreams"="c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
"AppleIEDAV"="c:\program files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe" [2013-11-15 1326408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Nuance PDF Reader-reminder"="c:\program files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" [2008-11-03 328992]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2011-10-19 3331312]
"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 737104]
"SonicMasterTray"="c:\program files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-09-13 2317312]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-07-03 43816]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-05 751184]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"QqsnTerminal"="c:\program files (x86)\QQS\qvodterminal.exe" [2013-04-15 1027672]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-07-08 152392]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-07-24 190032]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2011-10-19 549040]
simplicheck.lnk - c:\program files (x86)\simplitec\simplicheck\simplicheck.exe -timer [2012-9-21 2936168]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 L1C;NDIS Miniport Driver for Atheros AR8131/AR8132 PCI-E Ethernet Controller (NDIS 6.20);c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 ASUS InstantOn;ASUS InstantOn Service;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe;c:\program files (x86)\Common Files\InstantOn\InsOnSrv.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 serverqqs;serverqqs;c:\program files (x86)\QQS\serverqqs.exe;c:\program files (x86)\QQS\serverqqs.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S3 AiCharger;ASUS Charger Driver;c:\windows\system32\DRIVERS\AiCharger.sys;c:\windows\SYSNATIVE\DRIVERS\AiCharger.sys [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 intelkmd;intelkmd;c:\windows\system32\DRIVERS\igdpmd64.sys;c:\windows\SYSNATIVE\DRIVERS\igdpmd64.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-04-29 17:17	1078088	----a-w-	c:\program files (x86)\Google\Chrome\Application\34.0.1847.131\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2014-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-25 12:41]
.
2014-08-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-25 12:41]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2014-05-27 15:49	357376	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-05-25 07:09	227840	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-05-25 07:09	227840	----a-w-	c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-09 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-09 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-09 416024]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-09-19 2278504]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-07-28 1935120]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://aartemis.com/?type=hp&ts=1388428453&from=s32&uid=WDCXWD5000BPVT-80HXZT3_WD-WXF1A81P4366P4366
mDefault_Search_URL = about:blank
mDefault_Page_URL = about:blank
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
mSearch Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: &Citavi Picker... - file://c:\program files (x86)\Internet Explorer\Citavi Picker\ShowContextMenu.html
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-com.apple.dav.bookmarks.daemon - c:\program files (x86)\Common Files\Apple\Internet Services\BookmarkDAV_client.exe
Wow6432Node-HKCU-Run-Updater - c:\programdata\Updater\updater.exe
Wow6432Node-HKLM-Run-Updater - c:\programdata\Updater\Updater.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-SynAsusAcpi - c:\program files (x86)\Synaptics\SynTP\SynAsusAcpi.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash10k.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\Common Files\InstantOn\InsOnWMI.exe
c:\program files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
c:\program files (x86)\ASUS\SmartLogon\sensorsrv.exe
c:\program files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
c:\windows\AsScrPro.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-08-12  22:38:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-08-12 20:38
.
Vor Suchlauf: 11 Verzeichnis(se), 103.819.341.824 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 104.502.968.320 Bytes frei
.
- - End Of File - - F0A624D497E6E43A2134B15C131CD35F
         


Alt 13.08.2014, 19:29   #6
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
--> eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen

Alt 13.08.2014, 20:57   #7
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Nachdem ich den Suchlauf von Malwarebytes' Anti-Malware durchgeführt habe, erschien ein Fenster in dem stand "Suchlauf fehlgeschlagen mit Fehlercode: 8." Doch das Programm zeigt "Erfolgreich abgeschlossen! Keine schädlichen Elemente gefunden!" an.
Soll ich jetzt einfach mit den nächsten Schritten fortfahren oder was hat der Fehlercode zu bedeuten? VG

Alt 14.08.2014, 13:15   #8
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



einfach die andern beiden, ja
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 15.08.2014, 12:45   #9
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Es ist wieder irgendeine Störung aufgetreten. Der Suchlauf hat bei dem Programm AdwCleaner geklappt aber bei dem Löschvorgang kam diese Meldung: AutoIt- Error allocating memory. Was mache ich jetzt am besten? VG

Alt 16.08.2014, 07:31   #10
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



AdwCLeaner löschen und neu laden
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 21.08.2014, 20:46   #11
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Habe es jetzt mehrmals versucht, aber es kommt immer die gleiche Meldung wieder. Wodran kann das denn liegen? Viele Grüße und vielen Dank

Alt 22.08.2014, 19:18   #12
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Rechner neu starten, frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 23.08.2014, 20:53   #13
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen




FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-08-2014
Ran by Alina (administrator) on ALINA-PC on 23-08-2014 21:35:43
Running from C:\Users\Alina\Downloads\FRST-OlderVersion
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(ASUS) C:\Windows\AsScrPro.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUS) C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(ASUS) C:\Program Files (x86)\Common Files\InstantOn\InsOnWMI.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\QQS\serverqqs.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
() C:\Program Files (x86)\windowsvnew\windowsclnew.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2278504 2011-09-19] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2816808 2011-07-21] (Synaptics Incorporated)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-28] (Intel(R) Corporation)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [98088 2011-07-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2011-10-19] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-22] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-08] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [QqsnTerminal] => C:\Program Files (x86)\QQS\qvodterminal.exe [1027672 2013-04-15] (Shenzhen QVOD Technology Co.,Ltd)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe (ASUSTeK Computer Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {8FD5747A-3AB3-44DB-9625-AF77E3633166} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=e8755884-b9f1-4447-9efb-65fbed0bfb47&apn_sauid=5295E3B0-7467-4281-B9D8-25A597117AF0
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @qqsn.com/QqsnInsert -> C:\Program Files (x86)\QQS\NpqqsnInsert.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @qqsp.com/QvodInsert -> C:\Program Files (x86)\QQS\npqqsp.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @qvod.com/QvodInsert -> C:\Program Files (x86)\QQS\npqplus.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-11]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR DefaultSuggestURL: {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Google Docs) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-02]
CHR Extension: (Google Drive) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-02]
CHR Extension: (YouTube) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-25]
CHR Extension: (Google-Suche) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-25]
CHR Extension: (Google Wallet) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Citavi Picker) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-05-25]
CHR Extension: (Google Mail) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-25]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - D:\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-05] (Avira Operations GmbH & Co. KG)
S2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG)
S2 MBAMScheduler; C:\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-28] ()
R2 serverqqs; C:\Program Files (x86)\QQS\serverqqs.exe [712280 2014-01-26] ()
R2 windowsvnew; C:\Program Files (x86)\windowsvnew\windowsclnew.exe [36384 2014-08-15] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiCharger; C:\Windows\SysWOW64\DRIVERS\AiCharger.sys [16768 2011-09-20] (ASUSTek Computer Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-23 21:31 - 2014-08-23 21:31 - 00049506 _____ () C:\Users\Alina\Desktop\FRST2.txt
2014-08-23 21:16 - 2014-08-23 21:16 - 00049160 _____ () C:\Users\Alina\Desktop\FRST.txt
2014-08-23 20:57 - 2014-08-23 21:35 - 00000000 ____D () C:\Users\Alina\Downloads\FRST-OlderVersion
2014-08-17 19:58 - 2014-08-23 20:47 - 00000260 _____ () C:\Windows\windrun.ini
2014-08-17 18:26 - 2014-08-21 21:37 - 00000000 ____D () C:\Windows\windrun
2014-08-16 15:45 - 2014-08-16 15:45 - 01361203 _____ () C:\Users\Alina\Downloads\adwcleaner_3.306.exe
2014-08-16 09:48 - 2014-08-16 09:48 - 00000000 ____D () C:\Program Files (x86)\windowsvnew
2014-08-14 14:50 - 2014-08-18 07:58 - 00000000 ____D () C:\AdwCleaner
2014-08-14 14:50 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-14 14:47 - 2014-08-14 14:47 - 00001753 _____ () C:\Users\Alina\Desktop\mbam.txt
2014-08-13 22:01 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 22:01 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 22:01 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 22:01 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 22:01 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 22:01 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 22:01 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 22:01 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 21:27 - 2014-08-23 20:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-13 21:26 - 2014-08-13 21:26 - 00000703 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ Malwarebytes Anti-Malware 
2014-08-13 21:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-13 21:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-13 21:26 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-13 21:21 - 2014-08-13 21:22 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Alina\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-13 14:16 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 14:16 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 14:16 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 14:16 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 14:16 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 14:16 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 14:16 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 14:16 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 14:16 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 14:16 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 14:16 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 14:16 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 14:16 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 14:16 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 14:16 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 14:16 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 14:16 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 14:16 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 14:16 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 14:16 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 14:16 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 14:16 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 14:16 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 14:16 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 14:16 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 14:16 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 14:16 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 14:16 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 14:16 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 14:16 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 14:16 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 14:16 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 14:16 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 14:16 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 14:16 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 14:16 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 14:16 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 14:16 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 14:16 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 14:16 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 14:16 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 14:16 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 14:16 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 14:16 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 14:16 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 14:16 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 14:16 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 14:16 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 14:16 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 14:16 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 14:16 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 14:16 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 14:16 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 14:16 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 14:16 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 14:16 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 14:16 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 14:16 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 14:16 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 14:16 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 14:16 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 14:16 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 14:16 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 14:16 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 14:16 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 14:16 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 14:16 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 14:16 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 14:16 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 14:16 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 14:16 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 14:16 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 14:16 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 14:15 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 14:15 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 14:15 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 14:15 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-12 22:45 - 2014-08-12 22:45 - 00030408 _____ () C:\Users\Alina\Desktop\X.txt
2014-08-12 22:38 - 2014-08-12 22:38 - 00030408 _____ () C:\ComboFix.txt
2014-08-12 22:20 - 2014-08-12 22:38 - 00000000 ____D () C:\Qoobox
2014-08-12 22:20 - 2014-08-12 22:38 - 00000000 ____D () C:\ComboFix
2014-08-12 22:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-12 22:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-12 22:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-12 22:19 - 2014-08-12 22:37 - 00000000 ____D () C:\Windows\erdnt
2014-08-12 22:15 - 2014-08-12 22:19 - 05569662 ____R (Swearware) C:\Users\Alina\Downloads\ComboFix.exe
2014-08-12 17:57 - 2014-08-12 17:57 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95 (1).exe
2014-08-12 17:57 - 2014-08-12 17:57 - 00000700 _____ () C:\Users\Alina\Desktop\Revo Uninstaller.lnk
2014-08-12 17:55 - 2014-08-12 17:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95.exe
2014-08-12 12:54 - 2014-08-12 12:54 - 00066716 _____ () C:\Users\Alina\Desktop\AVSCAN-20140807-174049-37AFBB3B.LOG
2014-08-12 12:51 - 2014-08-12 12:51 - 00007924 _____ () C:\Users\Alina\Desktop\Gmer.txt
2014-08-12 12:33 - 2014-08-12 12:33 - 00380416 _____ () C:\Users\Alina\Downloads\Gmer-19357.exe
2014-08-12 12:26 - 2014-08-12 11:10 - 00000472 _____ () C:\Users\Alina\Desktop\defogger_disable.log
2014-08-12 12:24 - 2014-08-12 12:27 - 00000000 ____D () C:\Users\Alina\Desktop\FRST-Editor+Addition
2014-08-12 11:40 - 2014-08-12 12:19 - 00043712 _____ () C:\Users\Alina\Downloads\Addition.txt
2014-08-12 11:32 - 2014-08-23 21:35 - 00000000 ____D () C:\FRST
2014-08-12 11:32 - 2014-08-12 12:19 - 00029938 _____ () C:\Users\Alina\Downloads\FRST.txt
2014-08-12 11:13 - 2014-08-23 20:57 - 02103296 _____ (Farbar) C:\Users\Alina\Downloads\FRST64.exe
2014-08-12 11:01 - 2014-08-12 11:10 - 00000472 _____ () C:\Users\Alina\Downloads\defogger_disable.log
2014-08-12 11:01 - 2014-08-12 11:01 - 00000000 _____ () C:\Users\Alina\defogger_reenable
2014-08-12 10:54 - 2014-08-12 10:55 - 00050477 _____ () C:\Users\Alina\Downloads\Defogger.exe
