TR/ATRAPS.Gen2 Virus/Trojaner

HaukeR · 17.09.2013, 20:02

Hallo

ich hab seit gestern den Trojaner TR/ATRAPS.Gen2 (Gefunden in: "C:\Windows\Installer\{45be79ef-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000064.@" und in "C:\Windows\Installer\{45be79ef-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000032.@")
und habe mich auch erst gestern in diesem Forum registriert

Ich habe das Programm Avira Internet Security 2012 welches mich auf den Trojaner hingewiesen hat
habe auch versucht ihn zu löschen aber es ist nun in Quarantäne verschoben
da ich selber keine Ahnung hab wie ich damit umgehen soll und ich nicht weiß was ich machen soll frag ich euch

LG Hauke

schrauber · 17.09.2013, 20:40

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

HaukeR · 17.09.2013, 21:34

FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by marita1 (administrator) on MARITA-PC on 17-09-2013 22:19:19
Running from C:\Users\marita1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(AMD) C:\windows\system32\atieclxx.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Spotify Ltd) C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Bake Cake) C:\Users\marita1\AppData\Roaming\Movdap\WebCakeDesktop.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
() C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2.exe
() C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2-ui.exe
() C:\windows\SysWOW64\PnkBstrA.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Nokia) C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe
(Iminent) C:\Program Files (x86)\Iminent\IMBooster\IMBooster.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Avira Operations GmbH & Co. KG) c:\program files (x86)\avira\antivir desktop\avscan.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11448424 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1894696 2010-01-07] (Synaptics Incorporated)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4462496 2010-04-12] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056800 2010-03-18] (Lenovo (Beijing) Limited)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-15] (Spotify Ltd)
HKCU\...\Run: [Epson Stylus Office BX305(Netzwerk)] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\Users\marita1\AppData\Local\Temp\E_S5ACD.tmp" /EF "HKCU"
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [EADM] - E:\GAMES\Origin\Origin.exe [3549528 2013-08-30] (Electronic Arts)
HKCU\...\Run: [Clownfish] - "C:\Program Files (x86)\Clownfish\Clownfish.exe"
HKCU\...\Run: [WebCake Desktop] - C:\Users\marita1\AppData\Roaming\Movdap\WebCakeDesktop.exe [52504 2013-08-12] (Bake Cake)
HKCU\...\Run: [ImpulseFastStart] - C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [331BigDog] - C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2009-09-15] (Vimicro)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [365936 2010-05-28] ( )
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-11-25] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-06-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [NokiaMServer] - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup [x]
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe [132608 2009-03-30] ()
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [395144 2011-05-17] (Ask)
HKLM-x32\...\Run: [SweetIM] - C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe [114992 2011-06-02] (SweetIM Technologies Ltd.)
HKLM-x32\...\Run: [IMBooster] - C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe [1324008 2011-03-30] (Iminent)
HKLM-x32\...\Run: [ROC_roc_dec12] - "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 [x]
HKLM-x32\...\Run: [FUFAXSTM] - C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348624 2012-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKU\Marita\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [366024 2011-06-29] (IncrediMail, Ltd.)
HKU\Marita\...\Run: [JumiController] - [x]
HKU\Marita\...\Run: [] - [x]
HKU\Marita\...\Run: [NokiaOviSuite2] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [703360 2011-01-31] (Nokia)
HKU\Marita\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1602984 2013-02-25] (Valve Corporation)
HKU\Marita\...\Run: [Akamai NetSession Interface] - C:\Users\Marita\AppData\Local\Akamai\netsession_win.exe [3329824 2012-02-02] (Akamai Technologies, Inc)
HKU\Marita\...\Run: [EPSON BX305 Series] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S5E94.tmp" /EF "HKCU"
HKU\Marita\...\Run: [Epson Stylus Office BX305(Netzwerk)] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S87C5.tmp" /EF "HKCU"
HKU\Marita\...\Policies\system: [DisableTaskMgr] 1
HKU\Marita\...\Policies\system: [DisableRegistryTools] 1
HKU\Marita\...\Policies\Explorer: [NoDesktop] 1
HKU\Marita\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION 
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Manager] - C:\Users\Marita.Marita-PC\M-50-8964-7854-4678\winmgr.exe [213504 2012-09-02] ()
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Service] - C:\Users\Marita.Marita-PC\M-25-6788-7854-2457\winmgr.exe [183808 2012-08-28] ()
HKU\Marita.Marita-PC\...\Run: [Spotify] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-25] (Spotify Ltd)
HKU\Marita.Marita-PC\...\Run: [Spotify Web Helper] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-25] ()
HKU\Marita.Marita-PC\...\Run: [Windows Firewall] - C:\Users\Marita.Marita-PC\AppData\Local\89776623\svchosts.exe [42496 2012-09-09] ()
HKU\Marita.Marita-PC\...\CurrentVersion\Windows: [Load] C:\Users\MARITA~1.MAR\LOCALS~1\Temp\msuoawy.com <===== ATTENTION
AppInit_DLLs-x32: c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll  [2162280 2012-12-14] ()
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
ShortcutTarget: Product Registration.lnk -> C:\Users\marita1\AppData\Local\Temp\is-VR3KQ.tmp\ATR1.exe (No File)
Startup: C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=hp&installDate={installDate}
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&q={searchTerms}&installDate={installDate}
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://isearch.babylon.com/?affID=116634&tt=5112_8&babsrc=HP_ss&mntrId=aa776832000000000000ac8112101eb2
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&q={searchTerms}&installDate={installDate}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.chatzum.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
URLSearchHook: ATTENTION ==> Default URLSearchHook is missing.
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2629906
SearchScopes: HKLM-x32 - {EEE6C360-6118-11DC-9C72-001320C79847} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKCU - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&q={searchTerms}&installDate={installDate}
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&q={searchTerms}&installDate={installDate}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://isearch.babylon.com/?q={searchTerms}&affID=116634&tt=5112_8&babsrc=SP_ss&mntrId=aa776832000000000000ac8112101eb2
SearchScopes: HKCU - {47AE1BA9-0BD1-44F4-88AE-45F8F7B605EF} URL = hxxp://www.basicserve.com/?prt=bscsrvlink5&sp=&keywords={searchTerms}
SearchScopes: HKCU - {96bd48dd-741b-41ae-ac4a-aff96ba00f7e} URL = hxxp://search.chatzum.com/?q={SearchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Funload.de Toolbar - {0f369707-379f-46df-a5c5-d04390f3459b} - C:\Program Files (x86)\Funload.de\tbFunl.dll (Conduit Ltd.)
BHO-x32: Facebook Connect - {11DCAFD6-DDBA-4ADA-998B-996B7B691AE0} - C:\Users\Marita\AppData\Roaming\FBConnect\IE\FBConnect.dll (Facebook Inc.)
BHO-x32: Shopping Assistant Plugin - {1631550F-191D-4826-B069-D9439253D926} - C:\Program Files (x86)\PriceGong\2.5.0\PriceGongIE.dll (PriceGong)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: WebCake - {2A5A2A90-3B30-4E6E-A955-2F232C6EF517} - C:\Program Files (x86)\Movdap\WebCakeIEClient.dll (Let Them Eat Web-Cake LLC)
BHO-x32: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\bh\BabylonToolbar.dll (Babylon BHO)
BHO-x32: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: IMinent WebBooster (BHO) - {A09AB6EB-31B5-454C-97EC-9B294D92EE2A} - C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (Iminent)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: IncrediMail MediaBar 2 Toolbar - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Program Files (x86)\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: DVDVideoSoft WebPageAdjuster Class - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll (DVDVideoSoft Ltd.)
BHO-x32: SweetIM Toolbar Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
Toolbar: HKLM-x32 - ICQToolBar - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files (x86)\ICQ6Toolbar\ICQToolBar.dll No File
Toolbar: HKLM-x32 - IncrediMail MediaBar 2 Toolbar - {d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0} - C:\Program Files (x86)\IncrediMail_MediaBar_2\tbIncr.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files (x86)\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Funload.de Toolbar - {0f369707-379f-46df-a5c5-d04390f3459b} - C:\Program Files (x86)\Funload.de\tbFunl.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - SweetIM Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKLM-x32 - DVDVideoSoftTB DE Toolbar - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - ChatZum Toolbar - {37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - C:\Program Files (x86)\ChatZum Toolbar\tbunscA242.tmp\tbcore3.dll ()
Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarTlbr.dll (Babylon Ltd.)
Toolbar: HKCU -  No Name - {0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} -  No File
Toolbar: HKCU -  No Name - {0F369707-379F-46DF-A5C5-D04390F3459B} -  No File
Toolbar: HKCU -  No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU -  No Name - {D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} -  No File
Toolbar: HKCU -  No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Toolbar: HKCU -  No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File
Toolbar: HKCU -  No Name - {37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} -  No File
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 08 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 05 mswsock.dll File Not found ()
Winsock: Catalog9 06 mswsock.dll File Not found ()
Winsock: Catalog9 07 mswsock.dll File Not found ()
Winsock: Catalog9 08 mswsock.dll File Not found ()
Winsock: Catalog9 09 mswsock.dll File Not found ()
Winsock: Catalog9 10 mswsock.dll File Not found ()
Winsock: Catalog9 11 mswsock.dll File Not found ()
Winsock: Catalog9 12 mswsock.dll File Not found ()
Winsock: Catalog9 13 mswsock.dll File Not found ()
Winsock: Catalog9 14 mswsock.dll File Not found ()
Winsock: Catalog9 15 mswsock.dll File Not found ()
Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 08 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9-x64 05 mswsock.dll File Not found ()
Winsock: Catalog9-x64 06 mswsock.dll File Not found ()
Winsock: Catalog9-x64 07 mswsock.dll File Not found ()
Winsock: Catalog9-x64 08 mswsock.dll File Not found ()
Winsock: Catalog9-x64 09 mswsock.dll File Not found ()
Winsock: Catalog9-x64 10 mswsock.dll File Not found ()
Winsock: Catalog9-x64 11 mswsock.dll File Not found ()
Winsock: Catalog9-x64 12 mswsock.dll File Not found ()
Winsock: Catalog9-x64 13 mswsock.dll File Not found ()
Winsock: Catalog9-x64 14 mswsock.dll File Not found ()
Winsock: Catalog9-x64 15 mswsock.dll File Not found ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default
FF user.js: detected! => C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\user.js
FF NewTab: hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=nt&installDate={installDate}&q=
FF SelectedSearchEngine: Search the web (Babylon)
FF Homepage: hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=hp&installDate={installDate}
FF Keyword.URL: hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&installDate={installDate}&q=
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\searchplugins\babylon1.xml
FF SearchPlugin: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\searchplugins\BrowserProtect.xml
FF SearchPlugin: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\searchplugins\Web Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Battlefield Play4Free - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\battlefieldplay4free@ea.com
FF Extension: Babylon Toolbar - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\ffxtlbr@babylon.com
FF Extension: WebCake - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\plugin@getwebcake.com
FF Extension: No Name - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\WebSiteRecommendation@weliketheweb.com
FF Extension: gophoto - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\gophoto@gophoto.it.xpi
FF Extension: movie2kdownloader - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\movie2kdownloader@movie2kdownloader.com.xpi
FF Extension: torntv - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\torntv@torntv.com.xpi
FF Extension: BasicServe - C:\Program Files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Firefox\Extensions: [{ACAA314B-EEBA-48e4-AD47-84E31C44796C}] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF Extension: No Name - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF HKCU\...\Firefox\Extensions: [{58bd07eb-0ee0-4df0-8121-dc9b693373df}] - C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension
FF Extension: BrowserProtect - C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\marita1\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj\1.9_0
CHR HKLM-x32\...\Chrome\Extension: [blaofbhgbmeikidhlkmjhbkbfohpgekf] - C:\Program Files (x86)\Movie2KDownloader.com\Movie2KDownloader10.crx
CHR HKLM-x32\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Users\marita1\AppData\Roaming\BabSolution\CR\BabylonChrome1.crx
CHR HKLM-x32\...\Chrome\Extension: [jbpkiefagocgkmemidfngdkamloieekf] - C:\Program Files (x86)\TornTV.com\torn11.crx
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx
CHR HKLM-x32\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-15] (Akamai Technologies, Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [619472 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 BrowserProtect; C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [2469992 2012-12-14] ()
R2 Hamachi2Svc; C:\LogMeIn Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
S2 ICQ Service; C:\Program Files (x86)\ICQ6Toolbar\ICQ Service.exe [247096 2010-09-06] ()
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-11-19] ()
R2 UI Assistant Service; C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [241664 2009-03-30] ()
S2 WebCakeUpdater; C:\Program Files (x86)\Movdap\WBDesktop.Updater.exe [51992 2013-08-12] (cake bake)

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-08-01] ()
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114128 2012-05-22] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [139360 2012-05-22] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-22] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-22] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-10-11] (Avira GmbH)
R3 jumi; C:\Windows\System32\DRIVERS\jumi.sys [15160 2010-06-03] (Windows (R) Codename Longhorn DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2011-01-05] ()
S0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77688 2006-07-05] (Protection Technology (StarForce))
S0 sfsync02; C:\Windows\System32\drivers\sfsync02.sys [22936 2006-07-10] (Protection Technology)
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [106360 2007-01-12] (Protection Technology (StarForce))
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [207232 2009-11-09] (Vimicro Corporation)
U3 BcmSqlStartupSvc; 
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
U2 IAStorDataMgrSvc; 
U3 IGRS; 
U2 IviRegMgr; 
U2 ReadyComm.DirectRouter; 
U2 RichVideo; 
U3 SQLWriter; 
S3 X6va008; \??\C:\windows\SysWOW64\Drivers\X6va008 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-17 15:47 - 2013-09-17 15:47 - 00003432 _____ C:\windows\System32\Tasks\BrowserProtect
2013-09-16 20:31 - 2013-09-16 20:31 - 00000340 _____ C:\windows\PFRO.log
2013-09-16 19:27 - 2013-09-17 21:21 - 00001786 _____ C:\windows\setupact.log
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 14:22 - 2013-09-16 16:23 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:09 - 2013-09-16 14:11 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-13 18:17 - 2013-09-13 18:17 - 00000000 ____D C:\Users\marita1\AppData\Local\{12A6E36D-03AC-4149-85CD-F93B5EC537A3}
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-12 20:43 - 2013-09-12 20:43 - 00000000 ____D C:\Users\marita1\AppData\Local\{8381CE2B-FC31-430B-9D30-4B9135702839}
2013-09-12 14:41 - 2013-09-12 17:17 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-11 21:33 - 2013-09-11 21:33 - 00000000 ____D C:\Users\marita1\AppData\Local\{743668C0-2D9F-485F-B54C-C0797536F8E6}
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-12 21:44 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 16:20 - 2013-09-13 16:22 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-04 22:12 - 2013-09-07 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-04 22:06 - 2013-09-07 13:55 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-03 19:36 - 2013-09-10 14:09 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock

==================== One Month Modified Files and Folders =======

2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:17 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-17 22:17 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-17 22:16 - 2012-09-09 20:01 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Skype
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-17 22:08 - 2012-08-20 18:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-17 22:05 - 2011-01-05 17:45 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-17 22:05 - 2011-01-05 17:45 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-17 21:21 - 2013-09-16 19:27 - 00001786 _____ C:\windows\setupact.log
2013-09-17 21:01 - 2013-08-12 15:17 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Movdap
2013-09-17 20:50 - 2012-09-10 19:55 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Spotify
2013-09-17 20:32 - 2010-12-25 00:13 - 09082664 _____ C:\FaceProv.log
2013-09-17 20:32 - 2010-11-25 11:29 - 00000000 ____D C:\ProgramData\VeriFace
2013-09-17 15:50 - 2012-09-09 17:55 - 00000000 ____D C:\Users\marita1\AppData\Local\LogMeIn Hamachi
2013-09-17 15:47 - 2013-09-17 15:47 - 00003432 _____ C:\windows\System32\Tasks\BrowserProtect
2013-09-17 15:46 - 2013-08-09 18:23 - 00000340 _____ C:\windows\Tasks\spmonitor.job
2013-09-17 15:46 - 2013-08-09 18:23 - 00000262 _____ C:\windows\Tasks\SpeedUpMyPC.job
2013-09-17 15:46 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-16 20:31 - 2013-09-16 20:31 - 00000340 _____ C:\windows\PFRO.log
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 17:08 - 2011-05-21 20:09 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-16 16:23 - 2013-09-16 14:22 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:11 - 2013-09-16 14:09 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-14 17:09 - 2010-11-25 10:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-14 17:07 - 2010-11-25 11:34 - 00000000 ____D C:\windows\SysWOW64\Macromed
2013-09-13 21:10 - 2012-08-20 18:38 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 21:10 - 2012-08-20 18:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 21:10 - 2011-07-07 10:32 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 18:17 - 2013-09-13 18:17 - 00000000 ____D C:\Users\marita1\AppData\Local\{12A6E36D-03AC-4149-85CD-F93B5EC537A3}
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-13 16:22 - 2013-09-11 16:20 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-12 21:44 - 2013-09-11 20:53 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-12 20:43 - 2013-09-12 20:43 - 00000000 ____D C:\Users\marita1\AppData\Local\{8381CE2B-FC31-430B-9D30-4B9135702839}
2013-09-12 17:17 - 2013-09-12 14:41 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-12 14:48 - 2010-11-25 02:09 - 00723232 _____ C:\windows\system32\perfh007.dat
2013-09-12 14:48 - 2010-11-25 02:09 - 00158372 _____ C:\windows\system32\perfc007.dat
2013-09-12 14:48 - 2009-07-14 07:13 - 01674052 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-12 14:22 - 2012-09-10 20:06 - 00000000 ____D C:\Users\marita1\AppData\Local\Spotify
2013-09-11 21:33 - 2013-09-11 21:33 - 00000000 ____D C:\Users\marita1\AppData\Local\{743668C0-2D9F-485F-B54C-C0797536F8E6}
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 19:42 - 2012-09-19 22:28 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.minecraft
2013-09-11 16:22 - 2012-10-05 20:58 - 00000000 ____D C:\Users\marita1\AppData\Local\Adobe
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-11 16:20 - 2010-11-25 11:25 - 00000000 ____D C:\ProgramData\McAfee
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-10 14:09 - 2013-09-03 19:36 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:39 - 2012-09-09 17:52 - 00000000 ____D C:\Users\marita1
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-07 18:24 - 2013-09-04 22:12 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-07 13:55 - 2013-09-04 22:06 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-04 22:07 - 2012-12-21 22:10 - 00000000 ____D C:\Users\marita1\AppData\Local\craften.de
2013-09-03 17:24 - 2012-09-09 21:01 - 00000000 ___RD C:\Users\marita1\Desktop\Hauke
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-27 17:30 - 2013-08-09 18:22 - 00000000 ____D C:\ProgramData\BasicServe
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:31 - 2013-02-21 18:32 - 00000000 ____D C:\Users\marita1\Documents\My Games
2013-08-22 18:31 - 2012-10-24 17:22 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock
2013-08-22 14:16 - 2013-07-29 13:42 - 00000000 ____D C:\Users\marita1\Documents\Flight Simulator X-Dateien

ZeroAccess:
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000008.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\000000cb.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000000.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000032.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000064.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\00000004.@
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\201d3dde
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\55490ac4
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\6715e287
C:\Windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\76603ac3

ZeroAccess:
C:\Windows\assembly\GAC_32\Desktop.ini

ZeroAccess:
C:\Windows\assembly\GAC_64\Desktop.ini

ZeroAccess:
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\000000cb.@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000000.@

Files to move or delete:
====================
C:\Users\Marita\jagex_cl_runescape_LIVE.dat
C:\Users\Marita\jagex_runescape_preferences.dat
C:\Users\Marita\jagex_runescape_preferences2.dat


Some content of TEMP:
====================
C:\Users\Marita\AppData\Local\Temp\AutoRun.exe
C:\Users\Marita\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Marita\AppData\Local\Temp\CommonInstaller.exe
C:\Users\Marita\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\Marita\AppData\Local\Temp\SIntf16.dll
C:\Users\Marita\AppData\Local\Temp\SIntf32.dll
C:\Users\Marita\AppData\Local\Temp\SIntfNT.dll
C:\Users\Marita\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Marita\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Marita\AppData\Local\Temp\_is8739.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0019950509.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0083795890.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0092204845.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0194115915.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0204615950.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0237807739.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0261280905.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0424301933.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0486422955.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0607712876.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0656029986.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0888791205.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0905787831.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0921446088.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\0992319892.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1025410237.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1097865050.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1190522707.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1320667477.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1321078725.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1335537959.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\13aaef93.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\13ab155b.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1478839807.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1723763616.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1746247688.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1753716617.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1765137119.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1910025079.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1953706266.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\1986443114.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2011428299.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2062940401.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2076180993.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2081714797.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2129011819.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2553657153.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2826103887.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2884572958.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\2884852476.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3148497172.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3223951462.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3336786715.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3342504996.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3374776066.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3472706609.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\3661097348.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4040184354.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4112251747.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4135750519.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4136640174.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4152560473.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4187548791.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4308641180.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4365906535.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4382408468.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4403828974.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4448941504.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4516431648.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4546150285.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4588070686.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\4622908127.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5033290225.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5117457015.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5179973243.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5196400809.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5222475009.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5271165021.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5552286218.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5768053990.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5865296992.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5897214845.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\5930483352.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6052623963.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6109388656.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6199868666.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6259548562.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6265278065.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6359347248.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6435706291.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6474154024.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6577367573.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6645139320.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6714926874.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6805432678.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6832049503.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\6942079414.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7069860691.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7088103522.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7103109791.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7110704106.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7116472127.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7136968345.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7225164194.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7225517533.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7324310258.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7391344717.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7438875570.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7449377295.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7596363080.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7774564226.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7895435858.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7923873665.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\7960201420.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8001472408.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8018679363.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8025484104.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8040061397.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\812668.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8192076619.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8219968603.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8224747475.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8238251039.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8242536923.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8253312899.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8304613493.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8369624948.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8529603479.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8601338903.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8874496261.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8893697619.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\8985996376.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9197015471.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9216928342.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9217283249.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9220703837.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9229377293.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9451808932.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9688996447.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9720590821.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9755609096.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9795136236.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9807176576.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9837841496.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\9897743000.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\AutoRun.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\AutoRunGUI.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\CheatEngine62Clean.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\drm_dyndata_7370007.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\incredibar_installer.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\jansi-32-git-Bukkit-1.2.5-R4.0-b2222jnks.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\jansi-32-git-Bukkit-1.3.1-R1.0-b2320jnks.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\MyBabylonTB_google_20120807.exe
C:\Users\Marita.Marita-PC\AppData\Local\Temp\SIntf16.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\SIntf32.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\SIntfNT.dll
C:\Users\Marita.Marita-PC\AppData\Local\Temp\SkypeSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe 014A9CB92514E27C0107614DF764BC06 ZeroAccess <==== ATTENTION!.
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 10:51

==================== End Of Log ============================

--- --- ---

Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 16-09-2013 03
Ran by marita1 at 2013-09-17 22:24:13
Running from C:\Users\marita1\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.174)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168)
ANNO 2070 (x32 Version: 1.0.0.0)
Apple Mobile Device Support (Version: 5.2.0.6)
ATI Catalyst Install Manager (Version: 3.0.786.0)
Audacity 2.0.4 (x32 Version: 2.0.4)
BasicServe 1.0 build 113 (x32)
Blender (Version: 2.68a)
Bonjour (Version: 3.0.0.10)
ccc-utility64 (Version: 2010.0719.1349.22889)
CCleaner (Version: 4.03)
Craften Terminal 3.4.4997.36376 (x32 Version: 3.4.4997.36376)
Darkstar One (x32)
EPSON BX305 Series Printer Uninstall
Galactic Civilizations II - Ultimate Edition (x32)
GameSpy Arcade (x32)
Impulse (x32 Version: 1.0)
Impulse (x32)
iTunes (Version: 10.6.3.25)
LAME v3.99.3 (for Windows) (x32)
Lenovo OneKey Recovery (Version: 7.0.1230)
Mass Effect (x32 Version: 1.00)
McAfee Security Scan Plus (x32 Version: 3.0.318.3)
MDK2 (x32)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Silverlight (Version: 5.1.10411.0)
Microsoft Visual C++ 2005 Redistributable (x32)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVCRT Redists (Version: 1.0)
Shockwave (x32)
Sins of a Solar Empire (x32 Version: 1.05)
Sins of a Solar Empire (x32)
SpeedUpMyPC (x32 Version: 5.3.9.0)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Synaptics Pointing Device Driver (Version: 15.0.2.0)
Ubisoft Game Launcher (x32 Version: 1.0.0.0)
Web Cake 3.00 (Version: 3.00)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows-Treiberpaket - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (Version: 10/19/2009 5.4.0.1)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)

==================== Restore Points  =========================

05-09-2013 07:59:06 Geplanter Prüfpunkt
13-09-2013 17:25:50 Geplanter Prüfpunkt
15-09-2013 19:56:07 DirectX wurde installiert
15-09-2013 19:59:49 Installed Ubisoft Game Launcher

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {02035F3C-6D23-4C6E-95D8-E956C23EA92C} - System32\Tasks\{83EFAFB6-C666-40D3-B67F-A412976F6D80} => E:\HAUKE\GAMES\PTP\PTP.exe [2005-11-04] ()
Task: {044A6734-E90E-4F8F-B357-B2DC8AB3B5EC} - System32\Tasks\Microsoft\Windows\Time Synchronization\SynchronizeTime => Sc.exe start w32time task_started
Task: {09C4BD97-CB31-4D99-9F0E-667C1D3D4825} - System32\Tasks\{562A78CC-E025-47C7-86DC-BCDEF2F4D103} => E:\HAUKE\GAMES\PTP\PTP.exe [2005-11-04] ()
Task: {1E1F105E-408B-46B0-9EEA-E29EB8BADA7F} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-06-19] (Piriform Ltd)
Task: {29C8EF31-8C6B-4337-B68F-1638ECBC10B9} - System32\Tasks\WPD\SqmUpload_S-1-5-21-74344267-1380692144-3618317618-1009 => C:\Windows\System32\portabledeviceapi.dll [2010-11-20] (Microsoft Corporation)
Task: {30E07C28-C679-4720-99D1-09D24B53D5FA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-01-05] (Google Inc.)
Task: {3447C47A-8D06-4697-9CA9-BD7EB8960DF3} - System32\Tasks\{B6DB1259-A026-4C83-B527-234D09510783} => D:\ANNO 1602 Königs-Edition\1602.exe
Task: {4243E62A-7340-4506-A106-9663855AC271} - System32\Tasks\{5D951A4E-814E-43CD-94D9-0B253AF6BE5F} => D:\ANNO 1602\1602.exe
Task: {547EB50B-B454-4A26-A97F-AC954C6E81E2} - System32\Tasks\{E9CE0E38-79B0-46B4-9040-9BD7C91D8658} => D:\AR2\Ra2.exe
Task: {652DADFC-0B36-4F04-AB74-8787E1AA3593} - System32\Tasks\User_Feed_Synchronization-{6837F5AF-AEEC-4541-A802-545F2BC1C287} => C:\windows\system32\msfeedssync.exe [2012-03-16] (Microsoft Corporation)
Task: {6761A540-3154-4CD2-A384-633409EF8C2B} - System32\Tasks\{3B8DAFB0-0FC1-43A3-8E86-179AD3DEABDE} => D:\RPGXP\RPGXP.exe
Task: {6C7D8E25-CCC3-42B0-B594-E83850545067} - System32\Tasks\SpeedUpMyPC => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\sump.exe
Task: {83B3BB88-ED76-4977-8DA7-1EF6A30F3837} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {8DAA59CC-6FB4-4E9C-968A-2C0AEB9EAAD5} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-01-05] (Google Inc.)
Task: {9B8991B2-431C-4D95-944A-7C30ED7AA29D} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {9DD7B54D-250D-4428-B88B-5065766A8FC6} - System32\Tasks\spmonitor => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe
Task: {A9859461-25D5-47BF-A543-D313A4641DE7} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-13] (Adobe Systems Incorporated)
Task: {B06E8CF6-E3A2-4CD8-81A6-F56E7CB4524D} - System32\Tasks\WPD\SqmUpload_S-1-5-21-74344267-1380692144-3618317618-1010 => C:\Windows\System32\portabledeviceapi.dll [2010-11-20] (Microsoft Corporation)
Task: {B7DC38EF-C0A9-4EC0-9B4C-EF6D2298EFEF} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {B96B20D6-EA7F-4CC4-A5B1-47C501D0F11D} - System32\Tasks\{EDE7EA30-F796-4F3F-88AB-DF785308B90A} => E:\Microsoft Games\FS2002\fs2002.exe
Task: {BAD570F8-1CDF-43C0-9587-ED0DB40602E2} - System32\Tasks\{CA9FB637-E9CE-4972-B253-978ECECA635E} => D:\AR2\Ra2.exe
Task: {CC8F474F-8D18-45D4-A82A-9F33DA78B9A1} - System32\Tasks\{FF1C7AC3-4DB6-407F-BD81-674E25D54799} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2013-06-21] (Skype Technologies S.A.)
Task: {DC769F48-2763-44B2-BC5C-75CE596DF37C} - System32\Tasks\{88D2F02E-85AF-4F66-82BB-2C5771218393} => D:\AR2\Ra2.exe
Task: {E1CD394F-FA07-41DC-AE88-62C358957F17} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2011-05-17] ()
Task: {EACB4650-AC33-4C30-90BA-047BD941FE41} - System32\Tasks\{94A2A73C-8617-46B9-80E9-626389E8826E} => D:\ANNO 1602\1602.exe
Task: {EC684F69-57B0-4DA6-AA20-74AF2BD5AF15} - System32\Tasks\{1BA052C2-80BA-424D-9A80-EDD453B8EF53} => D:\AR2\Ra2.exe
Task: {F1E6F1EA-E8C9-487C-825B-4BD142031C7B} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {F7854C5D-FE73-4D57-BD9D-AE9071AACD84} - System32\Tasks\{89105B4F-D868-4DA2-9968-B5AF2FB5445C} => D:\ANNO 1602 Königs-Edition\1602.exe
Task: {F9CE0850-3D34-417C-90EC-57A84BAA468F} - System32\Tasks\Go for FilesUpdate => C:\Program Files (x86)\GoforFiles\GFFUpdater.exe
Task: {FDC3C343-032D-493E-968D-D751D62F3F48} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\SpeedUpMyPC.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\sump.exe
Task: C:\windows\Tasks\spmonitor.job => C:\Program Files (x86)\Uniblue\SpeedUpMyPC\spmonitor.exe

==================== Loaded Modules (whitelisted) =============

2010-11-25 11:29 - 2010-11-25 11:29 - 01502720 _____ () C:\windows\system32\IcnOvrly.dll
2011-05-22 02:29 - 2012-02-17 21:55 - 00193536 _____ () C:\Program Files (x86)\WinRAR\rarext64.dll
2010-11-25 10:50 - 2010-08-20 12:35 - 00149608 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkCfg64.dll
2010-11-25 10:50 - 2010-08-20 12:35 - 02619496 _____ (Realtek Semiconductor Corp.) C:\windows\system32\RtkAPO64.dll
2010-11-25 10:54 - 2010-01-07 14:43 - 00396584 _____ (Synaptics Incorporated) C:\windows\system32\SynCOM.dll
2010-11-25 10:54 - 2010-01-07 14:43 - 00207144 _____ (Synaptics Incorporated) C:\windows\system32\SynTPAPI.dll
2010-11-25 11:41 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll
2010-11-25 11:41 - 2009-07-15 17:55 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll
2011-06-25 15:24 - 2010-11-20 15:27 - 00326144 _____ (Microsoft Corporation) \\.\globalroot\systemroot\system32\mswsock.dll
2011-06-25 15:24 - 2010-11-20 15:27 - 00326144 _____ () C:\windows\system32\mswsock.dll
2011-06-25 15:24 - 2010-11-20 15:27 - 00326144 _____ (Microsoft Corporation) \\?\globalroot\systemroot\system32\mswsock.DLL
2012-12-22 23:08 - 2012-12-14 16:04 - 02162280 _____ () C:\ProgramData\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll
2013-08-17 21:26 - 2013-08-17 21:26 - 00053528 _____ (Tepfel) C:\Users\marita1\AppData\Roaming\Movdap\dat\Desktop.OS.dll
2013-08-18 01:30 - 2013-08-18 01:30 - 00337920 _____ () C:\Users\marita1\AppData\Roaming\Movdap\dat\sqlite3.DLL
2012-08-10 17:51 - 2012-08-10 17:51 - 00985088 _____ () C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
2010-11-25 11:29 - 2010-11-25 11:29 - 00492896 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll
2009-09-07 17:38 - 2009-09-07 17:38 - 00013608 ____N (TODO: <Company name>) C:\Program Files (x86)\Lenovo\YouCam\Custom\Lang\DEU\IM.dll
2011-06-25 15:24 - 2010-11-20 14:19 - 00232448 _____ (Microsoft Corporation) \\?\globalroot\systemroot\syswow64\mswsock.DLL
2011-06-02 15:56 - 2011-06-02 15:56 - 00282928 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00030000 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00270640 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00036656 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00168240 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00074032 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00065840 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll
2011-06-02 15:56 - 2011-06-02 15:56 - 00026928 ____R (SweetIM Technologies Ltd.) C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll
2011-06-25 15:24 - 2010-11-20 14:19 - 00232448 _____ (Microsoft Corporation) \\.\globalroot\systemroot\syswow64\mswsock.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00236520 _____ () C:\Program Files (x86)\Iminent\IMBooster\Iminent.Windows.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00144872 _____ (Iminent) C:\Program Files (x86)\Iminent\IMBooster\Iminent.Business.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00218600 _____ () C:\Program Files (x86)\Iminent\IMBooster\Iminent.Workflow.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00041960 _____ () C:\Program Files (x86)\Iminent\IMBooster\Iminent.Business.TinyUrl.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00337896 _____ () C:\Program Files (x86)\Iminent\IMBooster\Iminent.Booster.UI.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00013288 _____ (Iminent) C:\Program Files (x86)\Iminent\IMBooster\de\IMBooster.resources.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 00016360 _____ () C:\Program Files (x86)\Iminent\IMBooster\de\Iminent.Booster.UI.resources.dll
2011-03-30 16:45 - 2011-03-30 16:45 - 01869288 _____ () C:\Program Files (x86)\Iminent\IMBooster\Iminent.Services.dll
2010-11-17 19:11 - 2010-11-17 19:11 - 00041984 _____ (Iminent) C:\Program Files (x86)\Iminent\IMBooster\Iminent.WinCore.dll
2012-08-24 13:01 - 2012-08-24 13:01 - 00317352 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Resource_de.dll
2012-08-24 13:01 - 2012-08-24 13:01 - 02589096 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_StaticRes.dll
2012-08-24 12:55 - 2012-08-24 12:55 - 00066984 _____ (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.dll
2012-06-07 19:33 - 2012-06-07 19:33 - 00156560 _____ (Apple Inc.) D:\iTunes\iTunesHelper.dll
2010-11-17 14:16 - 2010-11-17 14:16 - 00053024 _____ (Open Source Software community project) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\pthreadVC2.dll
2012-06-07 19:51 - 2012-06-07 19:51 - 00050064 _____ (Apple Inc.) D:\iTunes\iTunesHelper.Resources\de.lproj\iTunesHelperLocalized.DLL
2012-06-07 19:33 - 2012-06-07 19:33 - 00048528 _____ (Apple Inc.) D:\iTunes\iTunesHelper.Resources\iTunesHelper.DLL
2012-05-30 20:06 - 2012-05-30 20:06 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-05-30 20:06 - 2012-05-30 20:06 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2011-08-30 23:05 - 2011-08-30 23:05 - 00085864 _____ (Apple Inc.) C:\windows\system32\dnssd.dll
2012-11-30 04:07 - 2012-11-30 04:07 - 00100248 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
2010-12-26 19:24 - 2012-08-12 20:45 - 45205504 _____ (SRWare) C:\Program Files (x86)\SRWare Iron\iron.dll
2012-09-10 11:43 - 2012-08-02 00:57 - 01195022 _____ () C:\Program Files (x86)\SRWare Iron\avcodec-54.dll
2012-09-10 11:43 - 2012-08-02 00:57 - 00138766 _____ () C:\Program Files (x86)\SRWare Iron\avutil-51.dll
2012-09-10 11:43 - 2012-08-02 00:57 - 00217614 _____ () C:\Program Files (x86)\SRWare Iron\avformat-54.dll
2012-12-24 14:25 - 2012-12-24 14:25 - 00070144 _____ () C:\Users\marita1\AppData\Local\Chromium\User Data\Default\Extensions\pgafcinpmmpklohkojmllohdhomoefph\1.0_0\spext.dll
2010-12-26 19:24 - 2012-08-02 12:56 - 00648704 _____ () C:\Program Files (x86)\SRWare Iron\libglesv2.dll
2010-12-26 19:24 - 2012-08-02 12:59 - 00122880 _____ () C:\Program Files (x86)\SRWare Iron\libegl.dll
2013-09-11 15:15 - 2013-09-11 16:19 - 16177544 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\ProgramData\Temp:05EE1EEF