2014-08-12 10:32 - 2014-08-12 10:32 - 00005128 _____ () C:\Users\Alina\Downloads\Logs.zip
2014-08-05 13:09 - 2014-08-21 21:43 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-05 13:09 - 2014-08-21 21:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-01 12:56 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 12:56 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 12:56 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 12:56 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 12:55 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 12:55 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 12:55 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 12:55 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 12:55 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 12:55 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-23 21:35 - 2014-08-23 20:57 - 00000000 ____D () C:\Users\Alina\Downloads\FRST-OlderVersion
2014-08-23 21:35 - 2014-08-12 11:32 - 00000000 ____D () C:\FRST
2014-08-23 21:31 - 2014-08-23 21:31 - 00049506 _____ () C:\Users\Alina\Desktop\FRST2.txt
2014-08-23 21:26 - 2012-10-25 14:41 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-23 21:16 - 2014-08-23 21:16 - 00049160 _____ () C:\Users\Alina\Desktop\FRST.txt
2014-08-23 20:59 - 2011-12-27 02:13 - 00000000 ____D () C:\ProgramData\Temp
2014-08-23 20:57 - 2014-08-12 11:13 - 02103296 _____ (Farbar) C:\Users\Alina\Downloads\FRST64.exe
2014-08-23 20:57 - 2014-03-05 13:40 - 00000244 _____ () C:\Windows\qqsserver.ini
2014-08-23 20:57 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-23 20:57 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-23 20:55 - 2011-12-27 02:01 - 02084621 _____ () C:\Windows\WindowsUpdate.log
2014-08-23 20:54 - 2014-08-13 21:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-23 20:47 - 2014-08-17 19:58 - 00000260 _____ () C:\Windows\windrun.ini
2014-08-23 20:46 - 2012-10-25 14:41 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-23 20:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-23 20:45 - 2009-07-14 06:51 - 00106998 _____ () C:\Windows\setupact.log
2014-08-21 21:43 - 2014-08-05 13:09 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-21 21:43 - 2014-08-05 13:09 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-21 21:43 - 2013-08-09 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-21 21:43 - 2013-08-09 13:24 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-21 21:37 - 2014-08-17 18:26 - 00000000 ____D () C:\Windows\windrun
2014-08-21 21:35 - 2009-07-14 06:45 - 00413624 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-18 07:58 - 2014-08-14 14:50 - 00000000 ____D () C:\AdwCleaner
2014-08-17 18:28 - 2011-12-27 02:10 - 00001485 _____ () C:\Windows\system32\ServiceFilter.ini
2014-08-17 12:39 - 2011-02-19 06:24 - 00711078 _____ () C:\Windows\system32\perfh007.dat
2014-08-17 12:39 - 2011-02-19 06:24 - 00153526 _____ () C:\Windows\system32\perfc007.dat
2014-08-17 12:39 - 2009-07-14 07:13 - 01651372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 15:45 - 2014-08-16 15:45 - 01361203 _____ () C:\Users\Alina\Downloads\adwcleaner_3.306.exe
2014-08-16 10:00 - 2014-01-23 22:27 - 00000000 ____D () C:\Users\Alina\AppData\Local\Apps\2.0
2014-08-16 09:53 - 2014-03-05 13:29 - 00000000 ____D () C:\Windows\qqsupdate
2014-08-16 09:48 - 2014-08-16 09:48 - 00000000 ____D () C:\Program Files (x86)\windowsvnew
2014-08-14 19:09 - 2012-08-20 12:43 - 00000000 ____D () C:\Users\Alina
2014-08-14 14:47 - 2014-08-14 14:47 - 00001753 _____ () C:\Users\Alina\Desktop\mbam.txt
2014-08-14 11:56 - 2011-10-19 05:20 - 00637788 _____ () C:\Windows\PFRO.log
2014-08-13 22:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 22:38 - 2012-08-28 21:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-13 22:29 - 2013-08-19 10:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 22:08 - 2012-08-28 21:49 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 22:00 - 2014-05-14 14:31 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 21:43 - 2009-07-29 08:03 - 00000000 ____D () C:\Windows\Panther
2014-08-13 21:26 - 2014-08-13 21:26 - 00000703 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ Malwarebytes Anti-Malware 
2014-08-13 21:22 - 2014-08-13 21:21 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Alina\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-13 15:05 - 2013-01-20 18:13 - 00000000 ____D () C:\Users\Alina\Documents\Wohnung
2014-08-12 22:45 - 2014-08-12 22:45 - 00030408 _____ () C:\Users\Alina\Desktop\X.txt
2014-08-12 22:38 - 2014-08-12 22:38 - 00030408 _____ () C:\ComboFix.txt
2014-08-12 22:38 - 2014-08-12 22:20 - 00000000 ____D () C:\Qoobox
2014-08-12 22:38 - 2014-08-12 22:20 - 00000000 ____D () C:\ComboFix
2014-08-12 22:38 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-08-12 22:37 - 2014-08-12 22:19 - 00000000 ____D () C:\Windows\erdnt
2014-08-12 22:33 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-12 22:19 - 2014-08-12 22:15 - 05569662 ____R (Swearware) C:\Users\Alina\Downloads\ComboFix.exe
2014-08-12 18:39 - 2013-12-30 21:34 - 00000176 _____ () C:\Users\Alina\AppData\Roaming\WB.CFG
2014-08-12 17:57 - 2014-08-12 17:57 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95 (1).exe
2014-08-12 17:57 - 2014-08-12 17:57 - 00000700 _____ () C:\Users\Alina\Desktop\Revo Uninstaller.lnk
2014-08-12 17:55 - 2014-08-12 17:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95.exe
2014-08-12 12:54 - 2014-08-12 12:54 - 00066716 _____ () C:\Users\Alina\Desktop\AVSCAN-20140807-174049-37AFBB3B.LOG
2014-08-12 12:51 - 2014-08-12 12:51 - 00007924 _____ () C:\Users\Alina\Desktop\Gmer.txt
2014-08-12 12:33 - 2014-08-12 12:33 - 00380416 _____ () C:\Users\Alina\Downloads\Gmer-19357.exe
2014-08-12 12:27 - 2014-08-12 12:24 - 00000000 ____D () C:\Users\Alina\Desktop\FRST-Editor+Addition
2014-08-12 12:19 - 2014-08-12 11:40 - 00043712 _____ () C:\Users\Alina\Downloads\Addition.txt
2014-08-12 12:19 - 2014-08-12 11:32 - 00029938 _____ () C:\Users\Alina\Downloads\FRST.txt
2014-08-12 11:10 - 2014-08-12 12:26 - 00000472 _____ () C:\Users\Alina\Desktop\defogger_disable.log
2014-08-12 11:10 - 2014-08-12 11:01 - 00000472 _____ () C:\Users\Alina\Downloads\defogger_disable.log
2014-08-12 11:01 - 2014-08-12 11:01 - 00000000 _____ () C:\Users\Alina\defogger_reenable
2014-08-12 10:55 - 2014-08-12 10:54 - 00050477 _____ () C:\Users\Alina\Downloads\Defogger.exe
2014-08-12 10:32 - 2014-08-12 10:32 - 00005128 _____ () C:\Users\Alina\Downloads\Logs.zip
2014-08-07 04:06 - 2014-08-13 14:15 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 14:15 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 10:42 - 2011-12-27 02:10 - 00002248 _____ () C:\Windows\system32\AutoRunFilter.ini
2014-08-05 13:09 - 2013-08-09 13:24 - 00000000 ____D () C:\ProgramData\Avira
2014-08-05 09:20 - 2012-08-29 09:07 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-04 13:45 - 2014-05-25 13:23 - 00000000 ____D () C:\Users\Alina\Documents\Citavi 4
2014-08-04 13:00 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-01 01:41 - 2014-08-13 14:16 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 14:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-25 16:52 - 2014-08-13 14:16 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-07-25 16:02 - 2014-08-13 14:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-07-25 16:01 - 2014-08-13 14:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-07-25 15:51 - 2014-08-13 14:16 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-25 15:30 - 2014-08-13 14:16 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-07-25 15:28 - 2014-08-13 14:16 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-07-25 15:28 - 2014-08-13 14:16 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-07-25 15:25 - 2014-08-13 14:16 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-07-25 15:25 - 2014-08-13 14:16 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-07-25 15:11 - 2014-08-13 14:16 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-07-25 15:10 - 2014-08-13 14:16 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-07-25 15:04 - 2014-08-13 14:16 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-25 15:03 - 2014-08-13 14:16 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-07-25 15:00 - 2014-08-13 14:16 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-07-25 15:00 - 2014-08-13 14:16 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-07-25 14:59 - 2014-08-13 14:16 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-07-25 14:47 - 2014-08-13 14:16 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-07-25 14:40 - 2014-08-13 14:16 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-07-25 14:34 - 2014-08-13 14:16 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-25 14:34 - 2014-08-13 14:16 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-25 14:33 - 2014-08-13 14:16 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-25 14:30 - 2014-08-13 14:16 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-25 14:28 - 2014-08-13 14:16 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-07-25 14:28 - 2014-08-13 14:16 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-07-25 14:21 - 2014-08-13 14:16 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-25 14:19 - 2014-08-13 14:16 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-07-25 14:18 - 2014-08-13 14:16 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-25 14:17 - 2014-08-13 14:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-07-25 14:17 - 2014-08-13 14:16 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-25 14:12 - 2014-08-13 14:16 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-25 14:10 - 2014-08-13 14:16 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-07-25 14:10 - 2014-08-13 14:16 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-25 14:08 - 2014-08-13 14:16 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-25 14:06 - 2014-08-13 14:16 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-25 13:52 - 2014-08-13 14:16 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-25 13:47 - 2014-08-13 14:16 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-07-25 13:43 - 2014-08-13 14:16 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-25 13:42 - 2014-08-13 14:16 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-07-25 13:39 - 2014-08-13 14:16 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-07-25 13:39 - 2014-08-13 14:16 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-07-25 13:36 - 2014-08-13 14:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-25 13:34 - 2014-08-13 14:16 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-25 13:29 - 2014-08-13 14:16 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-25 13:23 - 2014-08-13 14:16 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-07-25 13:13 - 2014-08-13 14:16 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-25 13:07 - 2014-08-13 14:16 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-25 13:07 - 2014-08-13 14:16 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-25 13:03 - 2014-08-13 14:16 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-25 12:52 - 2014-08-13 14:16 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-07-25 12:26 - 2014-08-13 14:16 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-07-25 12:17 - 2014-08-13 14:16 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-07-25 12:09 - 2014-08-13 14:16 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-25 12:05 - 2014-08-13 14:16 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-25 12:00 - 2014-08-13 14:16 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-24 17:46 - 2013-03-16 14:25 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-07-24 17:46 - 2013-03-16 14:25 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2014-07-24 10:50 - 2013-03-16 14:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight