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (09/17/2013 07:14:18 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 50841

Error: (09/17/2013 07:14:18 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 50841

Error: (09/17/2013 07:14:18 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/17/2013 07:14:17 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 49842

Error: (09/17/2013 07:14:17 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 49842

Error: (09/17/2013 07:14:17 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/17/2013 07:14:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 48844

Error: (09/17/2013 07:14:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 48844

Error: (09/17/2013 07:14:16 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/17/2013 07:14:15 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 47830


System errors:
=============
Error: (09/17/2013 08:31:27 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst MMCSS erreicht.

Error: (09/17/2013 08:31:27 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst lmhosts erreicht.

Error: (09/17/2013 03:50:34 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Heimnetzgruppen-Listener" wurde mit folgendem dienstspezifischem Fehler beendet: %%-2147023143.

Error: (09/17/2013 03:49:41 PM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
sfdrv01a
sfsync02

Error: (09/17/2013 03:48:45 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "WebCakeUpdater" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (09/17/2013 03:48:45 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst WebCakeUpdater erreicht.

Error: (09/17/2013 03:47:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IPsec-Richtlinien-Agent" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (09/17/2013 03:47:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "IKE- und AuthIP IPsec-Schlüsselerstellungsmodule" ist von folgendem Dienst abhängig: BFE. Dieser Dienst ist eventuell nicht installiert.

Error: (09/17/2013 03:47:51 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst ICQ Service erreicht.

Error: (09/17/2013 03:46:56 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1275


Microsoft Office Sessions:
=========================
Error: (09/17/2013 07:14:18 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 50841

Error: (09/17/2013 07:14:18 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 50841

Error: (09/17/2013 07:14:18 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/17/2013 07:14:17 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 49842

Error: (09/17/2013 07:14:17 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 49842

Error: (09/17/2013 07:14:17 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/17/2013 07:14:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 48844

Error: (09/17/2013 07:14:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 48844

Error: (09/17/2013 07:14:16 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (09/17/2013 07:14:15 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 47830


==================== Memory info =========================== 

Percentage of memory in use: 58%
Total physical RAM: 1786.9 MB
Available physical RAM: 745 MB
Total Pagefile: 3760.8 MB
Available Pagefile: 2071.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:188.94 GB) (Free:74.63 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:28.3 GB) NTFS
Drive e: (Transcend) (Fixed) (Total:465.76 GB) (Free:341 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: E07F58CB)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=189 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)

========================================================
Disk: 1 (Size: 466 GB) (Disk ID: 8712D913)
Partition 1: (Not Active) - (Size=466 GB) - (Type=07 NTFS)

==================== End Of Log ============================

schrauber · 18.09.2013, 10:10

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

HaukeR · 18.09.2013, 14:06

Irgendwie geht bei mir rie Installation nicht richtig soll ich die Setup auf dem Desktop haben?

schrauber · 18.09.2013, 18:05

Das ist kein Setup und keine Installation. Das ist ein Standalone Tool, einfach Doppelklick und es läuft.

HaukeR · 18.09.2013, 21:00

Wo finde ich die log Datei von Combofix?

Hab sie gefunden!

Code:

ATTFilter

ComboFix 13-09-17.01 - marita1 18.09.2013  21:12:34.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.1787.693 [GMT 2:00]
ausgeführt von:: c:\users\marita1\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Outdated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Outdated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Install.exe
c:\program files (x86)\Funload.de
c:\program files (x86)\Funload.de\Funload.deToolbarHelper.exe
c:\program files (x86)\Funload.de\GottenAppsContextMenu.xml
c:\program files (x86)\Funload.de\INSTALL.LOG
c:\program files (x86)\Funload.de\OtherAppsContextMenu.xml
c:\program files (x86)\Funload.de\SharedAppsContextMenu.xml
c:\program files (x86)\Funload.de\tbFunl.dll
c:\program files (x86)\Funload.de\toolbar.cfg
c:\program files (x86)\Funload.de\ToolbarContextMenu.xml
c:\program files (x86)\Funload.de\UNWISE.EXE
c:\program files (x86)\Funload.de\UNWISE.INI
c:\program files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}
c:\program files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}\chrome.manifest
c:\program files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}\chrome\basicserve.jar
c:\program files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}\defaults\preferences\prefs.js
c:\program files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}\install.rdf
c:\program files (x86)\PriceGong
c:\program files (x86)\PriceGong\2.5.0\FF\chrome.manifest
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\content\options.js
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\content\options.xul
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\content\overlay.js
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\content\PriceGong.png
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\content\pricegong.xul
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\locale\en-US\overlay.dtd
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\locale\en-US\pricegong.dtd
c:\program files (x86)\PriceGong\2.5.0\FF\chrome\skin\overlay.css
c:\program files (x86)\PriceGong\2.5.0\FF\components\pg_inst.txt
c:\program files (x86)\PriceGong\2.5.0\FF\components\PriceGong.xpt
c:\program files (x86)\PriceGong\2.5.0\FF\components\PriceGongFF.dll
c:\program files (x86)\PriceGong\2.5.0\FF\install.rdf
c:\program files (x86)\PriceGong\2.5.0\FF\modules\Observers.js
c:\program files (x86)\PriceGong\2.5.0\FF\modules\pricegong.js
c:\program files (x86)\PriceGong\2.5.0\PriceGongIE.dll
c:\program files (x86)\PriceGong\uninst.exe
c:\program files (x86)\Windows Live\Messenger\msacm32.dll
c:\programdata\2528213d3b3354382a_c
c:\programdata\BasicServe
c:\programdata\BasicServe\basicserve113.exe
c:\users\Marita\Documents\Downloads\Integrated_CT2629906.exe
c:\users\marita1\AppData\Roaming\Microsoft\Windows\Recent\Cool.url
c:\users\marita1\AppData\Roaming\Microsoft\Windows\Recent\Hauke.url
c:\users\marita1\AppData\Roaming\Microsoft\Windows\Recent\J.url
c:\users\marita1\AppData\Roaming\Microsoft\Windows\Recent\Neue Playlist.url
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\00000004.@
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\201d3dde
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\55490ac4
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\6715e287
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\L\76603ac3
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000008.@
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\000000cb.@
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000000.@
c:\windows\Installer\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000032.@
c:\windows\IsUn0407.exe
c:\windows\s.bat
c:\windows\SysWow64\frapsvid.dll
c:\windows\Tasks\SpeedUpMyPC.job
.
Infizierte Kopie von c:\windows\system32\services.exe wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-08-18 bis 2013-09-18  ))))))))))))))))))))))))))))))
.
.
2013-09-18 19:33 . 2013-09-18 19:33	--------	d-----w-	c:\users\Marita.Marita-PC\AppData\Local\temp
2013-09-18 19:33 . 2013-09-18 19:33	--------	d-----w-	c:\users\Marita\AppData\Local\temp
2013-09-18 19:33 . 2013-09-18 19:33	--------	d-----w-	c:\users\Marita.Marita-PC.000\AppData\Local\temp
2013-09-18 19:33 . 2013-09-18 19:33	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-09-18 19:18 . 2013-09-18 19:18	69000	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{B6ACEC5F-D0A3-497A-88C6-639BCA64369C}\offreg.dll
2013-09-18 19:03 . 2012-06-29 10:04	9133488	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{B6ACEC5F-D0A3-497A-88C6-639BCA64369C}\mpengine.dll
2013-09-17 20:18 . 2013-09-17 20:18	--------	d-----w-	C:\FRST
2013-09-15 20:00 . 2013-09-15 20:00	--------	d-----w-	c:\program files (x86)\Ubisoft
2013-09-14 15:08 . 2000-01-04 04:39	212992	----a-w-	c:\program files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ILog.dll
2013-09-11 19:28 . 2013-09-11 19:28	--------	d-----w-	c:\program files (x86)\Lame For Audacity
2013-09-11 18:53 . 2013-09-12 19:44	--------	d-----w-	c:\users\marita1\AppData\Roaming\Audacity
2013-09-11 14:20 . 2013-09-11 14:20	--------	d-----w-	c:\programdata\McAfee Security Scan
2013-09-11 14:20 . 2013-09-13 14:22	--------	d-----w-	c:\program files (x86)\McAfee Security Scan
2013-09-10 17:40 . 2013-09-10 17:40	--------	d-----w-	c:\users\marita1\AppData\Roaming\Blender Foundation
2013-09-09 19:39 . 2013-09-09 19:39	--------	d-----w-	c:\users\marita1\.thumbnails
2013-09-04 20:12 . 2013-09-07 16:24	--------	d-----w-	c:\users\marita1\AppData\Roaming\Craften Terminal
2013-09-01 14:56 . 2013-09-01 14:56	--------	d-----w-	c:\users\marita1\AppData\Roaming\.mono
2013-08-22 16:24 . 2013-08-22 16:24	--------	d-----w-	c:\users\marita1\AppData\Roaming\Stardock
2013-08-22 16:23 . 2013-08-22 16:23	--------	dc-h--w-	c:\programdata\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 16:21 . 2013-08-22 16:21	--------	d-----w-	c:\program files (x86)\Stardock
2013-08-22 16:21 . 2013-08-22 16:21	--------	d-----w-	c:\programdata\Stardock
2013-08-22 15:49 . 2013-08-22 15:49	--------	d-----w-	c:\users\marita1\AppData\Local\Ironclad Games
2013-08-22 15:35 . 2013-08-22 15:35	--------	d--h--w-	c:\programdata\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 15:27 . 2013-08-22 15:27	--------	d-----w-	c:\users\marita1\AppData\Local\Stardock
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-13 19:10 . 2012-08-20 16:38	692616	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-13 19:10 . 2011-07-07 08:32	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-25 06:50 . 2010-06-24 11:33	22240	----a-w-	c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]
2011-05-09 08:49	176936	----a-w-	c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{11DCAFD6-DDBA-4ADA-998B-996B7B691AE0}]
2010-12-02 15:12	201728	----a-w-	c:\users\Marita\AppData\Roaming\FBConnect\IE\FBConnect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517}]
2013-08-13 13:59	200984	----a-w-	c:\program files (x86)\Movdap\WebCakeIEClient.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2010-09-12 14:02	3863136	----a-w-	c:\program files (x86)\ConduitEngine\ConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-05-17 11:29	1490312	----a-w-	c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}]
2010-09-12 14:02	3863136	----a-w-	c:\program files (x86)\IncrediMail_MediaBar_2\tbIncr.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}]
2013-01-30 14:49	281760	----a-w-	c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]
2011-02-01 13:58	1499440	----a-r-	c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}"= "c:\program files (x86)\IncrediMail_MediaBar_2\tbIncr.dll" [2010-09-12 3863136]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files (x86)\ConduitEngine\ConduitEngine.dll" [2010-09-12 3863136]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2011-05-17 1490312]
"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2011-02-01 1499440]
"{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}"= "c:\program files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll" [2011-05-09 176936]
"{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}"= "c:\program files (x86)\ChatZum Toolbar\tbunscA242.tmp\tbcore3.dll" [2012-08-29 2665984]
.
[HKEY_CLASSES_ROOT\clsid\{d40b90b4-d3b1-4d6b-a5d7-dc041c1b76c0}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar.1]
[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]
[HKEY_CLASSES_ROOT\SWEETIE.IEToolbar]
.
[HKEY_CLASSES_ROOT\clsid\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}]
.
[HKEY_CLASSES_ROOT\clsid\{37d48d9c-3f7e-412f-b5bf-611be7ccfca1}]
[HKEY_CLASSES_ROOT\TBSB09850.TBSB09850.3]
[HKEY_CLASSES_ROOT\TypeLib\{EC4085F2-8DB3-45a6-AD0B-CA289F3C5D7E}]
[HKEY_CLASSES_ROOT\TBSB09850.TBSB09850]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-07-15 1104384]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19875944]
"EADM"="e:\games\Origin\Origin.exe" [2013-08-30 3549528]
"WebCake Desktop"="c:\users\marita1\AppData\Roaming\Movdap\WebCakeDesktop.exe" [2013-08-12 52504]
"ImpulseFastStart"="c:\program files (x86)\Stardock\Impulse\Impulse.exe" [2008-10-14 1717616]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files (x86)\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-07-19 98304]
"331BigDog"="c:\program files (x86)\USB Camera\VM331_STI.EXE" [2009-09-15 536576]
"LockKey"="c:\program files (x86)\LockKey\LockKey.exe" [2010-05-28 365936]
"VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2010-11-25 3122528]
"UCam_Menu"="c:\program files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe" [2009-05-19 222504]
"YouCam Mirror Tray icon"="c:\program files (x86)\Lenovo\YouCam\YouCamTray.exe" [2010-06-30 171104]
"UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"UIExec"="c:\program files (x86)\T-Mobile Internet Manager 03\UIExec.exe" [2009-03-30 132608]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2011-05-17 395144]
"SweetIM"="c:\program files (x86)\SweetIM\Messenger\SweetIM.exe" [2011-06-02 114992]
"IMBooster"="c:\program files (x86)\Iminent\IMBooster\imbooster.exe" [2011-03-30 1324008]
"FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2009-12-02 847872]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-05-22 348624]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-30 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="d:\itunes\iTunesHelper.exe" [2012-06-07 421776]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-04-04 843712]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2012-11-30 1263512]
"LogMeIn Hamachi Ui"="c:\logmein hamachi\hamachi-2-ui.exe" [2013-06-28 2255184]
.
c:\users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.2.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll c:\progra~3\browse~1\251005~1.80\{c16c1~1\browserprotect.dll
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R0 sfdrv01a;StarForce Protection Environment Driver (version 1.x.a);c:\windows\System32\drivers\sfdrv01a.sys;c:\windows\SYSNATIVE\drivers\sfdrv01a.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ICQ Service;ICQ Service;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe;c:\program files (x86)\ICQ6Toolbar\ICQ Service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 EagleX64;EagleX64;c:\windows\system32\drivers\EagleX64.sys;c:\windows\SYSNATIVE\drivers\EagleX64.sys [x]
R3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys;c:\windows\SYSNATIVE\DRIVERS\k57nd60a.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys;c:\windows\SYSNATIVE\drivers\massfilter.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
R3 X6va008;X6va008;c:\windows\SysWOW64\Drivers\X6va008;c:\windows\SysWOW64\Drivers\X6va008 [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys;c:\windows\SYSNATIVE\DRIVERS\avfwot.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [x]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S2 BrowserProtect;BrowserProtect;c:\programdata\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe;c:\programdata\BrowserProtect\2.5.1005.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 EPSON_EB_RPCV4_04;EPSON V5 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE [x]
S2 EPSON_PM_RPCV4_04;EPSON V3 Service4(04);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\logmein hamachi\hamachi-2.exe;c:\logmein hamachi\hamachi-2.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TeamViewer7;TeamViewer 7;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [x]
S2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe;c:\program files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [x]
S2 WebCakeUpdater;WebCakeUpdater;c:\program files (x86)\Movdap\WBDesktop.Updater.exe;c:\program files (x86)\Movdap\WBDesktop.Updater.exe [x]
S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys;c:\windows\SYSNATIVE\DRIVERS\avfwim.sys [x]
S3 jumi;%Jumi%;c:\windows\system32\DRIVERS\jumi.sys;c:\windows\SYSNATIVE\DRIVERS\jumi.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 vm331avs;Digital Camera 1;c:\windows\system32\Drivers\vm331avs.sys;c:\windows\SYSNATIVE\Drivers\vm331avs.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
Akamai	REG_MULTI_SZ   	Akamai
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-20 19:10]
.
2013-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-05 15:45]
.
2013-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-05 15:45]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
@="{771C7324-DA80-49D3-8017-753B0AF60951}"
[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
2010-11-25 09:29	1502720	----a-w-	c:\windows\System32\IcnOvrly.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-08-20 11448424]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-08-20 2120808]
"EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\utility.exe" [2010-04-12 4462496]
"Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2010-03-18 7056800]
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=GB&userid=53146daa-8993-7fe4-0bad-c3ddc49edebe&searchtype=hp&installDate={installDate}
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://search.chatzum.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=GB&userid=53146daa-8993-7fe4-0bad-c3ddc49edebe&searchtype=ds&q={searchTerms}&installDate={installDate}
IE: Free YouTube Download - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm
IE: Free YouTube to MP3 Converter - c:\program files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm
IE: {{EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - c:\program files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
FF - ProfilePath - c:\users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\
FF - prefs.js: browser.search.selectedEngine - Search the web (Babylon)
FF - prefs.js: browser.startup.homepage - hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=hp&installDate={installDate}
FF - prefs.js: keyword.URL - hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&installDate={installDate}&q=
FF - ExtSQL: 2013-08-09 18:22; {740B3FD5-4483-469D-BE7F-8555B153BD04}; c:\program files (x86)\Mozilla Firefox\extensions\{740B3FD5-4483-469D-BE7F-8555B153BD04}
FF - user.js: extensions.BabylonToolbar.tlbrSrchUrl - hxxp://search.babylon.com/?babsrc=TB_def&mntrId=aa776832000000000000ac8112101eb2&q=
FF - user.js: extensions.BabylonToolbar.id - aa776832000000000000ac8112101eb2
FF - user.js: extensions.BabylonToolbar.appId - {BDB69379-802F-4eaf-B541-F8DE92DD98DB}
FF - user.js: extensions.BabylonToolbar.instlDay - 15696
FF - user.js: extensions.BabylonToolbar.vrsn - 1.8.7.2
FF - user.js: extensions.BabylonToolbar.vrsni - 1.8.7.2
FF - user.js: extensions.BabylonToolbar_i.vrsnTs - 1.8.7.222:08
FF - user.js: extensions.BabylonToolbar.prtnrId - babylon
FF - user.js: extensions.BabylonToolbar.prdct - BabylonToolbar
FF - user.js: extensions.BabylonToolbar.aflt - babsst
FF - user.js: extensions.BabylonToolbar_i.smplGrp - none
FF - user.js: extensions.BabylonToolbar.tlbrId - base
FF - user.js: extensions.BabylonToolbar.instlRef - sst
FF - user.js: extensions.BabylonToolbar.dfltLng - en
FF - user.js: extensions.BabylonToolbar_i.excTlbr - false
FF - user.js: extensions.BabylonToolbar.excTlbr - false
FF - user.js: extensions.BabylonToolbar.admin - false
FF - user.js: extensions.BabylonToolbar_i.babTrack - affID=116634&tt=5112_8
FF - user.js: extensions.BabylonToolbar_i.babExt - 
FF - user.js: extensions.BabylonToolbar_i.srcExt - ss
FF - user.js: extensions.BabylonToolbar.autoRvrt - false
FF - user.js: extensions.BabylonToolbar.rvrt - false
FF - user.js: extensions.BabylonToolbar_i.newTab - false
FF - user.js: extentions.webcake.installId - 69c9fd08-74ea-49dc-a520-702d3625bb98
FF - user.js: extentions.webcake.defaultEnableAppsList - layers/banner,layers/inline,layers/search,layers/shopping,newOffers/wc
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{0f369707-379f-46df-a5c5-d04390f3459b} - c:\program files (x86)\Funload.de\tbFunl.dll
BHO-{1631550F-191D-4826-B069-D9439253D926} - c:\program files (x86)\PriceGong\2.5.0\PriceGongIE.dll
Toolbar-Locked - (no file)
Toolbar-{0f369707-379f-46df-a5c5-d04390f3459b} - c:\program files (x86)\Funload.de\tbFunl.dll
Toolbar-{D0F4A166-B8D4-48b8-9D63-80849FE137CB} - (no file)
Wow6432Node-HKCU-Run-Clownfish - c:\program files (x86)\Clownfish\Clownfish.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe
Toolbar-Locked - (no file)
WebBrowser-{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF} - (no file)
WebBrowser-{0F369707-379F-46DF-A5C5-D04390F3459B} - (no file)
WebBrowser-{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
WebBrowser-{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-BasicServe - c:\program files (x86)\BasicServe\uninstall.exe
AddRemove-Shockwave - c:\windows\System32\Macromed\SHOCKW~1\UNWISE.EXE
AddRemove-{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1 - c:\program files (x86)\Uniblue\SpeedUpMyPC\unins000.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\X6va008]
"ImagePath"="\??\c:\windows\SysWOW64\Drivers\X6va008"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-74344267-1380692144-3618317618-1010\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:11,55,51,c7,55,ba,6a,a1,0b,15,ed,95,83,f1,55,e6,51,1d,c3,47,7c,87,52,
   65,ec,31,d2,5a,f7,68,88,12,35,4f,b9,4c,53,85,95,30,44,6f,8c,34,38,b2,63,a9,\
"??"=hex:5d,2e,bc,00,9b,07,bc,9c,34,34,87,88,c9,ab,ca,0d
.
[HKEY_USERS\S-1-5-21-74344267-1380692144-3618317618-1010\Software\SecuROM\License information*]
"datasecu"=hex:83,07,47,dd,e2,b2,b1,37,36,c0,d4,83,1a,36,85,c1,3c,b6,d3,39,66,
   e4,a2,1e,a5,09,46,9c,82,5b,d6,af,20,47,4e,57,d9,4e,2c,19,a6,2b,a7,08,f6,b7,\
"rkeysecu"=hex:11,65,24,a6,10,70,26,74,6b,51,ed,23,8e,93,65,42
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_174_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_174.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\TeamViewer\Version7\TeamViewer.exe
c:\program files (x86)\TeamViewer\Version7\tv_w32.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-09-18  21:51:53 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-09-18 19:51
.
Vor Suchlauf: 13 Verzeichnis(se), 82.016.108.544 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 82.347.999.232 Bytes frei
.
- - End Of File - - D5A7569180A808CA96232E3C7830140F
A36C5E4F47E84449FF07ED3517B43A31

schrauber · 19.09.2013, 09:51

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

HaukeR · 19.09.2013, 18:06

MBAM

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.19.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
marita1 :: MARITA-PC [Administrator]

19.09.2013 17:52:33
mbam-log-2013-09-19 (17-52-33).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 313127
Laufzeit: 16 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 3
C:\Users\marita1\AppData\Roaming\Movdap\WebCakeDesktop.exe (PUP.WebCake.A) -> 1804 -> Löschen bei Neustart.
C:\Program Files (x86)\Movdap\WBDesktop.Updater.exe (PUP.Optional.WebCake.A) -> 4200 -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (PUP.Optional.SweetIM) -> 3984 -> Löschen bei Neustart.

Infizierte Speichermodule: 8
C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.

Infizierte Registrierungsschlüssel: 57
HKLM\SYSTEM\CurrentControlSet\Services\WebCakeUpdater (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517} (Adware.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517} (Adware.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{7169BBB3-3289-4696-B35D-4A88BCF6FB12} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\{BDB69379-802F-4eaf-B541-F8DE92DD98DB} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{291BCCC1-6890-484a-89D3-318C928DAC1B} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.BabylonESrvc.1 (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\esrv.BabylonESrvc (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517} (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2A5A2A90-3B30-4E6E-A955-2F232C6EF517} (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{26C9BBE4-6D45-4AB6-A5B4-E068C9F5EF6D} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{A9CAF365-EA35-45DA-BD8B-2EFA09D374AC} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{ACA608DB-A210-4253-B799-3FD24E9A7BF5} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.ActiveContentHandle.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.ActiveContentHandler (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.BrowserHelperObject.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.BrowserHelperObject (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Löschen bei Neustart.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{AF6B0594-6008-4327-93E5-608AD710A6FA} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\WebCakeIEClient.Api.1 (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\WebCakeIEClient.Api (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{AF6B0594-6008-4327-93E5-608AD710A6FA} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\b (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{BB975E58-E769-4E5A-BA12-B765BC559FF3} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{DF84E609-C3A4-49CB-A160-61767DAF8899} (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Typelib\{6E8BF012-2C85-4834-B10A-1B31AF173D70} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542} (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.ScriptExtender (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.ScriptExtender.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.TinyUrlHandler (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.TinyUrlHandler.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.Web2IMBHandler (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\IminentWebBooster.Web2IMBHandler.1 (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\AppID\WebCakeIEClient.DLL (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Löschen bei Neustart.
HKCU\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\BabylonToolbar (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\BASICSERVE (PUP.Zwangi) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\Chrome\Extensions\fjoijdanhaiflhibkljeklcghcmmfffh (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Google\Chrome\Extensions\pfmopbbadnfoelckkcmjjeaaegjpjjbk (PUP.Optional.Gophoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BASICSERVE (PUP.Zwangi) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\SWEETIM (PUP.Optional.SweetIM.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 9
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|WebCake Desktop (PUP.WebCake.A) -> Daten: C:\Users\marita1\AppData\Roaming\Movdap\WebCakeDesktop.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|SweetIM (PUP.Optional.SweetIM) -> Daten: C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{EEE6C35B-6118-11DC-9C72-001320C79847} (PUP.Optional.SweetIM) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://isearch.babylon.com/?affID=116634&tt=5112_8&babsrc=HP_ss&mntrId=aa776832000000000000ac8112101eb2 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Löschen bei Neustart.
HKCU\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\BasicServe|DllPath (PUP.Zwangi) -> Daten: C:\Program Files (x86)\BasicServe\basicserve.dll -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BasicServe|DisplayName (PUP.Zwangi) -> Daten: BasicServe 1.0 build 113 -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\Software\SweetIM|simapp_id (PUP.Optional.SweetIM.A) -> Daten: 11111111 -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 3
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=GB&userid=53146daa-8993-7fe4-0bad-c3ddc49edebe&searchtype=hp&installDate={installDate}) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|Default_Search_URL (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=GB&userid=53146daa-8993-7fe4-0bad-c3ddc49edebe&searchtype=ds&q={searchTerms}&installDate={installDate}) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Search|SearchAssistant (PUP.Optional.Snapdo) -> Bösartig: (hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=GB&userid=53146daa-8993-7fe4-0bad-c3ddc49edebe&searchtype=ds&q={searchTerms}&installDate={installDate}) Gut: (hxxp://www.google.com) -> Erfolgreich ersetzt und in Quarantäne gestellt.

Infizierte Verzeichnisse: 19
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38} (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Cache (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Web Cake (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Gophoto.it (PUP.Optional.Gophoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053} (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Cache (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\CR (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\FF (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\IE (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\AppData\Roaming\OpenCandy (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\AppData\Roaming\OpenCandy\25AEA14ED4864C69A1087521318D3934 (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateien: 66
C:\Users\marita1\AppData\Roaming\Movdap\WebCakeDesktop.exe (PUP.WebCake.A) -> Löschen bei Neustart.
C:\Program Files (x86)\Movdap\WBDesktop.Updater.exe (PUP.Optional.WebCake.A) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgAdaptersProxy.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgUpdateSupport.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgsimcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommon.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgcommunication.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mghooking.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll (PUP.Optional.SweetIM) -> Löschen bei Neustart.
C:\Program Files (x86)\Movdap\WebCakeIEClient.dll (Adware.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarsrv.exe (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Movdap\WebCakeIEClient.dll (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Iminent\IMBooster4Web\Iminent.WebBooster.dll (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.8.7.2\BabylonToolbarEng.dll (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.exe (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\Web Cake\WebCakeDesktop.exe (PUP.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\Desktop\Vegas Pro 12 Patch.exe (PUP.RiskwareTool.CK) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\Downloads\CheatEngine62.exe (PUP.Optional.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\Downloads\IMG00593829405-JPG.scr (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\M-0-5778-6436-2457\winsrvc.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\M-10-5845-8588-3464\winsvn.exe (Backdoor.Bot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\M-10-6897-8685-3464\winmgr.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\M-10-7960-8588-3464\winsvc.exe (Backdoor.Bot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\M-25-6788-7854-2457\winmgr.exe (Backdoor.Bot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\M-50-8964-7854-4678\winmgr.exe (Backdoor.Bot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\000000cb.@ (Rootkit.0Access) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\80000000.@ (Rootkit.0Access.64) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\bc623.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Windows\Installer\bc62b.msi (PUP.Optional.SweetIM) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.ico (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\Setup.dat (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setup.dll (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}\_Setupx.dll (PUP.WebCake) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Web Cake\WebCakeDesktop.Updater.InstallState (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Web Cake\sqlite3.exe (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Web Cake\WebCakeDesktop.Updater.exe (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Web Cake\WebCakeIEClient.dll (PUP.Optional.WebCake.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\SearchTheWeb.lnk (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\Blog.lnk (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\FAQ.lnk (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\Help.lnk (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Iminent\Iminent.lnk (PUP.Optional.Iminent.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\HDVidCodec.lnk (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hdvidcodec.com\Uninstall.lnk (PUP.Optional.HDVidCodec.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Program Files (x86)\Gophoto.it\gophotoit14.crx (PUP.Optional.Gophoto.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.dat (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\Setup.ico (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setup.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\Tarma Installer\{DE3B7BF9-0770-4104-BC0B-B1CCCCE2F053}\_Setupx.dll (PUP.Optional.Tarma.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\CR\BabylonChrome1.crx (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\CR\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\FF\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\IE\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\Shared\BabyTBConf.ini (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\marita1\AppData\Roaming\BabSolution\Shared\BUSolution.dll (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Marita.Marita-PC\AppData\Roaming\OpenCandy\25AEA14ED4864C69A1087521318D3934\TuneUpUtilities2012_de-DE-p2v0.exe (PUP.Optional.OpenCandy) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

AdwCleaner

Code:

ATTFilter

# AdwCleaner v3.004 - Bericht erstellt am 19/09/2013 um 18:32:17
# Updated 15/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : marita1 - MARITA-PC
# Gestartet von : C:\Users\marita1\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

Dienst Gelöscht : BrowserProtect
[#] Dienst Gelöscht : ICQ Service

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Babylon
[!] Ordner Gelöscht : C:\ProgramData\BrowserProtect
Ordner Gelöscht : C:\ProgramData\ICQ\ICQToolbar
Ordner Gelöscht : C:\ProgramData\Iminent
Ordner Gelöscht : C:\ProgramData\SweetIM
Ordner Gelöscht : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uniblue\SpeedUpMyPC
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\Program Files (x86)\BabylonToolbar
Ordner Gelöscht : C:\Program Files (x86)\ChatZum Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\ConduitEngine
Ordner Gelöscht : C:\Program Files (x86)\HDvidCodec.com
Ordner Gelöscht : C:\Program Files (x86)\ICQ6Toolbar
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\IncrediMail_MediaBar_2
Ordner Gelöscht : C:\Program Files (x86)\Movdap
Ordner Gelöscht : C:\Program Files (x86)\RegClean Pro
Ordner Gelöscht : C:\Program Files (x86)\SimilarSites
Ordner Gelöscht : C:\Program Files (x86)\SweetIM
Ordner Gelöscht : C:\Program Files (x86)\TornTV.com
Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB_DE
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\IncrediMail_MediaBar_2
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\Marita\AppData\LocalLow\Funload.de
Ordner Gelöscht : C:\Users\Marita\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Marita\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\IncrediMail_MediaBar_2
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\DVDVideoSoftTB_DE
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\LocalLow\Funload.de
Ordner Gelöscht : C:\Users\Marita.Marita-PC\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\marita1\AppData\Local\PutLockerDownloader
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\BabylonToolbar
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\ConduitEngine
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\IncrediMail_MediaBar_2
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\SweetIM
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\Toolbar4
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\DVDVideoSoftTB_DE
Ordner Gelöscht : C:\Users\marita1\AppData\LocalLow\Funload.de
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Movdap
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\SimilarSites
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Uniblue\SpeedUpMyPC
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Web Cake
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Movie2KDownloader.com
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\jetpack
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\ffxtlbr@babylon.com
Ordner Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\plugin@getwebcake.com
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\gophoto@gophoto.it.xpi
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\movie2kdownloader@movie2kdownloader.com.xpi
Datei Gelöscht : C:\chatzum_nt.exe
Datei Gelöscht : C:\Users\Public\Desktop\speedupmypc.lnk
Datei Gelöscht : C:\windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\marita1\Desktop\HDVidCodec.lnk
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\bprotector_extensions.sqlite
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\bprotector_prefs.js
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\Babylon.xml
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\searchplugins\babylon1.xml
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\searchplugins\BrowserProtect.xml
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\searchplugins\Web Search.xml
Datei Gelöscht : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\user.js
Datei Gelöscht : C:\windows\System32\Tasks\Scheduled Update for Ask Toolbar
Datei Gelöscht : C:\windows\System32\Tasks\SpeedUpMyPC