Some content of TEMP:
====================
C:\Users\Alina\AppData\Local\Temp\avgnt.exe
C:\Users\Alina\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-01 13:21

==================== End Of Log ============================
         
--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 23-08-2014
Ran by Alina at 2014-08-23 21:45:13
Running from C:\Users\Alina\Downloads\FRST-OlderVersion
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 10.1.85.3 - Adobe Systems Incorporated)
Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.0.32.18 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.08) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.08 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 2.5.775.2 - Advanced Micro Devices Inc.) Hidden
AMD AVIVO64 Codecs (Version: 11.7.0.10927 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{92015CBE-D397-C3EA-99FC-B03051DE69A4}) (Version: 3.0.847.0 - Advanced Micro Devices, Inc.)
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Asmedia ASM104x USB 3.0 Host Controller Driver (HKLM-x32\...\{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}) (Version: 1.12.9.0 - Asmedia Technology)
ASUS AI Recovery (HKLM-x32\...\{D39F0676-163E-4595-A917-E28F99BBD4D2}) (Version: 1.0.16 - ASUS)
ASUS LifeFrame3 (HKLM-x32\...\{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}) (Version: 3.0.27 - ASUS)
ASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.0.7 - ASUS)
ASUS Power4Gear Hybrid (HKLM\...\{33B98264-A889-4913-A0CA-C364A75032B3}) (Version: 1.1.45 - ASUS)
ASUS SmartLogon (HKLM-x32\...\{64452561-169F-4A36-A2FF-B5E118EC65F5}) (Version: 1.0.0011 - ASUS)
ASUS Sonic Focus (HKLM-x32\...\{B0002707-4F7E-4745-88A7-852DA8A88635}) (Version: 1.0.0.5 - Synopsys )
ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.0.4 - ASUS)
ASUS Virtual Camera (HKLM-x32\...\{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}) (Version: 1.0.23 - asus)
ASUS WebStorage (HKLM-x32\...\ASUS WebStorage) (Version: 3.0.108.222 - eCareme Technologies, Inc.)
AsusScr_K3 Series_ENG (HKLM-x32\...\AsusScr_K3 Series_ENG) (Version: 1.0.0001 - ASUS)
AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.7.142 - ASUSTEK)
ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0014 - ASUS)
Avira (HKLM-x32\...\{e67154a7-9cc5-4167-b782-f3982bc6c70d}) (Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.19.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Profiles Mobile (x32 Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2011.0927.2224.38375 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2011.0927.2225.38375 - Advanced Micro Devices, Inc.) Hidden
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.3.0.15 - Swiss Academic Software)
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM-x32\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM-x32\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM-x32\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.3624 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.3624 - CyberLink Corp.) Hidden
CyberLink Media Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 8.0.2926 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2926 - CyberLink Corp.) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 7.0.0.1126 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 7.0.0.1126 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Deadtime Stories (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-118716773}) (Version:  - Oberon Media)
Dream Day First Home (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-113832110}) (Version:  - Oberon Media)
Dream Vacation Solitaire (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111249233}) (Version:  - Oberon Media)
Farm Frenzy 3 - Madagascar (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-119205603}) (Version:  - Oberon Media)
Fast Boot (HKLM\...\{13F4A7F3-EABC-4261-AF6B-1317777F0755}) (Version: 1.0.10 - ASUS)
Free YouTube to MP3 Converter version 3.12.39.604 (HKLM-x32\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.39.604 - DVDVideoSoft Ltd.)
Galapago (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}) (Version:  - Oberon Media)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Game Park Console (HKLM-x32\...\Game Park Console) (Version: 1.2.4.431 - Oberon Media Inc.)
Go Go Gourmet Chef of the Year (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115290153}) (Version:  - Oberon Media)
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
InstantOn for NB (HKLM-x32\...\{749F674B-2674-47E8-879C-5626A06B2A91}) (Version: 2.1.5 - ASUS)
Intel PROSet Wireless (Version:  - ) Hidden
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Display Audio Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 6.14.00.3074 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi Software (HKLM\...\{25FBDA9A-E868-4B3B-B9FF-D923818511A1}) (Version: 14.2.0000 - Intel Corporation)
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
MAGIX Foto Designer 7 (HKLM-x32\...\MAGIX_{2DCD52EE-1AE1-4128-9819-A79F7D09B6B3}) (Version: 7.0.1.1 - MAGIX AG)
MAGIX Foto Designer 7 (Version: 7.0.1.1 - MAGIX AG) Hidden
Mahjong Memoirs (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117948443}) (Version:  - Oberon Media)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Nuance PDF Reader (HKLM-x32\...\{B480904D-F73F-4673-B034-8A5F492C9184}) (Version: 6.00.0041 - Nuance Communications, Inc.)
Plants vs Zombies (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117080787}) (Version:  - Oberon Media)
PX Profile Update (x32 Version: 1.00.1. - AMD) Hidden
QQS version 2.9 (HKLM-x32\...\{C1BC705B-A7E6-48DE-8E41-66FB67A3FDCB}_is1) (Version: 2.9 - Alliance Win Online Network Technology Co., LTD)
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.48.823.2011 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6473 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7600.10010 - Realtek Semiconductor Corp.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
simplitec simplicheck (HKLM-x32\...\{DF103EDA-7937-4966-8EFB-5EF5C38301F2}) (Version: 1.3.9.0 - simplitec GmbH)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.17.0 - Synaptics Incorporated)
Turbo Fiesta (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-115320460}) (Version:  - Oberon Media)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{EA54F104-79D2-48CC-9ABC-91A63C43D353}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2883097) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B2260BC9-D561-46EE-B33D-739CF760A2A9}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Family Safety (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM-x32\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
WinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.32.0 - ASUS)
Wireless Console 3 (HKLM-x32\...\{C4BC5A5F-4A97-47CC-99C3-AB8E10572AFE}) (Version: 3.0.24 - ASUS)
World of Goo (HKLM-x32\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-116672750}) (Version:  - Oberon Media)
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM-x32\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Элемент управления Windows Live Mesh ActiveX для удаленных подключений (HKLM-x32\...\{BCB0D6F7-7EAB-4009-A6F2-8E0E7F317773}) (Version: 15.4.5722.2 - Microsoft Corporation)
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
פקד ActiveX של Windows Live Mesh עבור חיבורים מרוחקים (HKLM-x32\...\{9D4C7DFA-CBBB-4F06-BDAC-94D831406DF0}) (Version: 15.4.5722.2 - Microsoft Corporation)
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
عنصر تحكم ActiveX الخاص بـ Windows Live Mesh للاتصالات البعيدة (HKLM-x32\...\{E18B30AA-6E2D-480C-B918-AF61009F4010}) (Version: 15.4.5722.2 - Microsoft Corporation)
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (HKLM-x32\...\{622DE1BE-9EDE-49D3-B349-29D64760342A}) (Version: 15.4.5722.2 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

01-08-2014 10:54:35 Windows Update
01-08-2014 11:02:04 Windows Update
05-08-2014 09:44:35 Windows Update
10-08-2014 12:51:17 Windows Update
12-08-2014 17:55:32 Revo Uninstaller's restore point - Advanced System Protector
12-08-2014 17:57:52 Revo Uninstaller's restore point - Ask Toolbar
12-08-2014 18:00:23 Revo Uninstaller's restore point - Internet Updater
12-08-2014 18:02:24 Revo Uninstaller's restore point - Internet Updater
12-08-2014 18:03:24 Revo Uninstaller's restore point - Internet Updater
12-08-2014 18:05:56 Revo Uninstaller's restore point - Mobogenie
12-08-2014 18:07:50 Revo Uninstaller's restore point - SaveSense
12-08-2014 20:00:29 Revo Uninstaller's restore point - Updater
12-08-2014 20:01:16 Revo Uninstaller's restore point - Updater
12-08-2014 20:02:44 Revo Uninstaller's restore point - Websteroids
13-08-2014 20:00:19 Windows Update
21-08-2014 19:43:57 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-08-12 22:28 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {270A9D56-2000-4395-ADFF-A1910D95310E} - System32\Tasks\ASUS P4G => C:\Program Files\P4G\BatteryLife.exe [2011-06-01] (ASUS)
Task: {39BB8806-4CFA-40D6-906F-EDA2F0AEF959} - System32\Tasks\ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
Task: {42565EA5-C880-4ED6-995D-F5DAEC2367E4} - System32\Tasks\USBChargerPlus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2011-09-20] (ASUSTek Computer Inc.)
Task: {7353B56C-521F-4C43-B3AF-8CF5A7309231} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {87F9E635-9EFD-427B-8318-02036C4C7F07} - System32\Tasks\ASUS SmartLogon Console Sensor => C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe [2010-11-15] (ASUS)
Task: {97FB1A7D-CC63-4C47-9B60-FAF01FF39B8C} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-25] (Google Inc.)
Task: {B0B1ED6F-B28E-4F7D-87E2-27F9F5200F9F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-10-25] (Google Inc.)
Task: {BD4818B2-B76A-482B-83EC-E46000BA6FD4} - System32\Tasks\ATKOSD2 => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [2011-07-22] (ASUS)
Task: {EA5F4C4D-C218-40C6-8FE7-79B41EE725F7} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2011-09-30] (ASUSTeK Computer Inc.)
Task: {F04456C9-2348-467E-9426-E8A5942FBFB6} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2013-11-20] (Apple Inc.)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2011-07-28 06:07 - 2011-07-28 06:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2008-08-25 06:02 - 2008-08-25 06:02 - 00027648 _____ () C:\Windows\System32\DELG1L6.DLL
2010-07-15 02:11 - 2010-07-15 02:11 - 00031360 _____ () C:\Program Files\P4G\DevMng.dll
2011-12-27 02:03 - 2011-08-09 01:44 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2011-07-28 06:07 - 2011-07-28 06:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-10-13 08:19 - 2011-07-21 12:59 - 00057640 _____ () C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
2014-03-05 13:29 - 2014-01-26 20:32 - 00712280 _____ () C:\Program Files (x86)\QQS\serverqqs.exe
2014-08-16 09:48 - 2014-08-15 11:25 - 00036384 _____ () C:\Program Files (x86)\windowsvnew\windowsclnew.exe
2011-09-30 03:06 - 2011-09-30 03:06 - 00208384 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\alvupdt.dll
2010-08-20 19:57 - 2010-08-20 19:57 - 00619816 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
2010-08-20 19:57 - 2010-08-20 19:57 - 00013096 _____ () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-01-20 14:17 - 2014-01-20 14:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-01-20 14:16 - 2014-01-20 14:16 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2014-08-13 12:18 - 2014-08-04 14:20 - 00052472 _____ () C:\Users\Alina\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2014-08-04 14:20 - 2014-08-04 14:20 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:51E9F892
AlternateDataStreams: C:\ProgramData\Temp:676C1C69

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: ASUS Screen Saver Protector => C:\Windows\AsScrPro.exe
MSCONFIG\startupreg: CLMLServer => "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe"
MSCONFIG\startupreg: RtHDVCpl => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s

==================== Faulty Device Manager Devices =============

Name: Lexmark X422
Description: Lexmark X422
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Lexmark
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: Lexmark X422
Description: Lexmark X422
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Lexmark
Service: usbscan
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/23/2014 09:01:37 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm chrome.exe, Version 34.0.1847.131 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 13a8

Startzeit: 01cfbf040fcc77b2

Endzeit: 12

Anwendungspfad: C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

Berichts-ID: e4763344-2af7-11e4-a032-c86000067722

Error: (08/18/2014 06:42:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 18150467

Error: (08/18/2014 06:42:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 18150467

Error: (08/18/2014 06:42:00 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/18/2014 06:41:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 18132870

Error: (08/18/2014 06:41:45 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 18132870

Error: (08/18/2014 06:41:44 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/17/2014 06:18:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8555532

Error: (08/17/2014 06:18:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8555532

Error: (08/17/2014 06:18:22 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second


System errors:
=============
Error: (08/23/2014 08:47:20 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Avira Service Host erreicht.