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [{58BD07EB-0EE0-4DF0-8121-DC9B693373DF}]
Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{ACAA314B-EEBA-48E4-AD47-84E31C44796C}]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\blaofbhgbmeikidhlkmjhbkbfohpgekf
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dhkplhfnhceodhffomolpfigojocbpcb
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope]
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\ICQ Service.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Iminent.MMServer.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Iminent.WebBooster.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\PriceGongIE.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbCommonUtils.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\TbHelper.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ICQToolBar.IEHook.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.TinyUrl.TinyfyingArgs.DownloadArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.TinyUrl.TinyfyingArgs.LinkToPromoteArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.TinyUrl.TinyfyingArgs.RawDataArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.TinyUrl.TinyfyingArgs.TinyUrlArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.TinyUrl.TinyfyingArgs.ViralLinkArgs
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Iminent.Business.TinyUrl.UrlTinyfier
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentMMServer.ACPlayer
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\IminentMMServer.ACPlayer.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MediaPlayer.GraphicsUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\MgMediaPlayer.GifAnimator.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Movie2KDownloader
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\sim-packages
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbCommonUtils.CommonUtils.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbDownloadManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbPropertyManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbRequest.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.TbTask.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TbHelper.ToolbarHelper.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar3.SearchProviderManager.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\tracing\askpartnercobrandingtool_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\chatzum_nt_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\chatzum_nt_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\SweetIM.exe
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgHelperApp.exe]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs [C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\mgToolbarProxy.dll]
Schlüssel Gelöscht : HKCU\Software\a57d9deb234ef43
Schlüssel Gelöscht : HKLM\SOFTWARE\a57d9deb234ef43
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2625848
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2629906
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2724386
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_gamespy-arcade_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_gamespy-arcade_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_pacific-storm-allies_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_pacific-storm-allies_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_ace-of-spades_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_ace-of-spades_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_av-voice-changer-software_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_av-voice-changer-software_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_battlefield-2 (1)_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_battlefield-2 (1)_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_battlefield-2_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_battlefield-2_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_buildcraft-mod-installer_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_buildcraft-mod-installer_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_dx-ball-2_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_dx-ball-2_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-download_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_free-youtube-download_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_grand-theft-auto_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_grand-theft-auto_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hypercam_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_hypercam_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_magix-music-maker-mx_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_magix-music-maker-mx_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_windows-movie-maker_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_fuer_windows-movie-maker_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{01994268-3C10-4044-A1EA-7A9C1B739A11}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{13C8734A-1AD2-4500-9F65-10D99AD80F54}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4CE516A7-F7AC-4628-B411-8F886DC5733E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{50F7F0BE-31BA-4145-BD8B-6B0DECFED804}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{5D723752-5899-47E8-99B4-62C824EF9E13}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{835315FC-1BF6-4CA9-80CD-F6C158D40692}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{01BB6254-5E89-4C53-BEF1-4D1656B09B86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1631550F-191D-4826-B069-D9439253D926}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1C950DE5-D31E-42FB-AFB9-91B0161633D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3BDF4CE9-E81D-432B-A55E-9F0570CE811F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{479BF2D6-E362-4A99-B1AB-BC764D7B97AE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4B6D6E60-FBD2-4E79-BF4B-886BC98F1797}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5C176BA0-6FC0-4EBD-8ACF-24AC592506B6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{796D822A-C3F9-4A97-BAAB-42FE7628EA63}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{82AC53B4-164C-4B07-A016-437A8388B81A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8E948448-E97B-4864-8177-546200709672}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{913FAA37-8CDB-4144-9047-E2A950CD967E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A0B10EBE-4E51-4CAE-949B-E6B9E7D68CEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4A0CB15-8465-4F58-A7E5-73084EA2A064}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A93B530D-2B18-48C7-9F3C-281679403372}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9A56B8E-2DEB-4ED3-BC92-1FA450BCE1A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE338F6D-5A7C-4D1D-86E3-C618532079B5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C339D489-FABC-41DD-B39D-276101667C70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C875C0A1-09E3-48D5-9F8E-BD337796FD14}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D2A2595C-4FE4-4315-AA9B-19DBD6271B71}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D433A9D0-8267-40CB-8AD5-24F22FA5373F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D89031C2-10DA-4C90-9A62-FCED012BC46B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D8F01233-2DE6-4EE7-8988-37263F00651B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{DD438708-AAB4-422D-A322-B619589F5680}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{EEE6C35D-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F511AFDB-726E-4458-90E7-1ECB97406544}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0F369707-379F-46DF-A5C5-D04390F3459B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FEF05F9C-F03E-4309-97DF-DDDC27E5CCF9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{723411D8-4071-4698-90E3-27AB1D7EF9AF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{01221FCC-4BFB-461C-B08C-F6D2DF309921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0AFD55C8-ADF8-4A33-A6E1-DEDB7A36AEB4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{452AE416-9A97-44CA-93DA-D0F15C36254F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{45CDA4F7-594C-49A0-AAD1-8224517FE979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{81E852CC-1FD5-4004-8761-79A48B975E29}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{913FAA37-8CDB-4144-9047-E2A950CD967E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A439801C-961D-452C-AB42-7848E9CBD289}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B2CA345D-ADB8-4F5D-AC64-4AB34322F659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B9F43021-60D4-42A6-A065-9BA37F38AC47}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BF921DD3-732A-4A11-933B-A5EA49F2FD2C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C58D664A-3DBC-4925-AE74-0382007DF113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C776D7F4-BA85-4B75-AAFC-3A0A11FE6E36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D83B296A-2FA6-425B-8AE8-A1F33D99FBD6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C358-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C359-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EEE6C35A-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4EBB1E2-21F3-4786-8CF4-16EC5925867F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FD8F79A0-D2E2-4FA2-AEAF-393EAC8064F7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{425F621C-217C-40AD-B22F-4EFCFF452800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4D3B167E-5FD8-4276-8FD7-9DF19C1E4D19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B87F8B63-7274-43FD-87FA-09D3B7496148}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{C4BAE205-5E02-4E32-876E-F34B4E2D000C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1631550F-191D-4826-B069-D9439253D926}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F369707-379F-46DF-A5C5-D04390F3459B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{723411D8-4071-4698-90E3-27AB1D7EF9AF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FCBCCB87-9224-4B8D-B117-F56D924BEB18}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{30F9B915-B755-4826-820B-08FBA6BD249D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EEE6C360-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{457EF9F0-0A7C-4302-B47B-C207A8DE8598}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FEF05F9C-F03E-4309-97DF-DDDC27E5CCF9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{723411D8-4071-4698-90E3-27AB1D7EF9AF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{855F3B16-6D32-4FE6-8A56-BBB695989046}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EEE6C367-6118-11DC-9C72-001320C79847}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A19C48D8-7994-4326-B95B-3A48CA933A05}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9672C38-B767-4F50-96C8-6ABAB0067C0F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{50354911-DF80-4CAB-ACDE-706F20DD1D19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2DBC22DA-1441-46D6-85EE-91A78B508805}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7EA010BF-D61B-4088-AC55-54F63F319D13}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{96BD48DD-741B-41AE-AC4A-AFF96BA00F7E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{EEE6C360-6118-11DC-9C72-001320C79847}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{0F369707-379F-46DF-A5C5-D04390F3459B}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{37D48D9C-3F7E-412F-B5BF-611BE7CCFCA1}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{855F3B16-6D32-4FE6-8A56-BBB695989046}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0027DA2D-C9F2-4B0B-AE05-E2CD1BDB6CFF}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{0F369707-379F-46DF-A5C5-D04390F3459B}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{D40B90B4-D3B1-4D6B-A5D7-DC041C1B76C0}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{EE932B49-D5C0-4D19-A3DA-CE0849258DE6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\ChatZum Toolbar
Schlüssel Gelöscht : HKCU\Software\Iminent
Schlüssel Gelöscht : HKCU\Software\Microsoft\Babylon
Schlüssel Gelöscht : HKCU\Software\powerpack
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\conduitEngine
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\IncrediMail_MediaBar_2
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB_DE
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Funload.de
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\ChatZum Toolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\conduitEngine
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gelöscht : HKLM\Software\Iminent
Schlüssel Gelöscht : HKLM\Software\ImInstaller
Schlüssel Gelöscht : HKLM\Software\IncrediMail_MediaBar_2
Schlüssel Gelöscht : HKLM\Software\Uniblue\SpeedUpMyPC
Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB_DE
Schlüssel Gelöscht : HKLM\Software\Funload.de
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E55B3271-7CA8-4D0C-AE06-69A24856E996}_is1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C4ED781C-7394-4906-AAFF-D6AB64FF7C38}
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~1\251005~1.80\{c16c1~1\browse~1.dll
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - c:\progra~3\browse~1\251005~1.80\{c16c1~1\browserprotect.dll

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16448

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]

-\\ Mozilla Firefox v16.0.2 (de)

[ Datei : C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\prefs.js ]

Zeile gelöscht : user_pref("avg.install.userHPSettings", "hxxp://isearch.babylon.com/?affID=116634&tt=5112_8&babsrc=HP_ss&mntrId=aa776832000000000000ac8112101eb2");
Zeile gelöscht : user_pref("avg.install.userSPSettings", "Search the web (Babylon)");
Zeile gelöscht : user_pref("browser.search.selectedEngine", "Search the web (Babylon)");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.admin", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.aflt", "babsst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.appId", "{BDB69379-802F-4eaf-B541-F8DE92DD98DB}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.bbDpng", "3");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.cntry", "DE");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dfltLng", "en");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.dpkLst", "");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.excTlbr", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar.hdrMd5", "BCE4E5FDB0BCB417A09E90930707B431");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.id", "aa776832000000000000ac8112101eb2");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlDay", "15696");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.instlRef", "sst");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.lastVrsnTs", "1.8.7.222:07:59");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.pnu_base", "{\"newVrsn\":\"74\",\"lastVrsn\":\"74\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"true\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prdct", "BabylonToolbar");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.prtnrId", "babylon");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.rvrt", "false");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.sg", "azb");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.smplGrp", "azb");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrId", "base");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.tlbrSrchUrl", "hxxp://search.babylon.com/?babsrc=TB_def&mntrId=aa776832000000000000ac8112101eb2&q=");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsn", "1.8.7.2");
Zeile gelöscht : user_pref("extensions.BabylonToolbar.vrsni", "1.8.7.2");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babExt", "");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.babTrack", "affID=116634&tt=5112_8");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.excTlbr", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.newTab", false);
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.srcExt", "ss");
Zeile gelöscht : user_pref("extensions.BabylonToolbar_i.vrsnTs", "1.8.7.222:08:00");
Zeile gelöscht : user_pref("extentions.webcake.defaultEnableAppsList", "layers/banner,layers/inline,layers/search,layers/shopping,newOffers/wc");
Zeile gelöscht : user_pref("extentions.webcake.installId", "69c9fd08-74ea-49dc-a520-702d3625bb98");

*************************

AdwCleaner[R0].txt - [40973 octets] - [19/09/2013 18:29:32]
AdwCleaner[S0].txt - [39143 octets] - [19/09/2013 18:32:17]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [39204 octets] ##########

JRT

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.1 (09.15.2013:1)
OS: Windows 7 Home Premium x64
Ran by marita1 on 19.09.2013 at 18:45:36,03
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC}
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\DisplayName
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\\URL
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchURL\\Default



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{A09AB6EB-31B5-454C-97EC-9B294D92EE2A}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-74344267-1380692144-3618317618-1010\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Eventlog\Application\WebCakeUpdater
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\features\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\products\a28b4d68debaa244eb686953b7074fef
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9



~~~ Files

Successfully deleted: [File] "C:\Users\marita1\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\speedupmypc.lnk"
Successfully deleted: [File] C:\windows\syswow64\sho209B.tmp
Successfully deleted: [File] C:\windows\syswow64\sho2EA8.tmp
Successfully deleted: [File] C:\windows\syswow64\shoCD40.tmp
Successfully deleted: [File] C:\windows\syswow64\shoD854.tmp
Successfully deleted: [File] C:\windows\syswow64\shoE6A0.tmp



~~~ Folders

Successfully deleted: [Folder] "C:\Users\marita1\AppData\Roaming\goforfiles"
Successfully deleted: [Folder] "C:\Program Files (x86)\goforfiles"
Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\uniblue"
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{12A6E36D-03AC-4149-85CD-F93B5EC537A3}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{3F0F4FCF-0948-4B92-A96A-5369B69AA4F9}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{43ADB92A-F8CE-45E1-BA42-BC1514C5529B}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{68CC669E-6545-4577-845C-44E43EABAE3D}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{743668C0-2D9F-485F-B54C-C0797536F8E6}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{79B5BF7B-7672-4886-8CB4-B6867C2B425B}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{7DD8202A-E37D-4E02-B94A-D91BA528BB7A}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{8381CE2B-FC31-430B-9D30-4B9135702839}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{84E07B66-60C9-4ABA-ABF2-0E091369C1F7}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{BCCE08E3-7D59-4070-8675-449AD4F89F2A}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{EB5D44E0-8157-4326-9C80-92EABE5C87BA}
Successfully deleted: [Empty Folder] C:\Users\marita1\appdata\local\{EB6B1E23-C078-43FB-A3DC-E90B0F36F268}



~~~ FireFox

Failed to delete: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml"
Successfully deleted: [File] "C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml"
Successfully deleted: [Folder] C:\Users\marita1\AppData\Roaming\mozilla\firefox\profiles\0rux5gt3.default\extensions\staged
Successfully deleted the following from C:\Users\marita1\AppData\Roaming\mozilla\firefox\profiles\0rux5gt3.default\prefs.js

user_pref("browser.newtab.url", "hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=nt&installDate={insta
user_pref("browser.startup.homepage", "hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=hp&installDate=
user_pref("keyword.URL", "hxxp://feed.snapdo.com/?publisher=SoftPublisherYB&dpid=sfp1&co=DE&userid=0b03c6e9-a65d-411c-acd9-e9e6b1cffe53&searchtype=ds&installDate={installDate}
Emptied folder: C:\Users\marita1\AppData\Roaming\mozilla\firefox\profiles\0rux5gt3.default\minidumps [6 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.09.2013 at 18:59:45,98
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by marita1 (administrator) on MARITA-PC on 19-09-2013 19:03:32
Running from C:\Users\marita1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(AMD) C:\windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Spotify Ltd) C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2.exe
() C:\windows\SysWOW64\PnkBstrA.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Nokia) C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11448424 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1894696 2010-01-07] (Synaptics Incorporated)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4462496 2010-04-12] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056800 2010-03-18] (Lenovo (Beijing) Limited)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-15] (Spotify Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [EADM] - E:\GAMES\Origin\Origin.exe [3549528 2013-08-30] (Electronic Arts)
HKCU\...\Run: [ImpulseFastStart] - C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [331BigDog] - C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2009-09-15] (Vimicro)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [365936 2010-05-28] ( )
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-11-25] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-06-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [NokiaMServer] - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup [x]
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe [132608 2009-03-30] ()
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [IMBooster] - C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe /warmup [x]
HKLM-x32\...\Run: [FUFAXSTM] - C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348624 2012-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKU\Marita\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [366024 2011-06-29] (IncrediMail, Ltd.)
HKU\Marita\...\Run: [JumiController] - [x]
HKU\Marita\...\Run: [] - [x]
HKU\Marita\...\Run: [NokiaOviSuite2] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [703360 2011-01-31] (Nokia)
HKU\Marita\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1602984 2013-02-25] (Valve Corporation)
HKU\Marita\...\Run: [Akamai NetSession Interface] - C:\Users\Marita\AppData\Local\Akamai\netsession_win.exe [3329824 2012-02-02] (Akamai Technologies, Inc)
HKU\Marita\...\Run: [EPSON BX305 Series] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S5E94.tmp" /EF "HKCU"
HKU\Marita\...\Run: [Epson Stylus Office BX305(Netzwerk)] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S87C5.tmp" /EF "HKCU"
HKU\Marita\...\Policies\system: [DisableTaskMgr] 1
HKU\Marita\...\Policies\system: [DisableRegistryTools] 1
HKU\Marita\...\Policies\Explorer: [NoDesktop] 1
HKU\Marita\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION 
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Manager] - C:\Users\Marita.Marita-PC\M-50-8964-7854-4678\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Service] - C:\Users\Marita.Marita-PC\M-25-6788-7854-2457\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Spotify] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-25] (Spotify Ltd)
HKU\Marita.Marita-PC\...\Run: [Spotify Web Helper] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-25] ()
HKU\Marita.Marita-PC\...\Run: [Windows Firewall] - C:\Users\Marita.Marita-PC\AppData\Local\89776623\svchosts.exe [42496 2012-09-09] ()
HKU\Marita.Marita-PC\...\CurrentVersion\Windows: [Load] C:\Users\MARITA~1.MAR\LOCALS~1\Temp\msuoawy.com <===== ATTENTION
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
ShortcutTarget: Product Registration.lnk -> C:\Users\marita1\AppData\Local\Temp\is-VR3KQ.tmp\ATR1.exe (No File)
Startup: C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Facebook Connect - {11DCAFD6-DDBA-4ADA-998B-996B7B691AE0} - C:\Users\Marita\AppData\Roaming\FBConnect\IE\FBConnect.dll (Facebook Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Battlefield Play4Free - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\battlefieldplay4free@ea.com
FF Extension: No Name - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\WebSiteRecommendation@weliketheweb.com
FF Extension: torntv - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\torntv@torntv.com.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\marita1\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj\1.9_0
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-15] (Akamai Technologies, Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [619472 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 Hamachi2Svc; C:\LogMeIn Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-11-19] ()
R2 UI Assistant Service; C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [241664 2009-03-30] ()

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-08-01] ()
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114128 2012-05-22] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [139360 2012-05-22] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-22] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-22] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-10-11] (Avira GmbH)
R3 jumi; C:\Windows\System32\DRIVERS\jumi.sys [15160 2010-06-03] (Windows (R) Codename Longhorn DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2011-01-05] ()
S0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77688 2006-07-05] (Protection Technology (StarForce))
S0 sfsync02; C:\Windows\System32\drivers\sfsync02.sys [22936 2006-07-10] (Protection Technology)
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [106360 2007-01-12] (Protection Technology (StarForce))
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [207232 2009-11-09] (Vimicro Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 BcmSqlStartupSvc; 
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
U2 IAStorDataMgrSvc; 
U3 IGRS; 
U2 IviRegMgr; 
U2 ReadyComm.DirectRouter; 
U2 RichVideo; 
U3 SQLWriter; 
S3 X6va008; \??\C:\windows\SysWOW64\Drivers\X6va008 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-19 18:59 - 2013-09-19 18:59 - 00005457 _____ C:\Users\marita1\Desktop\JRT.txt
2013-09-19 18:45 - 2013-09-19 18:45 - 00000000 ____D C:\windows\ERUNT
2013-09-19 18:28 - 2013-09-19 18:34 - 00000000 ____D C:\AdwCleaner
2013-09-19 17:42 - 2013-09-19 17:42 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-19 17:40 - 2013-09-19 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-19 17:39 - 2013-09-19 17:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-19 17:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-19 17:38 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Desktop\JRT.exe
2013-09-19 17:37 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Downloads\JRT.exe
2013-09-19 17:34 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Desktop\adwcleaner.exe
2013-09-19 17:33 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Downloads\adwcleaner.exe
2013-09-19 17:30 - 2013-09-19 17:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\marita1\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00000994 _____ C:\Users\marita1\Desktop\Anno 2070.lnk
2013-09-18 22:21 - 2012-10-25 18:46 - 00381952 _____ C:\Users\marita1\Desktop\AnnoCookie0.3.exe
2013-09-18 22:20 - 2013-09-18 22:20 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anno 2170 - A.R.R.C
2013-09-18 21:05 - 2013-09-19 18:56 - 01073577 _____ C:\windows\WindowsUpdate.log
2013-09-18 21:05 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-18 21:05 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-18 21:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-18 20:55 - 2013-09-18 21:52 - 00000000 ____D C:\Qoobox
2013-09-18 20:55 - 2013-09-18 21:48 - 00000000 ____D C:\windows\erdnt
2013-09-18 19:55 - 2013-09-18 19:53 - 05128653 ____R (Swearware) C:\Users\marita1\Desktop\ComboFix.exe
2013-09-18 19:46 - 2013-09-18 19:53 - 05128653 _____ (Swearware) C:\Users\marita1\Downloads\ComboFix.exe
2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-16 20:31 - 2013-09-19 18:14 - 00021584 _____ C:\windows\PFRO.log
2013-09-16 19:27 - 2013-09-19 18:38 - 00003043 _____ C:\windows\setupact.log
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 14:22 - 2013-09-16 16:23 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:09 - 2013-09-16 14:11 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-12 14:41 - 2013-09-12 17:17 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-12 21:44 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 16:20 - 2013-09-13 16:22 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-04 22:12 - 2013-09-07 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-04 22:06 - 2013-09-07 13:55 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-03 19:36 - 2013-09-10 14:09 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock

==================== One Month Modified Files and Folders =======

2013-09-19 19:03 - 2013-09-18 21:05 - 01073577 _____ C:\windows\WindowsUpdate.log
2013-09-19 18:59 - 2013-09-19 18:59 - 00005457 _____ C:\Users\marita1\Desktop\JRT.txt
2013-09-19 18:48 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-19 18:48 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-19 18:45 - 2013-09-19 18:45 - 00000000 ____D C:\windows\ERUNT
2013-09-19 18:43 - 2012-09-09 20:01 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Skype
2013-09-19 18:42 - 2012-09-09 17:55 - 00000000 ____D C:\Users\marita1\AppData\Local\LogMeIn Hamachi
2013-09-19 18:42 - 2010-11-25 11:29 - 00000000 ____D C:\ProgramData\VeriFace
2013-09-19 18:39 - 2010-12-25 00:13 - 09157228 _____ C:\FaceProv.log
2013-09-19 18:38 - 2013-09-16 19:27 - 00003043 _____ C:\windows\setupact.log
2013-09-19 18:38 - 2011-01-05 17:45 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-19 18:38 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-19 18:34 - 2013-09-19 18:28 - 00000000 ____D C:\AdwCleaner
2013-09-19 18:14 - 2013-09-16 20:31 - 00021584 _____ C:\windows\PFRO.log
2013-09-19 18:09 - 2012-09-02 17:20 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-50-8964-7854-4678
2013-09-19 18:09 - 2012-08-28 15:02 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-25-6788-7854-2457
2013-09-19 18:09 - 2012-08-25 12:22 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-5845-8588-3464
2013-09-19 18:09 - 2012-08-23 20:49 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-7960-8588-3464
2013-09-19 18:09 - 2012-08-21 20:57 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-0-5778-6436-2457
2013-09-19 18:09 - 2012-08-20 12:01 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-6897-8685-3464
2013-09-19 18:08 - 2012-08-20 18:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-19 18:05 - 2011-01-05 17:45 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-19 17:42 - 2013-09-19 17:42 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-19 17:40 - 2013-09-19 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-19 17:38 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Desktop\JRT.exe
2013-09-19 17:38 - 2013-09-19 17:37 - 01029675 _____ (Thisisu) C:\Users\marita1\Downloads\JRT.exe
2013-09-19 17:35 - 2013-09-19 17:30 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\marita1\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-19 17:34 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Desktop\adwcleaner.exe
2013-09-19 17:34 - 2013-09-19 17:33 - 01039554 _____ C:\Users\marita1\Downloads\adwcleaner.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00000994 _____ C:\Users\marita1\Desktop\Anno 2070.lnk
2013-09-18 22:20 - 2013-09-18 22:20 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anno 2170 - A.R.R.C
2013-09-18 21:52 - 2013-09-18 20:55 - 00000000 ____D C:\Qoobox
2013-09-18 21:51 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-18 21:48 - 2013-09-18 20:55 - 00000000 ____D C:\windows\erdnt
2013-09-18 21:42 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-18 20:55 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-09-18 19:53 - 2013-09-18 19:55 - 05128653 ____R (Swearware) C:\Users\marita1\Desktop\ComboFix.exe
2013-09-18 19:53 - 2013-09-18 19:46 - 05128653 _____ (Swearware) C:\Users\marita1\Downloads\ComboFix.exe
2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-17 20:50 - 2012-09-10 19:55 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Spotify
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 17:08 - 2011-05-21 20:09 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-16 16:23 - 2013-09-16 14:22 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:11 - 2013-09-16 14:09 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-14 17:09 - 2010-11-25 10:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-14 17:07 - 2010-11-25 11:34 - 00000000 ____D C:\windows\SysWOW64\Macromed
2013-09-13 21:10 - 2012-08-20 18:38 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 21:10 - 2012-08-20 18:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 21:10 - 2011-07-07 10:32 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-13 16:22 - 2013-09-11 16:20 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-12 21:44 - 2013-09-11 20:53 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-12 17:17 - 2013-09-12 14:41 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-12 14:48 - 2010-11-25 02:09 - 00723232 _____ C:\windows\system32\perfh007.dat
2013-09-12 14:48 - 2010-11-25 02:09 - 00158372 _____ C:\windows\system32\perfc007.dat
2013-09-12 14:48 - 2009-07-14 07:13 - 01674052 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-12 14:22 - 2012-09-10 20:06 - 00000000 ____D C:\Users\marita1\AppData\Local\Spotify
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 19:42 - 2012-09-19 22:28 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.minecraft
2013-09-11 16:22 - 2012-10-05 20:58 - 00000000 ____D C:\Users\marita1\AppData\Local\Adobe
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-11 16:20 - 2010-11-25 11:25 - 00000000 ____D C:\ProgramData\McAfee
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-10 14:09 - 2013-09-03 19:36 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:39 - 2012-09-09 17:52 - 00000000 ____D C:\Users\marita1
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-07 18:24 - 2013-09-04 22:12 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-07 13:55 - 2013-09-04 22:06 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-04 22:07 - 2012-12-21 22:10 - 00000000 ____D C:\Users\marita1\AppData\Local\craften.de
2013-09-03 17:24 - 2012-09-09 21:01 - 00000000 ___RD C:\Users\marita1\Desktop\Hauke
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:31 - 2013-02-21 18:32 - 00000000 ____D C:\Users\marita1\Documents\My Games
2013-08-22 18:31 - 2012-10-24 17:22 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock
2013-08-22 14:16 - 2013-07-29 13:42 - 00000000 ____D C:\Users\marita1\Documents\Flight Simulator X-Dateien

ZeroAccess:
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@

Files to move or delete:
====================
C:\Users\Marita\jagex_cl_runescape_LIVE.dat
C:\Users\Marita\jagex_runescape_preferences.dat
C:\Users\Marita\jagex_runescape_preferences2.dat


Some content of TEMP:
====================
C:\Users\marita1\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 10:51

==================== End Of Log ============================

--- --- ---

--- --- ---

HaukeR · 19.09.2013, 18:08

FRST

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by marita1 (administrator) on MARITA-PC on 19-09-2013 19:03:32
Running from C:\Users\marita1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(AMD) C:\windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Spotify Ltd) C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2.exe
() C:\windows\SysWOW64\PnkBstrA.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Nokia) C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe
(SRWare) C:\Program Files (x86)\SRWare Iron\iron.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11448424 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1894696 2010-01-07] (Synaptics Incorporated)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4462496 2010-04-12] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056800 2010-03-18] (Lenovo (Beijing) Limited)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-15] (Spotify Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [EADM] - E:\GAMES\Origin\Origin.exe [3549528 2013-08-30] (Electronic Arts)
HKCU\...\Run: [ImpulseFastStart] - C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [331BigDog] - C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2009-09-15] (Vimicro)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [365936 2010-05-28] ( )
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-11-25] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-06-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [NokiaMServer] - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup [x]
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe [132608 2009-03-30] ()
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [IMBooster] - C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe /warmup [x]
HKLM-x32\...\Run: [FUFAXSTM] - C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348624 2012-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKU\Marita\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [366024 2011-06-29] (IncrediMail, Ltd.)
HKU\Marita\...\Run: [JumiController] - [x]
HKU\Marita\...\Run: [] - [x]
HKU\Marita\...\Run: [NokiaOviSuite2] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [703360 2011-01-31] (Nokia)
HKU\Marita\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1602984 2013-02-25] (Valve Corporation)
HKU\Marita\...\Run: [Akamai NetSession Interface] - C:\Users\Marita\AppData\Local\Akamai\netsession_win.exe [3329824 2012-02-02] (Akamai Technologies, Inc)
HKU\Marita\...\Run: [EPSON BX305 Series] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S5E94.tmp" /EF "HKCU"
HKU\Marita\...\Run: [Epson Stylus Office BX305(Netzwerk)] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S87C5.tmp" /EF "HKCU"
HKU\Marita\...\Policies\system: [DisableTaskMgr] 1
HKU\Marita\...\Policies\system: [DisableRegistryTools] 1
HKU\Marita\...\Policies\Explorer: [NoDesktop] 1
HKU\Marita\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION 
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Manager] - C:\Users\Marita.Marita-PC\M-50-8964-7854-4678\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Service] - C:\Users\Marita.Marita-PC\M-25-6788-7854-2457\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Spotify] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-25] (Spotify Ltd)
HKU\Marita.Marita-PC\...\Run: [Spotify Web Helper] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-25] ()
HKU\Marita.Marita-PC\...\Run: [Windows Firewall] - C:\Users\Marita.Marita-PC\AppData\Local\89776623\svchosts.exe [42496 2012-09-09] ()
HKU\Marita.Marita-PC\...\CurrentVersion\Windows: [Load] C:\Users\MARITA~1.MAR\LOCALS~1\Temp\msuoawy.com <===== ATTENTION
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
ShortcutTarget: Product Registration.lnk -> C:\Users\marita1\AppData\Local\Temp\is-VR3KQ.tmp\ATR1.exe (No File)
Startup: C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Facebook Connect - {11DCAFD6-DDBA-4ADA-998B-996B7B691AE0} - C:\Users\Marita\AppData\Roaming\FBConnect\IE\FBConnect.dll (Facebook Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Battlefield Play4Free - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\battlefieldplay4free@ea.com
FF Extension: No Name - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\WebSiteRecommendation@weliketheweb.com