Error: (08/17/2014 08:01:09 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X64 erreicht.

Error: (08/17/2014 07:58:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "serverqqs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/17/2014 07:58:04 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst serverqqs erreicht.

Error: (08/17/2014 06:26:31 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "serverqqs" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/17/2014 06:26:31 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst serverqqs erreicht.

Error: (08/14/2014 02:42:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/14/2014 02:42:17 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (08/14/2014 02:42:17 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: )
Description: WMPNetworkSvc0x80070420

Error: (08/14/2014 02:38:18 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {078AEF33-C48A-49F7-AFF3-A0EE810BFE7C}


Microsoft Office Sessions:
=========================
Error: (06/10/2014 07:46:03 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6695.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 105 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-08-12 22:27:53.621
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-08-12 22:27:53.503
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-08-20 13:00:13.652
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 13:00:13.356
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 13:00:13.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 13:00:12.778
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\winsxs\x86_microsoft-windows-s..trics-sensoradapter_31bf3856ad364e35_6.1.7600.16385_none_13881e44d6ccca6b\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:03.147
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:02.835
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:02.429
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-08-20 12:56:02.008
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Users\Alina\Documents\boot\Windows\System32\WinBioPlugIns\winbiosensoradapter.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-2450M CPU @ 2.50GHz
Percentage of memory in use: 22%
Total physical RAM: 8096.05 MB
Available physical RAM: 6295.93 MB
Total Pagefile: 16190.29 MB
Available Pagefile: 14066.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:186.3 GB) (Free:96.34 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:254.46 GB) (Free:235.79 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: E3102A4B)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=186.3 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=254.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Alt 24.08.2014, 06:55   #14
schrauber
/// the machine
/// TB-Ausbilder
 

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 27.08.2014, 16:56   #15
häuser
 
eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Standard

eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen



Code:
ATTFilter
 Results of screen317's Security Check version 0.99.87  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Adobe Flash Player 10 Flash Player out of Date! 
 Adobe Reader XI  
 Google Chrome 33.0.1750.154  
 Google Chrome 34.0.1847.131  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=f1de25a60597f5448ebd66e77fd55597
# engine=19844
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-08-27 06:39:48
# local_time=2014-08-27 08:39:48 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1810 16777213 100 100 80745 153673766 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776573 100 94 301538 160751438 0 0
# scanned=198910
# found=9
# cleaned=0
# scan_time=73698
sh=3A50155CD035CA715D5AF5664E35D796D4B3BEC6 ft=0 fh=0000000000000000 vn="JS/Toolbar.Crossrider.B evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\weDownload\45820.crx.vir"
sh=AAEA2D2C15813161F9E114E6E1708CE545D5C8CA ft=1 fh=0022d452663e533e vn="Variante von Win32/DealPly.M evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSense\SaveSenseUpdateVer.exe.vir"
sh=FABF99D84DAE1B16B0BDBA7003ACA991AE40DB47 ft=1 fh=2aca0aed277d57d6 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\SaveSenseLive.exe.vir"
sh=10903598F769E2AC5F1E2372E90F6722A3A860B7 ft=1 fh=89560075533c3d40 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\npGoogleUpdate3.dll.vir"
sh=88482528CE4F67A1004B50BA93282CEACCEDE534 ft=1 fh=e40b702402e604d5 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\psmachine.dll.vir"
sh=FABF99D84DAE1B16B0BDBA7003ACA991AE40DB47 ft=1 fh=2aca0aed277d57d6 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLive.exe.vir"
sh=70D49B9ABA391E6976DAB5C4BEA63733459B3F1C ft=1 fh=0b76a05977e7722a vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveBroker.exe.vir"
sh=FABF99D84DAE1B16B0BDBA7003ACA991AE40DB47 ft=1 fh=2aca0aed277d57d6 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveHandler.exe.vir"
sh=F09B9B9B1D16D1539D23CC6ACDE0DC7BC983DF59 ft=1 fh=2dbadf99ca2df2d7 vn="Win32/SaveSense.A evtl. unerwünschte Anwendung" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\SaveSenseLive\Update\1.3.23.0\SaveSenseLiveOnDemand.exe.vir"
         

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-08-2014
Ran by Alina (administrator) on ALINA-PC on 27-08-2014 17:40:05
Running from C:\Users\Alina\Downloads\FRST-OlderVersion
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(ASUSTeK Computer Inc.) C:\Windows\System32\FBAgent.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(ASUS) C:\Program Files\P4G\BatteryLife.exe
(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe
(ASUS) C:\Program Files (x86)\ASUS\SmartLogon\sensorsrv.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUS) C:\Windows\AsScrPro.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(ASUS) C:\Program Files (x86)\Common Files\InstantOn\InsOnSrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(ASUS) C:\Program Files (x86)\Common Files\InstantOn\InsOnWMI.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Virage Logic Corporation / Sonic Focus) C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
(ASUS) C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files (x86)\QQS\serverqqs.exe
() C:\Program Files (x86)\windowsvnew\windowsclnew.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
() C:\Windows\windrun\310x270.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebgrd.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2278504 2011-09-19] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2816808 2011-07-21] (Synaptics Incorporated)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-28] (Intel(R) Corporation)
HKLM\...\Run: [SynAsusAcpi] => C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe [98088 2011-07-21] (Synaptics Incorporated)
HKLM-x32\...\Run: [Nuance PDF Reader-reminder] => C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe [328992 2008-11-03] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2011-10-19] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] => C:\Program Files (x86)\ASUS\ASUS Sonic Focus\SonicFocusTray.exe [984400 2010-07-10] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-22] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-08] (ASUS)
HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] => C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2317312 2011-09-13] (ASUS)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [QqsnTerminal] => C:\Program Files (x86)\QQS\qvodterminal.exe [1027672 2013-04-15] (Shenzhen QVOD Technology Co.,Ltd)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [161584 2014-08-04] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-4030160574-3978167193-2738772545-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1326408 2013-11-15] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\AsusVibeLauncher.lnk
ShortcutTarget: AsusVibeLauncher.lnk -> C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe (ASUSTeK Computer Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)
ShellIconOverlayIdentifiers: AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\ASUSWSShellExt64.dll (eCareme Technologies, Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - DefaultScope {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = 
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {8FD5747A-3AB3-44DB-9625-AF77E3633166} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-3&o=APN10395&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^ABT&apn_dtid=^YYYYYY^YY^DE&apn_uid=e8755884-b9f1-4447-9efb-65fbed0bfb47&apn_sauid=5295E3B0-7467-4281-B9D8-25A597117AF0
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @qqsn.com/QqsnInsert -> C:\Program Files (x86)\QQS\NpqqsnInsert.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @qqsp.com/QvodInsert -> C:\Program Files (x86)\QQS\npqqsp.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @qvod.com/QvodInsert -> C:\Program Files (x86)\QQS\npqplus.dll (Alliance Win Online Network Technology Co., LTD)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin-x32: ZEON/PDF,version=2.0 -> C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)
FF HKCU\...\Firefox\Extensions: [{B64D9B05-48E1-4CEB-BF58-E0643994E900}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff
FF Extension: Download videos and MP3s from YouTube - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff [2014-06-11]

Chrome: 
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR DefaultSuggestURL: {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Google Docs) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-08-02]
CHR Extension: (Google Drive) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-08-02]
CHR Extension: (YouTube) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-10-25]
CHR Extension: (Google-Suche) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-10-25]
CHR Extension: (Google Wallet) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-08]
CHR Extension: (Citavi Picker) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohgndokldibnndfnjnagojmheejlengn [2014-05-25]
CHR Extension: (Google Mail) - C:\Users\Alina\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-10-25]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - D:\Pickers\Chrome\ChromePicker.crx [2014-02-07]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [1021008 2014-08-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [149296 2014-08-04] (Avira Operations GmbH & Co. KG)
S2 MBAMScheduler; C:\ Malwarebytes Anti-Malware \mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\ Malwarebytes Anti-Malware \mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-28] ()
R2 serverqqs; C:\Program Files (x86)\QQS\serverqqs.exe [712280 2014-01-26] ()
R2 windowsvnew; C:\Program Files (x86)\windowsvnew\windowsclnew.exe [36384 2014-08-15] ()

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 AiCharger; C:\Windows\SysWOW64\DRIVERS\AiCharger.sys [16768 2011-09-20] (ASUSTek Computer Inc.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-07-07] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-06-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-14] (Avira Operations GmbH & Co. KG)
R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 17:39 - 2014-08-27 17:39 - 00000818 _____ () C:\Users\Alina\Desktop\checkup.txt
2014-08-27 08:48 - 2014-08-27 08:48 - 00854417 _____ () C:\Users\Alina\Downloads\SecurityCheck.exe
2014-08-26 12:08 - 2014-08-26 12:08 - 02347384 _____ (ESET) C:\Users\Alina\Downloads\esetsmartinstaller_deu.exe
2014-08-26 12:08 - 2014-08-26 12:08 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-24 12:44 - 2014-08-24 12:44 - 00000000 ____D () C:\Users\Alina\AppData\Local\{5AA7F958-02CF-4A08-990A-74AE734D92D6}
2014-08-23 21:47 - 2014-08-23 21:47 - 00049461 _____ () C:\Users\Alina\Desktop\FRST.txt
2014-08-23 21:47 - 2014-08-23 21:47 - 00040691 _____ () C:\Users\Alina\Desktop\Addition.txt
2014-08-23 20:57 - 2014-08-27 17:40 - 00000000 ____D () C:\Users\Alina\Downloads\FRST-OlderVersion
2014-08-17 19:58 - 2014-08-26 10:09 - 00000260 _____ () C:\Windows\windrun.ini
2014-08-17 18:26 - 2014-08-21 21:37 - 00000000 ____D () C:\Windows\windrun
2014-08-16 15:45 - 2014-08-16 15:45 - 01361203 _____ () C:\Users\Alina\Downloads\adwcleaner_3.306.exe
2014-08-16 09:48 - 2014-08-16 09:48 - 00000000 ____D () C:\Program Files (x86)\windowsvnew
2014-08-14 14:50 - 2014-08-18 07:58 - 00000000 ____D () C:\AdwCleaner
2014-08-14 14:50 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-14 14:47 - 2014-08-14 14:47 - 00001753 _____ () C:\Users\Alina\Desktop\mbam.txt
2014-08-13 22:01 - 2014-07-01 00:24 - 00008856 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-13 22:01 - 2014-07-01 00:14 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-13 22:01 - 2014-06-06 08:16 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-13 22:01 - 2014-06-06 08:12 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-13 22:01 - 2014-03-09 23:48 - 01389208 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-13 22:01 - 2014-03-09 23:48 - 00171160 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-13 22:01 - 2014-03-09 23:47 - 00619672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-13 22:01 - 2014-03-09 23:47 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-13 21:27 - 2014-08-26 10:50 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-13 21:26 - 2014-08-13 21:26 - 00000703 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ Malwarebytes Anti-Malware 
2014-08-13 21:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-13 21:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-13 21:26 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-13 21:21 - 2014-08-13 21:22 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Alina\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-13 14:16 - 2014-08-01 01:41 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-13 14:16 - 2014-08-01 01:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-13 14:16 - 2014-07-25 16:52 - 23645696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-13 14:16 - 2014-07-25 16:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-13 14:16 - 2014-07-25 16:01 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-08-13 14:16 - 2014-07-25 15:51 - 17524224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-13 14:16 - 2014-07-25 15:30 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-13 14:16 - 2014-07-25 15:28 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-13 14:16 - 2014-07-25 15:28 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-08-13 14:16 - 2014-07-25 15:25 - 02774528 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-13 14:16 - 2014-07-25 15:25 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-08-13 14:16 - 2014-07-25 15:11 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-13 14:16 - 2014-07-25 15:10 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-13 14:16 - 2014-07-25 15:04 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-13 14:16 - 2014-07-25 15:03 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-13 14:16 - 2014-07-25 15:00 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-13 14:16 - 2014-07-25 15:00 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-08-13 14:16 - 2014-07-25 14:59 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-08-13 14:16 - 2014-07-25 14:47 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-08-13 14:16 - 2014-07-25 14:40 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-13 14:16 - 2014-07-25 14:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-13 14:16 - 2014-07-25 14:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-13 14:16 - 2014-07-25 14:33 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-08-13 14:16 - 2014-07-25 14:30 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-08-13 14:16 - 2014-07-25 14:28 - 05824512 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-13 14:16 - 2014-07-25 14:28 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-08-13 14:16 - 2014-07-25 14:21 - 02184704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-13 14:16 - 2014-07-25 14:19 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-13 14:16 - 2014-07-25 14:18 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-13 14:16 - 2014-07-25 14:17 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-13 14:16 - 2014-07-25 14:17 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-13 14:16 - 2014-07-25 14:12 - 00438784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-13 14:16 - 2014-07-25 14:10 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-13 14:16 - 2014-07-25 14:10 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-13 14:16 - 2014-07-25 14:08 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-08-13 14:16 - 2014-07-25 14:06 - 04204032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-13 14:16 - 2014-07-25 13:52 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-13 14:16 - 2014-07-25 13:47 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-13 14:16 - 2014-07-25 13:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-08-13 14:16 - 2014-07-25 13:42 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-13 14:16 - 2014-07-25 13:39 - 02087936 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-13 14:16 - 2014-07-25 13:39 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-08-13 14:16 - 2014-07-25 13:36 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-13 14:16 - 2014-07-25 13:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-13 14:16 - 2014-07-25 13:29 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-13 14:16 - 2014-07-25 13:23 - 13547008 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-13 14:16 - 2014-07-25 13:13 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-13 14:16 - 2014-07-25 13:07 - 02001920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-13 14:16 - 2014-07-25 13:07 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-08-13 14:16 - 2014-07-25 13:03 - 11772928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-13 14:16 - 2014-07-25 12:52 - 02266624 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-13 14:16 - 2014-07-25 12:26 - 01431040 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-13 14:16 - 2014-07-25 12:17 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-08-13 14:16 - 2014-07-25 12:09 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-08-13 14:16 - 2014-07-25 12:05 - 01792512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-13 14:16 - 2014-07-25 12:00 - 01169920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-13 14:16 - 2014-07-16 05:25 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-13 14:16 - 2014-07-16 05:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-13 14:16 - 2014-07-16 04:46 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-13 14:16 - 2014-07-16 04:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-13 14:16 - 2014-07-16 04:12 - 03163648 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-08-13 14:16 - 2014-07-09 04:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-08-13 14:16 - 2014-07-09 03:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-08-13 14:16 - 2014-07-09 00:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-08-13 14:16 - 2014-07-09 00:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-08-13 14:16 - 2014-06-25 04:05 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-08-13 14:16 - 2014-06-25 03:41 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-08-13 14:16 - 2014-06-16 04:10 - 00985536 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-13 14:16 - 2014-06-03 12:02 - 03241984 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-13 14:16 - 2014-06-03 12:02 - 01941504 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-13 14:16 - 2014-06-03 12:02 - 00504320 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-13 14:16 - 2014-06-03 12:02 - 00112064 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-13 14:16 - 2014-06-03 11:29 - 02363392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-13 14:16 - 2014-06-03 11:29 - 01805824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-13 14:16 - 2014-06-03 11:29 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-13 14:15 - 2014-08-07 04:06 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-13 14:15 - 2014-08-07 04:01 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-13 14:15 - 2014-07-14 04:02 - 01216000 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-13 14:15 - 2014-07-14 03:40 - 00664064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-12 22:45 - 2014-08-12 22:45 - 00030408 _____ () C:\Users\Alina\Desktop\X.txt