FF Extension: torntv - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\torntv@torntv.com.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\marita1\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj\1.9_0
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-15] (Akamai Technologies, Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [619472 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 Hamachi2Svc; C:\LogMeIn Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-11-19] ()
R2 UI Assistant Service; C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [241664 2009-03-30] ()

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-08-01] ()
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114128 2012-05-22] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [139360 2012-05-22] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-22] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-22] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-10-11] (Avira GmbH)
R3 jumi; C:\Windows\System32\DRIVERS\jumi.sys [15160 2010-06-03] (Windows (R) Codename Longhorn DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2011-01-05] ()
S0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77688 2006-07-05] (Protection Technology (StarForce))
S0 sfsync02; C:\Windows\System32\drivers\sfsync02.sys [22936 2006-07-10] (Protection Technology)
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [106360 2007-01-12] (Protection Technology (StarForce))
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [207232 2009-11-09] (Vimicro Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 BcmSqlStartupSvc; 
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
U2 IAStorDataMgrSvc; 
U3 IGRS; 
U2 IviRegMgr; 
U2 ReadyComm.DirectRouter; 
U2 RichVideo; 
U3 SQLWriter; 
S3 X6va008; \??\C:\windows\SysWOW64\Drivers\X6va008 [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-19 18:59 - 2013-09-19 18:59 - 00005457 _____ C:\Users\marita1\Desktop\JRT.txt
2013-09-19 18:45 - 2013-09-19 18:45 - 00000000 ____D C:\windows\ERUNT
2013-09-19 18:28 - 2013-09-19 18:34 - 00000000 ____D C:\AdwCleaner
2013-09-19 17:42 - 2013-09-19 17:42 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-19 17:40 - 2013-09-19 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-19 17:39 - 2013-09-19 17:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-19 17:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-19 17:38 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Desktop\JRT.exe
2013-09-19 17:37 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Downloads\JRT.exe
2013-09-19 17:34 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Desktop\adwcleaner.exe
2013-09-19 17:33 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Downloads\adwcleaner.exe
2013-09-19 17:30 - 2013-09-19 17:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\marita1\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00000994 _____ C:\Users\marita1\Desktop\Anno 2070.lnk
2013-09-18 22:21 - 2012-10-25 18:46 - 00381952 _____ C:\Users\marita1\Desktop\AnnoCookie0.3.exe
2013-09-18 22:20 - 2013-09-18 22:20 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anno 2170 - A.R.R.C
2013-09-18 21:05 - 2013-09-19 18:56 - 01073577 _____ C:\windows\WindowsUpdate.log
2013-09-18 21:05 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-18 21:05 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-18 21:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-18 20:55 - 2013-09-18 21:52 - 00000000 ____D C:\Qoobox
2013-09-18 20:55 - 2013-09-18 21:48 - 00000000 ____D C:\windows\erdnt
2013-09-18 19:55 - 2013-09-18 19:53 - 05128653 ____R (Swearware) C:\Users\marita1\Desktop\ComboFix.exe
2013-09-18 19:46 - 2013-09-18 19:53 - 05128653 _____ (Swearware) C:\Users\marita1\Downloads\ComboFix.exe
2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-16 20:31 - 2013-09-19 18:14 - 00021584 _____ C:\windows\PFRO.log
2013-09-16 19:27 - 2013-09-19 18:38 - 00003043 _____ C:\windows\setupact.log
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 14:22 - 2013-09-16 16:23 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:09 - 2013-09-16 14:11 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-12 14:41 - 2013-09-12 17:17 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-12 21:44 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 16:20 - 2013-09-13 16:22 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-04 22:12 - 2013-09-07 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-04 22:06 - 2013-09-07 13:55 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-03 19:36 - 2013-09-10 14:09 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock

==================== One Month Modified Files and Folders =======

2013-09-19 19:03 - 2013-09-18 21:05 - 01073577 _____ C:\windows\WindowsUpdate.log
2013-09-19 18:59 - 2013-09-19 18:59 - 00005457 _____ C:\Users\marita1\Desktop\JRT.txt
2013-09-19 18:48 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-19 18:48 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-19 18:45 - 2013-09-19 18:45 - 00000000 ____D C:\windows\ERUNT
2013-09-19 18:43 - 2012-09-09 20:01 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Skype
2013-09-19 18:42 - 2012-09-09 17:55 - 00000000 ____D C:\Users\marita1\AppData\Local\LogMeIn Hamachi
2013-09-19 18:42 - 2010-11-25 11:29 - 00000000 ____D C:\ProgramData\VeriFace
2013-09-19 18:39 - 2010-12-25 00:13 - 09157228 _____ C:\FaceProv.log
2013-09-19 18:38 - 2013-09-16 19:27 - 00003043 _____ C:\windows\setupact.log
2013-09-19 18:38 - 2011-01-05 17:45 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-19 18:38 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-19 18:34 - 2013-09-19 18:28 - 00000000 ____D C:\AdwCleaner
2013-09-19 18:14 - 2013-09-16 20:31 - 00021584 _____ C:\windows\PFRO.log
2013-09-19 18:09 - 2012-09-02 17:20 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-50-8964-7854-4678
2013-09-19 18:09 - 2012-08-28 15:02 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-25-6788-7854-2457
2013-09-19 18:09 - 2012-08-25 12:22 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-5845-8588-3464
2013-09-19 18:09 - 2012-08-23 20:49 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-7960-8588-3464
2013-09-19 18:09 - 2012-08-21 20:57 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-0-5778-6436-2457
2013-09-19 18:09 - 2012-08-20 12:01 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-6897-8685-3464
2013-09-19 18:08 - 2012-08-20 18:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-19 18:05 - 2011-01-05 17:45 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-19 17:42 - 2013-09-19 17:42 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-19 17:40 - 2013-09-19 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-19 17:38 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Desktop\JRT.exe
2013-09-19 17:38 - 2013-09-19 17:37 - 01029675 _____ (Thisisu) C:\Users\marita1\Downloads\JRT.exe
2013-09-19 17:35 - 2013-09-19 17:30 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\marita1\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-19 17:34 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Desktop\adwcleaner.exe
2013-09-19 17:34 - 2013-09-19 17:33 - 01039554 _____ C:\Users\marita1\Downloads\adwcleaner.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00000994 _____ C:\Users\marita1\Desktop\Anno 2070.lnk
2013-09-18 22:20 - 2013-09-18 22:20 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anno 2170 - A.R.R.C
2013-09-18 21:52 - 2013-09-18 20:55 - 00000000 ____D C:\Qoobox
2013-09-18 21:51 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-18 21:48 - 2013-09-18 20:55 - 00000000 ____D C:\windows\erdnt
2013-09-18 21:42 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-18 20:55 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-09-18 19:53 - 2013-09-18 19:55 - 05128653 ____R (Swearware) C:\Users\marita1\Desktop\ComboFix.exe
2013-09-18 19:53 - 2013-09-18 19:46 - 05128653 _____ (Swearware) C:\Users\marita1\Downloads\ComboFix.exe
2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-17 20:50 - 2012-09-10 19:55 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Spotify
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 17:08 - 2011-05-21 20:09 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-16 16:23 - 2013-09-16 14:22 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:11 - 2013-09-16 14:09 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-14 17:09 - 2010-11-25 10:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-14 17:07 - 2010-11-25 11:34 - 00000000 ____D C:\windows\SysWOW64\Macromed
2013-09-13 21:10 - 2012-08-20 18:38 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-13 21:10 - 2012-08-20 18:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-13 21:10 - 2011-07-07 10:32 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-13 16:22 - 2013-09-11 16:20 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-12 21:44 - 2013-09-11 20:53 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-12 17:17 - 2013-09-12 14:41 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-12 14:48 - 2010-11-25 02:09 - 00723232 _____ C:\windows\system32\perfh007.dat
2013-09-12 14:48 - 2010-11-25 02:09 - 00158372 _____ C:\windows\system32\perfc007.dat
2013-09-12 14:48 - 2009-07-14 07:13 - 01674052 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-12 14:22 - 2012-09-10 20:06 - 00000000 ____D C:\Users\marita1\AppData\Local\Spotify
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 19:42 - 2012-09-19 22:28 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.minecraft
2013-09-11 16:22 - 2012-10-05 20:58 - 00000000 ____D C:\Users\marita1\AppData\Local\Adobe
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-11 16:20 - 2010-11-25 11:25 - 00000000 ____D C:\ProgramData\McAfee
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-10 14:09 - 2013-09-03 19:36 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:39 - 2012-09-09 17:52 - 00000000 ____D C:\Users\marita1
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-07 18:24 - 2013-09-04 22:12 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-07 13:55 - 2013-09-04 22:06 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-04 22:07 - 2012-12-21 22:10 - 00000000 ____D C:\Users\marita1\AppData\Local\craften.de
2013-09-03 17:24 - 2012-09-09 21:01 - 00000000 ___RD C:\Users\marita1\Desktop\Hauke
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:31 - 2013-02-21 18:32 - 00000000 ____D C:\Users\marita1\Documents\My Games
2013-08-22 18:31 - 2012-10-24 17:22 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock
2013-08-22 14:16 - 2013-07-29 13:42 - 00000000 ____D C:\Users\marita1\Documents\Flight Simulator X-Dateien

ZeroAccess:
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@

Files to move or delete:
====================
C:\Users\Marita\jagex_cl_runescape_LIVE.dat
C:\Users\Marita\jagex_runescape_preferences.dat
C:\Users\Marita\jagex_runescape_preferences2.dat


Some content of TEMP:
====================
C:\Users\marita1\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 10:51

==================== End Of Log ============================

--- --- ---

schrauber · 20.09.2013, 10:20

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

HaukeR · 20.09.2013, 19:31

Das log kommt mir so seltsam vor weils so kurz ist

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok

und Checkup

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.73  
 Windows 7 Service Pack 1 x64   
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 WMI entry may not exist for antivirus; attempting automatic update. 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Adobe Flash Player 11.8.800.168  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

schrauber · 21.09.2013, 10:41

Nö passt. Frisches FRST log bitte. Noch PRobleme?

HaukeR · 21.09.2013, 10:54

So hier ist das FRST log

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-09-2013 03
Ran by marita1 (administrator) on MARITA-PC on 21-09-2013 11:48:57
Running from C:\Users\marita1\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\windows\system32\atiesrxx.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(AMD) C:\windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe
(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe
(Spotify Ltd) C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Vimicro) C:\Program Files (x86)\USB Camera\VM331_STI.EXE
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2.exe
() C:\windows\SysWOW64\PnkBstrA.exe
(LogMeIn Inc.) C:\LogMeIn Hamachi\hamachi-2-ui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\tv_x64.exe
( ) C:\Program Files (x86)\LockKey\LockKey.exe
(Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe
(CyberLink Corp.) C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe
(Nokia) C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer.exe
() C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11448424 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2120808 2010-08-20] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1894696 2010-01-07] (Synaptics Incorporated)
HKLM\...\Run: [EnergyUtility] - C:\Program Files (x86)\Lenovo\Energy Management\utility.exe [4462496 2010-04-12] (Lenovo(beijing) Limited)
HKLM\...\Run: [Energy Management] - C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [7056800 2010-03-18] (Lenovo (Beijing) Limited)
HKLM\...\Run: [MRT] - C:\windows\system32\MRT.exe [79143768 2013-09-01] (Microsoft Corporation)
HKCU\...\Run: [Spotify Web Helper] - C:\Users\marita1\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-07-15] (Spotify Ltd)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875944 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [EADM] - E:\GAMES\Origin\Origin.exe [3549528 2013-08-30] (Electronic Arts)
HKCU\...\Run: [ImpulseFastStart] - C:\Program Files (x86)\Stardock\Impulse\Impulse.exe [1717616 2008-10-14] (Stardock Corporation)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-07-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [331BigDog] - C:\Program Files (x86)\USB Camera\VM331_STI.EXE [536576 2009-09-15] (Vimicro)
HKLM-x32\...\Run: [LockKey] - C:\Program Files (x86)\LockKey\LockKey.exe [365936 2010-05-28] ( )
HKLM-x32\...\Run: [VeriFaceManager] - C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [3122528 2010-11-25] (Lenovo)
HKLM-x32\...\Run: [UCam_Menu] - C:\Program Files (x86)\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-20] (CyberLink Corp.)
HKLM-x32\...\Run: [YouCam Mirror Tray icon] - C:\Program Files (x86)\Lenovo\YouCam\YouCamTray.exe [171104 2010-06-30] (CyberLink Corp.)
HKLM-x32\...\Run: [UpdateP2GShortCut] - C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [218408 2008-12-04] (CyberLink Corp.)
HKLM-x32\...\Run: [NokiaMServer] - C:\Program Files (x86)\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles startup [x]
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\T-Mobile Internet Manager 03\UIExec.exe [132608 2009-03-30] ()
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [IMBooster] - C:\Program Files (x86)\Iminent\IMBooster\imbooster.exe /warmup [x]
HKLM-x32\...\Run: [FUFAXSTM] - C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [847872 2009-12-03] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [348624 2012-05-22] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-05-30] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - D:\iTunes\iTunesHelper.exe [421776 2012-06-07] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263512 2012-11-30] ()
HKLM-x32\...\Run: [LogMeIn Hamachi Ui] - C:\LogMeIn Hamachi\hamachi-2-ui.exe [2255184 2013-06-28] (LogMeIn Inc.)
HKU\Marita\...\Run: [IncrediMail] - C:\Program Files (x86)\IncrediMail\bin\IncMail.exe [366024 2011-06-29] (IncrediMail, Ltd.)
HKU\Marita\...\Run: [JumiController] - [x]
HKU\Marita\...\Run: [] - [x]
HKU\Marita\...\Run: [NokiaOviSuite2] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\NokiaOviSuite.exe [703360 2011-01-31] (Nokia)
HKU\Marita\...\Run: [Steam] - C:\Program Files (x86)\Steam\steam.exe [1602984 2013-02-25] (Valve Corporation)
HKU\Marita\...\Run: [Akamai NetSession Interface] - C:\Users\Marita\AppData\Local\Akamai\netsession_win.exe [3329824 2012-02-02] (Akamai Technologies, Inc)
HKU\Marita\...\Run: [EPSON BX305 Series] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S5E94.tmp" /EF "HKCU"
HKU\Marita\...\Run: [Epson Stylus Office BX305(Netzwerk)] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIGJE.EXE /FU "C:\windows\TEMP\E_S87C5.tmp" /EF "HKCU"
HKU\Marita\...\Policies\system: [DisableTaskMgr] 1
HKU\Marita\...\Policies\system: [DisableRegistryTools] 1
HKU\Marita\...\Policies\Explorer: [NoDesktop] 1
HKU\Marita\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION 
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Manager] - C:\Users\Marita.Marita-PC\M-50-8964-7854-4678\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Service] - C:\Users\Marita.Marita-PC\M-25-6788-7854-2457\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Spotify] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Spotify.exe [5576408 2012-08-25] (Spotify Ltd)
HKU\Marita.Marita-PC\...\Run: [Spotify Web Helper] - C:\Users\Marita.Marita-PC\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1193176 2012-08-25] ()
HKU\Marita.Marita-PC\...\CurrentVersion\Windows: [Load] C:\Users\MARITA~1.MAR\LOCALS~1\Temp\msuoawy.com <===== ATTENTION
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\Users\Marita\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Product Registration.lnk
ShortcutTarget: Product Registration.lnk -> C:\Users\marita1\AppData\Local\Temp\is-VR3KQ.tmp\ATR1.exe (No File)
Startup: C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
ShortcutTarget: OpenOffice.org 3.2.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Facebook Connect - {11DCAFD6-DDBA-4ADA-998B-996B7B691AE0} - C:\Users\Marita\AppData\Roaming\FBConnect\IE\FBConnect.dll (Facebook Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION / CyCom Technology Corp.)
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - D:\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.9.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.9.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
FF Extension: Battlefield Play4Free - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\battlefieldplay4free@ea.com
FF Extension: No Name - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\WebSiteRecommendation@weliketheweb.com
FF Extension: torntv - C:\Users\marita1\AppData\Roaming\Mozilla\Firefox\Profiles\0rux5gt3.default\Extensions\torntv@torntv.com.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF HKLM-x32\...\Thunderbird\Extensions: [{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}] - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\

Chrome: 
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: () - C:\Users\marita1\AppData\Local\Google\Chrome\User Data\Default\Extensions\olakgnkoldmagdblaalodobkmeokmgjj\1.9_0
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-15] (Akamai Technologies, Inc.)
R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [619472 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-05-22] (Avira Operations GmbH & Co. KG)
R2 Hamachi2Svc; C:\LogMeIn Hamachi\hamachi-2.exe [2470736 2013-06-28] (LogMeIn Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 PnkBstrA; C:\Windows\SysWow64\PnkBstrA.exe [76888 2012-11-19] ()
R2 UI Assistant Service; C:\Program Files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [241664 2009-03-30] ()

==================== Drivers (Whitelisted) ====================

S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [310984 2012-08-01] ()
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114128 2012-05-22] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [139360 2012-05-22] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-22] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-22] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-10-11] (Avira GmbH)
R3 jumi; C:\Windows\System32\DRIVERS\jumi.sys [15160 2010-06-03] (Windows (R) Codename Longhorn DDK provider)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2011-01-05] ()
S0 sfdrv01a; C:\Windows\System32\drivers\sfdrv01a.sys [77688 2006-07-05] (Protection Technology (StarForce))
S0 sfsync02; C:\Windows\System32\drivers\sfsync02.sys [22936 2006-07-10] (Protection Technology)
R0 sfvfs02; C:\Windows\System32\drivers\sfvfs02.sys [106360 2007-01-12] (Protection Technology (StarForce))
R3 vm331avs; C:\Windows\System32\Drivers\vm331avs.sys [207232 2009-11-09] (Vimicro Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
U3 BcmSqlStartupSvc; 
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EagleX64; \??\C:\windows\system32\drivers\EagleX64.sys [x]
U2 IAStorDataMgrSvc; 
U3 IGRS; 
U2 IviRegMgr; 
U2 ReadyComm.DirectRouter; 
U2 RichVideo; 
U3 SQLWriter; 
S3 X6va008; \??\C:\windows\SysWOW64\Drivers\X6va008 [x]
S1 yitmugol; \??\C:\windows\system32\drivers\yitmugol.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-21 03:05 - 2013-09-21 11:07 - 00006747 _____ C:\windows\IE10_main.log
2013-09-20 18:07 - 2013-09-20 18:07 - 00000000 _____ C:\windows\SysWOW64\shoA75.tmp
2013-09-20 16:48 - 2013-09-20 16:48 - 00000000 ____D C:\windows\system32\MRT