2014-08-12 22:38 - 2014-08-12 22:38 - 00030408 _____ () C:\ComboFix.txt
2014-08-12 22:20 - 2014-08-12 22:38 - 00000000 ____D () C:\Qoobox
2014-08-12 22:20 - 2014-08-12 22:38 - 00000000 ____D () C:\ComboFix
2014-08-12 22:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-12 22:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-12 22:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-12 22:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-12 22:19 - 2014-08-12 22:37 - 00000000 ____D () C:\Windows\erdnt
2014-08-12 22:15 - 2014-08-12 22:19 - 05569662 ____R (Swearware) C:\Users\Alina\Downloads\ComboFix.exe
2014-08-12 17:57 - 2014-08-12 17:57 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95 (1).exe
2014-08-12 17:57 - 2014-08-12 17:57 - 00000700 _____ () C:\Users\Alina\Desktop\Revo Uninstaller.lnk
2014-08-12 17:55 - 2014-08-12 17:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95.exe
2014-08-12 12:54 - 2014-08-12 12:54 - 00066716 _____ () C:\Users\Alina\Desktop\AVSCAN-20140807-174049-37AFBB3B.LOG
2014-08-12 12:51 - 2014-08-12 12:51 - 00007924 _____ () C:\Users\Alina\Desktop\Gmer.txt
2014-08-12 12:33 - 2014-08-12 12:33 - 00380416 _____ () C:\Users\Alina\Downloads\Gmer-19357.exe
2014-08-12 12:26 - 2014-08-12 11:10 - 00000472 _____ () C:\Users\Alina\Desktop\defogger_disable.log
2014-08-12 12:24 - 2014-08-12 12:27 - 00000000 ____D () C:\Users\Alina\Desktop\FRST-Editor+Addition
2014-08-12 11:40 - 2014-08-12 12:19 - 00043712 _____ () C:\Users\Alina\Downloads\Addition.txt
2014-08-12 11:32 - 2014-08-27 17:40 - 00000000 ____D () C:\FRST
2014-08-12 11:32 - 2014-08-12 12:19 - 00029938 _____ () C:\Users\Alina\Downloads\FRST.txt
2014-08-12 11:13 - 2014-08-23 20:57 - 02103296 _____ (Farbar) C:\Users\Alina\Downloads\FRST64.exe
2014-08-12 11:01 - 2014-08-12 11:10 - 00000472 _____ () C:\Users\Alina\Downloads\defogger_disable.log
2014-08-12 11:01 - 2014-08-12 11:01 - 00000000 _____ () C:\Users\Alina\defogger_reenable
2014-08-12 10:54 - 2014-08-12 10:55 - 00050477 _____ () C:\Users\Alina\Downloads\Defogger.exe
2014-08-12 10:32 - 2014-08-12 10:32 - 00005128 _____ () C:\Users\Alina\Downloads\Logs.zip
2014-08-05 13:09 - 2014-08-21 21:43 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-05 13:09 - 2014-08-21 21:43 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-01 12:56 - 2014-05-14 18:23 - 02477536 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-01 12:56 - 2014-05-14 18:23 - 00058336 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-01 12:56 - 2014-05-14 18:23 - 00044512 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-08-01 12:56 - 2014-05-14 18:21 - 02620928 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00700384 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00581600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00038880 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-08-01 12:55 - 2014-05-14 18:23 - 00036320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wups.dll
2014-08-01 12:55 - 2014-05-14 18:20 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-01 12:55 - 2014-05-14 18:17 - 00092672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-01 12:55 - 2014-05-14 09:23 - 00198600 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-01 12:55 - 2014-05-14 09:23 - 00179656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-01 12:55 - 2014-05-14 09:20 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-01 12:55 - 2014-05-14 09:17 - 00033792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-27 17:40 - 2014-08-23 20:57 - 00000000 ____D () C:\Users\Alina\Downloads\FRST-OlderVersion
2014-08-27 17:40 - 2014-08-12 11:32 - 00000000 ____D () C:\FRST
2014-08-27 17:39 - 2014-08-27 17:39 - 00000818 _____ () C:\Users\Alina\Desktop\checkup.txt
2014-08-27 17:36 - 2012-10-25 14:41 - 00001108 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-27 17:36 - 2011-12-27 02:01 - 01121675 _____ () C:\Windows\WindowsUpdate.log
2014-08-27 14:05 - 2012-10-25 14:41 - 00001104 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-27 08:48 - 2014-08-27 08:48 - 00854417 _____ () C:\Users\Alina\Downloads\SecurityCheck.exe
2014-08-26 12:08 - 2014-08-26 12:08 - 02347384 _____ (ESET) C:\Users\Alina\Downloads\esetsmartinstaller_deu.exe
2014-08-26 12:08 - 2014-08-26 12:08 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-08-26 11:03 - 2011-02-19 06:24 - 00711078 _____ () C:\Windows\system32\perfh007.dat
2014-08-26 11:03 - 2011-02-19 06:24 - 00153526 _____ () C:\Windows\system32\perfc007.dat
2014-08-26 11:03 - 2009-07-14 07:13 - 01651372 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-26 10:50 - 2014-08-13 21:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-26 10:19 - 2014-03-05 13:40 - 00000244 _____ () C:\Windows\qqsserver.ini
2014-08-26 10:17 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-26 10:17 - 2009-07-14 06:45 - 00018512 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-26 10:09 - 2014-08-17 19:58 - 00000260 _____ () C:\Windows\windrun.ini
2014-08-26 10:08 - 2011-12-27 02:13 - 00000000 ____D () C:\ProgramData\Temp
2014-08-26 10:07 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-26 10:07 - 2009-07-14 06:45 - 00413624 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-26 10:06 - 2009-07-14 06:51 - 00107166 _____ () C:\Windows\setupact.log
2014-08-24 17:09 - 2013-07-31 18:36 - 00000099 _____ () C:\Users\Public\LMDebug.log
2014-08-24 12:44 - 2014-08-24 12:44 - 00000000 ____D () C:\Users\Alina\AppData\Local\{5AA7F958-02CF-4A08-990A-74AE734D92D6}
2014-08-23 21:47 - 2014-08-23 21:47 - 00049461 _____ () C:\Users\Alina\Desktop\FRST.txt
2014-08-23 21:47 - 2014-08-23 21:47 - 00040691 _____ () C:\Users\Alina\Desktop\Addition.txt
2014-08-23 20:57 - 2014-08-12 11:13 - 02103296 _____ (Farbar) C:\Users\Alina\Downloads\FRST64.exe
2014-08-21 21:43 - 2014-08-05 13:09 - 00001139 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-08-21 21:43 - 2014-08-05 13:09 - 00000000 ____D () C:\ProgramData\Package Cache
2014-08-21 21:43 - 2013-08-09 13:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-08-21 21:43 - 2013-08-09 13:24 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-08-21 21:37 - 2014-08-17 18:26 - 00000000 ____D () C:\Windows\windrun
2014-08-18 07:58 - 2014-08-14 14:50 - 00000000 ____D () C:\AdwCleaner
2014-08-17 18:28 - 2011-12-27 02:10 - 00001485 _____ () C:\Windows\system32\ServiceFilter.ini
2014-08-16 15:45 - 2014-08-16 15:45 - 01361203 _____ () C:\Users\Alina\Downloads\adwcleaner_3.306.exe
2014-08-16 10:00 - 2014-01-23 22:27 - 00000000 ____D () C:\Users\Alina\AppData\Local\Apps\2.0
2014-08-16 09:53 - 2014-03-05 13:29 - 00000000 ____D () C:\Windows\qqsupdate
2014-08-16 09:48 - 2014-08-16 09:48 - 00000000 ____D () C:\Program Files (x86)\windowsvnew
2014-08-14 19:09 - 2012-08-20 12:43 - 00000000 ____D () C:\Users\Alina
2014-08-14 14:47 - 2014-08-14 14:47 - 00001753 _____ () C:\Users\Alina\Desktop\mbam.txt
2014-08-14 11:56 - 2011-10-19 05:20 - 00637788 _____ () C:\Windows\PFRO.log
2014-08-13 22:40 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-13 22:38 - 2012-08-28 21:06 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-13 22:29 - 2013-08-19 10:47 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-13 22:08 - 2012-08-28 21:49 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-13 22:00 - 2014-05-14 14:31 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-08-13 21:43 - 2009-07-29 08:03 - 00000000 ____D () C:\Windows\Panther
2014-08-13 21:26 - 2014-08-13 21:26 - 00000703 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-13 21:26 - 2014-08-13 21:26 - 00000000 ____D () C:\ Malwarebytes Anti-Malware 
2014-08-13 21:22 - 2014-08-13 21:21 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Alina\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-13 15:05 - 2013-01-20 18:13 - 00000000 ____D () C:\Users\Alina\Documents\Wohnung
2014-08-12 22:45 - 2014-08-12 22:45 - 00030408 _____ () C:\Users\Alina\Desktop\X.txt
2014-08-12 22:38 - 2014-08-12 22:38 - 00030408 _____ () C:\ComboFix.txt
2014-08-12 22:38 - 2014-08-12 22:20 - 00000000 ____D () C:\Qoobox
2014-08-12 22:38 - 2014-08-12 22:20 - 00000000 ____D () C:\ComboFix
2014-08-12 22:38 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-08-12 22:37 - 2014-08-12 22:19 - 00000000 ____D () C:\Windows\erdnt
2014-08-12 22:33 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-12 22:19 - 2014-08-12 22:15 - 05569662 ____R (Swearware) C:\Users\Alina\Downloads\ComboFix.exe
2014-08-12 18:39 - 2013-12-30 21:34 - 00000176 _____ () C:\Users\Alina\AppData\Roaming\WB.CFG
2014-08-12 17:57 - 2014-08-12 17:57 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95 (1).exe
2014-08-12 17:57 - 2014-08-12 17:57 - 00000700 _____ () C:\Users\Alina\Desktop\Revo Uninstaller.lnk
2014-08-12 17:55 - 2014-08-12 17:55 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Alina\Downloads\revosetup95.exe
2014-08-12 12:54 - 2014-08-12 12:54 - 00066716 _____ () C:\Users\Alina\Desktop\AVSCAN-20140807-174049-37AFBB3B.LOG
2014-08-12 12:51 - 2014-08-12 12:51 - 00007924 _____ () C:\Users\Alina\Desktop\Gmer.txt
2014-08-12 12:33 - 2014-08-12 12:33 - 00380416 _____ () C:\Users\Alina\Downloads\Gmer-19357.exe
2014-08-12 12:27 - 2014-08-12 12:24 - 00000000 ____D () C:\Users\Alina\Desktop\FRST-Editor+Addition
2014-08-12 12:19 - 2014-08-12 11:40 - 00043712 _____ () C:\Users\Alina\Downloads\Addition.txt
2014-08-12 12:19 - 2014-08-12 11:32 - 00029938 _____ () C:\Users\Alina\Downloads\FRST.txt
2014-08-12 11:10 - 2014-08-12 12:26 - 00000472 _____ () C:\Users\Alina\Desktop\defogger_disable.log
2014-08-12 11:10 - 2014-08-12 11:01 - 00000472 _____ () C:\Users\Alina\Downloads\defogger_disable.log
2014-08-12 11:01 - 2014-08-12 11:01 - 00000000 _____ () C:\Users\Alina\defogger_reenable
2014-08-12 10:55 - 2014-08-12 10:54 - 00050477 _____ () C:\Users\Alina\Downloads\Defogger.exe
2014-08-12 10:32 - 2014-08-12 10:32 - 00005128 _____ () C:\Users\Alina\Downloads\Logs.zip
2014-08-07 04:06 - 2014-08-13 14:15 - 00529920 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-08-07 04:01 - 2014-08-13 14:15 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-08-06 10:42 - 2011-12-27 02:10 - 00002248 _____ () C:\Windows\system32\AutoRunFilter.ini
2014-08-05 13:09 - 2013-08-09 13:24 - 00000000 ____D () C:\ProgramData\Avira
2014-08-05 09:20 - 2012-08-29 09:07 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-08-04 13:45 - 2014-05-25 13:23 - 00000000 ____D () C:\Users\Alina\Documents\Citavi 4
2014-08-04 13:00 - 2009-07-14 07:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-01 01:41 - 2014-08-13 14:16 - 00348856 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-01 01:16 - 2014-08-13 14:16 - 00307384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

Some content of TEMP:
====================
C:\Users\Alina\AppData\Local\Temp\avgnt.exe
C:\Users\Alina\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2013-09-01 13:21

==================== End Of Log ============================
         
--- --- ---

Antwort

Themen zu eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
aartemis, aartemis entfernen, adware/adware.gen, antivirus, branding, computer, converter, device driver, dnsapi.dll, dvdvideosoft ltd., fake mail, flash player, hdd0(c:, helper, homepage, js/toolbar.crossrider.b, mobogenie, mobogenie entfernen, programfilesdir/helper.dll, programm, security, server, software, svchost.exe, viren, win32/dealply.m, win32/savesense.a, windows



Ähnliche Themen: eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen


  1. Windows 7 nach Datei download Virenbefall (ADWARE/SuperFish.342192 und ADWARE/CrossRider.Gen7)
    Log-Analyse und Auswertung - 23.07.2015 (36)
  2. Avira hat Maleware gefunden : ADWARE/Adware.Gen
    Log-Analyse und Auswertung - 09.02.2015 (9)
  3. Windows 8.1:Variant.Adware.Graftor.159320+Adware.Generic.1133960-Virenbefall?
    Log-Analyse und Auswertung - 13.01.2015 (32)
  4. Windows 7: Avira meldet immer wieder ADWARE/Adware.Gen4 bzw. .Gen7, zudem taucht Optimizer Pro immer wieder auf
    Log-Analyse und Auswertung - 14.12.2014 (9)
  5. Adware.Gen7 - Adware/Cherished.oia - Adware/InstallCore.Gen9 - TR/Trash.Gen bei Antivir gefunden
    Plagegeister aller Art und deren Bekämpfung - 03.12.2014 (13)
  6. Win7/Avira meldet ADWARE/Adware.Gen7
    Log-Analyse und Auswertung - 24.11.2014 (8)
  7. Windows 7: ADWARE/CrossRider.Gen4, ADWARE/EoRezo.Gen4 und ADWARE/MPlug 6.14 durch AntiVir gefunden
    Log-Analyse und Auswertung - 22.10.2014 (4)
  8. Win 7: Avira Funde: TR/Urausy.358451 & ADWARE/Adware.Gen2
    Log-Analyse und Auswertung - 07.07.2014 (9)
  9. Trojaner gefunden TR/Dldr.Agent.314440 und verschiedene Adwares ADWARE/EoRezo.AF, ADWARE/Adware.Gen7, ADWARE/AgentCV.A.2919
    Log-Analyse und Auswertung - 02.05.2014 (19)
  10. Win-7: Adware / Virus entfernen - Virenscanner inaktiv - Weiterleitung auf Adware Webseite
    Plagegeister aller Art und deren Bekämpfung - 07.01.2014 (12)
  11. Win 7, 64 Bit, Avira Fund ADWARE/Adware.Gen
    Plagegeister aller Art und deren Bekämpfung - 12.09.2013 (3)
  12. Antivir findet 3 infizierte Dateien 'EXP/Pidief.ej ; 'EXP/Java.HLP.A.1197; ADWARE/Adware.Gen
    Log-Analyse und Auswertung - 09.08.2013 (9)
  13. ADWARE/InstallCore.Gen, ADWARE/Yontoo.Gen und ADWARE/InstallCore.E von AVIRA gefunden
    Plagegeister aller Art und deren Bekämpfung - 16.04.2013 (10)
  14. Absturz Firefox und Funde ADWARE/InstallMat.D, TR/Barys.443.5, ADWARE/Adware.Gen6
    Log-Analyse und Auswertung - 03.01.2013 (19)
  15. USB-Stick enthält Erkennungsmuster der Adware ADWARE/Adware.Gen
    Plagegeister aller Art und deren Bekämpfung - 29.07.2012 (25)
  16. Testbundle23w_1254[1].exe enthält Erkennungsmuster der Adware ADWARE/Adware.GEN
    Plagegeister aller Art und deren Bekämpfung - 22.04.2012 (5)
  17. PC von Adware.Agent.ZGen, Adware.ClickPotato, Adware.ShopperReports, Adware.Hotbar, Adwa angegriffen
    Mülltonne - 30.06.2011 (0)

Zum Thema eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen - Hallo, ich habe eine Fake Mail von eBay bekommen. Den ZIP Anhang runtergeladen aber dann nicht mehr geöffnet. Dann Avira durchlaufen lassen, da ich erste zweifel an der Richtigkeit der - eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen...
Archiv
Du betrachtest: eBay-Fake eMail mit ZIP Anhang gespeichert, Windows 7- Avira: Enthält Erkennungsmuster der Adware ADWARE/Adware.Gen auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.