2013-09-20 16:40 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-09-20 16:40 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-09-20 16:40 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-09-20 16:40 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-09-20 16:40 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-09-20 16:40 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-09-20 16:40 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-09-20 16:40 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-09-20 16:40 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-09-20 16:40 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-09-20 16:40 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-09-20 16:40 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-09-20 16:40 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-09-20 16:40 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-09-20 16:40 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-09-20 16:40 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-09-20 16:40 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-09-20 16:40 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-09-20 16:40 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-09-20 16:40 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-09-20 16:40 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-09-20 16:40 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-09-20 16:40 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-09-20 16:40 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-09-20 16:40 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-09-20 16:40 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-09-20 16:40 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-09-20 16:40 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-09-20 16:40 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-09-20 16:40 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-09-20 16:40 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-09-20 16:40 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-09-20 16:28 - 2012-07-26 06:55 - 00785512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\Wdf01000.sys
2013-09-20 16:28 - 2012-07-26 06:55 - 00054376 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdfLdr.sys
2013-09-20 16:28 - 2012-07-26 04:36 - 00009728 _____ (Microsoft Corporation) C:\windows\system32\Wdfres.dll
2013-09-20 16:28 - 2012-06-02 16:35 - 00000003 _____ C:\windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2013-09-20 15:37 - 2012-12-16 19:11 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2013-09-20 15:37 - 2012-12-16 16:45 - 00367616 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2013-09-20 15:37 - 2012-12-16 16:13 - 00295424 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2013-09-20 15:37 - 2012-12-16 16:13 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2013-09-20 15:35 - 2012-07-26 05:08 - 00744448 _____ (Microsoft Corporation) C:\windows\system32\WUDFx.dll
2013-09-20 15:35 - 2012-07-26 05:08 - 00229888 _____ (Microsoft Corporation) C:\windows\system32\WUDFHost.exe
2013-09-20 15:35 - 2012-07-26 05:08 - 00194048 _____ (Microsoft Corporation) C:\windows\system32\WUDFPlatform.dll
2013-09-20 15:35 - 2012-07-26 05:08 - 00084992 _____ (Microsoft Corporation) C:\windows\system32\WUDFSvc.dll
2013-09-20 15:35 - 2012-07-26 05:08 - 00045056 _____ (Microsoft Corporation) C:\windows\system32\WUDFCoinstaller.dll
2013-09-20 15:35 - 2012-07-26 04:26 - 00198656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFRd.sys
2013-09-20 15:35 - 2012-07-26 04:26 - 00087040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFPf.sys
2013-09-20 15:35 - 2012-06-02 16:57 - 00000003 _____ C:\windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2013-09-20 15:23 - 2013-09-20 15:19 - 00891144 _____ C:\Users\marita1\Desktop\SecurityCheck.exe
2013-09-20 15:17 - 2013-09-20 15:19 - 00891144 _____ C:\Users\marita1\Downloads\SecurityCheck.exe
2013-09-20 15:17 - 2013-09-20 15:16 - 02347384 _____ (ESET) C:\Users\marita1\Desktop\esetsmartinstaller_enu.exe
2013-09-20 15:15 - 2013-09-20 15:16 - 02347384 _____ (ESET) C:\Users\marita1\Downloads\esetsmartinstaller_enu.exe
2013-09-19 21:27 - 2013-04-10 08:01 - 00983400 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2013-09-19 21:27 - 2013-04-10 08:01 - 00265064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgmms1.sys
2013-09-19 21:27 - 2011-02-03 13:25 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\cdd.dll
2013-09-19 21:23 - 2012-10-09 20:17 - 00226816 _____ (Microsoft Corporation) C:\windows\system32\dhcpcore6.dll
2013-09-19 21:23 - 2012-10-09 20:17 - 00055296 _____ (Microsoft Corporation) C:\windows\system32\dhcpcsvc6.dll
2013-09-19 21:23 - 2012-10-09 19:40 - 00193536 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcore6.dll
2013-09-19 21:23 - 2012-10-09 19:40 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\dhcpcsvc6.dll
2013-09-19 21:22 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-09-19 21:22 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-09-19 21:22 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-09-19 21:22 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-09-19 21:22 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-09-19 21:22 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-09-19 21:22 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-09-19 21:22 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-09-19 21:22 - 2013-02-15 08:08 - 00044032 _____ (Microsoft Corporation) C:\windows\system32\tsgqec.dll
2013-09-19 21:22 - 2013-02-15 08:06 - 03717632 _____ (Microsoft Corporation) C:\windows\system32\mstscax.dll
2013-09-19 21:22 - 2013-02-15 08:02 - 00158720 _____ (Microsoft Corporation) C:\windows\system32\aaclient.dll
2013-09-19 21:22 - 2013-02-15 06:37 - 03217408 _____ (Microsoft Corporation) C:\windows\SysWOW64\mstscax.dll
2013-09-19 21:22 - 2013-02-15 06:34 - 00131584 _____ (Microsoft Corporation) C:\windows\SysWOW64\aaclient.dll
2013-09-19 21:22 - 2013-02-15 05:25 - 00036864 _____ (Microsoft Corporation) C:\windows\SysWOW64\tsgqec.dll
2013-09-19 21:16 - 2013-02-27 08:02 - 00111448 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2013-09-19 21:16 - 2013-02-27 07:48 - 01930752 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2013-09-19 21:16 - 2013-02-27 07:47 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
2013-09-19 21:16 - 2013-02-27 06:49 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2013-09-19 21:12 - 2013-03-19 07:53 - 00230400 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll
2013-09-19 21:12 - 2013-03-19 07:53 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\wwanprotdim.dll
2013-09-19 21:07 - 2013-04-12 16:45 - 01656680 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ntfs.sys
2013-09-19 21:03 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-09-19 21:03 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-09-19 21:02 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ataport.sys
2013-09-19 20:54 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\windows\system32\ntoskrnl.exe
2013-09-19 20:54 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\windows\system32\ntdll.dll
2013-09-19 20:54 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\windows\system32\wow64win.dll
2013-09-19 20:54 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\windows\system32\wow64.dll
2013-09-19 20:54 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\windows\system32\wow64cpu.dll
2013-09-19 20:54 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\windows\system32\winsrv.dll
2013-09-19 20:54 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\ntvdm64.dll
2013-09-19 20:54 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\windows\system32\kernel32.dll
2013-09-19 20:54 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\KernelBase.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\csrsrv.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\windows\system32\apisetschema.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntkrnlpa.exe
2013-09-19 20:54 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntoskrnl.exe
2013-09-19 20:54 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntdll.dll
2013-09-19 20:54 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\windows\SysWOW64\kernel32.dll
2013-09-19 20:54 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\KernelBase.dll
2013-09-19 20:54 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\windows\SysWOW64\wow32.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\windows\SysWOW64\apisetschema.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\windows\system32\conhost.exe
2013-09-19 20:54 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\windows\system32\smss.exe
2013-09-19 20:54 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\setup16.exe
2013-09-19 20:54 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ntvdm64.dll
2013-09-19 20:54 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\windows\SysWOW64\instnm.exe
2013-09-19 20:54 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\user.exe
2013-09-19 20:54 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-19 20:54 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-19 20:54 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-09-19 20:54 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-09-19 20:54 - 2013-02-12 06:12 - 00019968 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usb8023.sys
2013-09-19 20:54 - 2012-08-22 20:12 - 00950128 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ndis.sys
2013-09-19 20:54 - 2012-07-04 22:26 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\Drivers\RNDISMP.sys
2013-09-19 20:53 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-09-19 20:53 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-09-19 20:53 - 2012-11-01 07:43 - 02002432 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll
2013-09-19 20:53 - 2012-11-01 07:43 - 01882624 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2013-09-19 20:53 - 2012-11-01 06:47 - 01389568 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll
2013-09-19 20:53 - 2012-11-01 06:47 - 01236992 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2013-09-19 20:53 - 2012-10-03 19:44 - 00303104 _____ (Microsoft Corporation) C:\windows\system32\nlasvc.dll
2013-09-19 20:53 - 2012-10-03 19:44 - 00246272 _____ (Microsoft Corporation) C:\windows\system32\netcorehc.dll
2013-09-19 20:53 - 2012-10-03 19:44 - 00216576 _____ (Microsoft Corporation) C:\windows\system32\ncsi.dll
2013-09-19 20:53 - 2012-10-03 19:44 - 00070656 _____ (Microsoft Corporation) C:\windows\system32\nlaapi.dll
2013-09-19 20:53 - 2012-10-03 19:44 - 00018944 _____ (Microsoft Corporation) C:\windows\system32\netevent.dll
2013-09-19 20:53 - 2012-10-03 19:42 - 00569344 _____ (Microsoft Corporation) C:\windows\system32\iphlpsvc.dll
2013-09-19 20:53 - 2012-10-03 18:42 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\netcorehc.dll
2013-09-19 20:53 - 2012-10-03 18:42 - 00156672 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncsi.dll
2013-09-19 20:53 - 2012-10-03 18:42 - 00018944 _____ (Microsoft Corporation) C:\windows\SysWOW64\netevent.dll
2013-09-19 20:53 - 2012-10-03 18:07 - 00045568 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpipreg.sys
2013-09-19 20:53 - 2012-01-13 09:12 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\nlaapi.dll
2013-09-19 20:48 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-09-19 20:48 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-09-19 20:48 - 2012-11-20 07:48 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2013-09-19 20:48 - 2012-11-20 06:51 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2013-09-19 20:48 - 2012-11-02 07:59 - 00478208 _____ (Microsoft Corporation) C:\windows\system32\dpnet.dll
2013-09-19 20:48 - 2012-11-02 07:11 - 00376832 _____ (Microsoft Corporation) C:\windows\SysWOW64\dpnet.dll
2013-09-19 20:45 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys
2013-09-19 20:45 - 2012-11-22 07:44 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll
2013-09-19 20:45 - 2012-11-22 06:45 - 00626688 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll
2013-09-19 20:45 - 2012-08-21 23:01 - 00245760 _____ (Microsoft Corporation) C:\windows\system32\OxpsConverter.exe
2013-09-19 20:44 - 2012-12-07 15:20 - 00441856 _____ (Microsoft Corporation) C:\windows\system32\Wpc.dll
2013-09-19 20:44 - 2012-12-07 15:15 - 02746368 _____ (Microsoft Corporation) C:\windows\system32\gameux.dll
2013-09-19 20:44 - 2012-12-07 14:26 - 00308736 _____ (Microsoft Corporation) C:\windows\SysWOW64\Wpc.dll
2013-09-19 20:44 - 2012-12-07 14:20 - 02576384 _____ (Microsoft Corporation) C:\windows\SysWOW64\gameux.dll
2013-09-19 20:44 - 2012-12-07 13:20 - 00045568 _____ (Microsoft) C:\windows\system32\oflc-nz.rs
2013-09-19 20:44 - 2012-12-07 13:20 - 00044544 _____ (Microsoft) C:\windows\system32\pegibbfc.rs
2013-09-19 20:44 - 2012-12-07 13:20 - 00043520 _____ (Microsoft) C:\windows\system32\csrr.rs
2013-09-19 20:44 - 2012-12-07 13:20 - 00030720 _____ (Microsoft) C:\windows\system32\usk.rs
2013-09-19 20:44 - 2012-12-07 13:20 - 00023552 _____ (Microsoft) C:\windows\system32\oflc.rs
2013-09-19 20:44 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\windows\system32\pegi-pt.rs
2013-09-19 20:44 - 2012-12-07 13:20 - 00020480 _____ (Microsoft) C:\windows\system32\pegi-fi.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00055296 _____ (Microsoft) C:\windows\system32\cero.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00051712 _____ (Microsoft) C:\windows\system32\esrb.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00046592 _____ (Microsoft) C:\windows\system32\fpb.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00040960 _____ (Microsoft) C:\windows\system32\cob-au.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00021504 _____ (Microsoft) C:\windows\system32\grb.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00020480 _____ (Microsoft) C:\windows\system32\pegi.rs
2013-09-19 20:44 - 2012-12-07 13:19 - 00015360 _____ (Microsoft) C:\windows\system32\djctq.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00055296 _____ (Microsoft) C:\windows\SysWOW64\cero.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00051712 _____ (Microsoft) C:\windows\SysWOW64\esrb.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00046592 _____ (Microsoft) C:\windows\SysWOW64\fpb.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00045568 _____ (Microsoft) C:\windows\SysWOW64\oflc-nz.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00044544 _____ (Microsoft) C:\windows\SysWOW64\pegibbfc.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00043520 _____ (Microsoft) C:\windows\SysWOW64\csrr.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00040960 _____ (Microsoft) C:\windows\SysWOW64\cob-au.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00030720 _____ (Microsoft) C:\windows\SysWOW64\usk.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00023552 _____ (Microsoft) C:\windows\SysWOW64\oflc.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00021504 _____ (Microsoft) C:\windows\SysWOW64\grb.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\windows\SysWOW64\pegi-pt.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\windows\SysWOW64\pegi-fi.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00020480 _____ (Microsoft) C:\windows\SysWOW64\pegi.rs
2013-09-19 20:44 - 2012-12-07 12:46 - 00015360 _____ (Microsoft) C:\windows\SysWOW64\djctq.rs
2013-09-19 20:40 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-09-19 20:39 - 2012-11-30 01:17 - 00420064 _____ C:\windows\SysWOW64\locale.nls
2013-09-19 20:39 - 2012-11-30 01:15 - 00420064 _____ C:\windows\system32\locale.nls
2013-09-19 20:39 - 2012-08-11 02:56 - 00715776 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2013-09-19 20:39 - 2012-08-11 01:56 - 00542208 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2013-09-19 20:32 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2013-09-19 20:32 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\windows\system32\shdocvw.dll
2013-09-19 20:32 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2013-09-19 20:32 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\windows\SysWOW64\shdocvw.dll
2013-09-19 20:32 - 2012-09-26 00:47 - 00078336 _____ (Microsoft Corporation) C:\windows\SysWOW64\synceng.dll
2013-09-19 20:32 - 2012-09-26 00:46 - 00095744 _____ (Microsoft Corporation) C:\windows\system32\synceng.dll
2013-09-19 20:31 - 2013-04-26 07:51 - 00751104 _____ (Microsoft Corporation) C:\windows\system32\win32spl.dll
2013-09-19 20:31 - 2013-04-26 06:55 - 00492544 _____ (Microsoft Corporation) C:\windows\SysWOW64\win32spl.dll
2013-09-19 20:31 - 2012-11-23 05:13 - 00068608 _____ (Microsoft Corporation) C:\windows\system32\taskhost.exe
2013-09-19 18:53 - 2013-01-24 08:01 - 00223752 _____ (Microsoft Corporation) C:\windows\system32\Drivers\fvevol.sys
2013-09-19 18:45 - 2013-09-19 18:45 - 00000000 ____D C:\windows\ERUNT
2013-09-19 18:34 - 2013-05-10 07:49 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\cryptdlg.dll
2013-09-19 18:34 - 2013-05-10 05:20 - 00024576 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptdlg.dll
2013-09-19 18:32 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-09-19 18:32 - 2013-05-13 07:50 - 00052224 _____ (Microsoft Corporation) C:\windows\system32\certenc.dll
2013-09-19 18:32 - 2013-05-13 05:43 - 01192448 _____ (Microsoft Corporation) C:\windows\system32\certutil.exe
2013-09-19 18:32 - 2013-05-13 05:08 - 00903168 _____ (Microsoft Corporation) C:\windows\SysWOW64\certutil.exe
2013-09-19 18:32 - 2013-05-13 05:08 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\certenc.dll
2013-09-19 18:32 - 2013-01-03 08:00 - 00288088 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS
2013-09-19 18:32 - 2012-08-22 20:12 - 00376688 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2013-09-19 18:28 - 2013-09-19 18:34 - 00000000 ____D C:\AdwCleaner
2013-09-19 18:21 - 2013-04-10 07:45 - 01545728 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2013-09-19 18:21 - 2013-04-10 07:02 - 01077760 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-09-19 17:42 - 2013-09-19 17:42 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-19 17:40 - 2013-09-19 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-19 17:39 - 2013-09-19 17:40 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-19 17:39 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys
2013-09-19 17:38 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Desktop\JRT.exe
2013-09-19 17:37 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Downloads\JRT.exe
2013-09-19 17:34 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Desktop\adwcleaner.exe
2013-09-19 17:33 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Downloads\adwcleaner.exe
2013-09-19 17:30 - 2013-09-19 17:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\marita1\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00000994 _____ C:\Users\marita1\Desktop\Anno 2070.lnk
2013-09-18 22:21 - 2012-10-25 18:46 - 00381952 _____ C:\Users\marita1\Desktop\AnnoCookie0.3.exe
2013-09-18 22:20 - 2013-09-18 22:20 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anno 2170 - A.R.R.C
2013-09-18 21:05 - 2013-09-21 11:07 - 01670249 _____ C:\windows\WindowsUpdate.log
2013-09-18 21:05 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe
2013-09-18 21:05 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe
2013-09-18 21:05 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe
2013-09-18 21:05 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe
2013-09-18 20:55 - 2013-09-18 21:52 - 00000000 ____D C:\Qoobox
2013-09-18 20:55 - 2013-09-18 21:48 - 00000000 ____D C:\windows\erdnt
2013-09-18 19:55 - 2013-09-18 19:53 - 05128653 ____R (Swearware) C:\Users\marita1\Desktop\ComboFix.exe
2013-09-18 19:46 - 2013-09-18 19:53 - 05128653 _____ (Swearware) C:\Users\marita1\Downloads\ComboFix.exe
2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-16 20:31 - 2013-09-20 21:05 - 00022410 _____ C:\windows\PFRO.log
2013-09-16 19:27 - 2013-09-20 21:05 - 00003155 _____ C:\windows\setupact.log
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 14:22 - 2013-09-16 16:23 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:09 - 2013-09-16 14:11 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-12 14:41 - 2013-09-12 17:17 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-12 21:44 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 16:20 - 2013-09-13 16:22 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-04 22:12 - 2013-09-07 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-04 22:06 - 2013-09-07 13:55 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-03 19:36 - 2013-09-10 14:09 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock

==================== One Month Modified Files and Folders =======

2013-09-21 11:42 - 2012-09-10 19:55 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Spotify
2013-09-21 11:36 - 2013-09-18 21:05 - 01670249 _____ C:\windows\WindowsUpdate.log
2013-09-21 11:08 - 2012-09-10 20:06 - 00000000 ____D C:\Users\marita1\AppData\Local\Spotify
2013-09-21 11:08 - 2012-08-20 18:38 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-09-21 11:08 - 2011-01-05 17:45 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-21 11:08 - 2010-12-25 00:13 - 09185705 _____ C:\FaceProv.log
2013-09-21 11:08 - 2010-11-25 11:29 - 00000000 ____D C:\ProgramData\VeriFace
2013-09-21 11:07 - 2013-09-21 03:05 - 00006747 _____ C:\windows\IE10_main.log
2013-09-21 11:07 - 2012-09-09 20:01 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Skype
2013-09-20 22:04 - 2011-01-05 17:45 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-20 21:16 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-20 21:16 - 2009-07-14 06:45 - 00013424 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-20 21:09 - 2012-09-09 17:55 - 00000000 ____D C:\Users\marita1\AppData\Local\LogMeIn Hamachi
2013-09-20 21:05 - 2013-09-16 20:31 - 00022410 _____ C:\windows\PFRO.log
2013-09-20 21:05 - 2013-09-16 19:27 - 00003155 _____ C:\windows\setupact.log
2013-09-20 21:05 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-09-20 18:18 - 2010-11-25 02:09 - 00723232 _____ C:\windows\system32\perfh007.dat
2013-09-20 18:18 - 2010-11-25 02:09 - 00158372 _____ C:\windows\system32\perfc007.dat
2013-09-20 18:18 - 2009-07-14 07:13 - 01674052 _____ C:\windows\system32\PerfStringBackup.INI
2013-09-20 18:16 - 2012-09-09 17:55 - 00110480 _____ C:\Users\marita1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-09-20 18:12 - 2012-09-09 17:53 - 00000000 ___RD C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-20 18:12 - 2012-09-09 17:53 - 00000000 ___RD C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-20 18:10 - 2009-07-14 06:45 - 00398032 _____ C:\windows\system32\FNTCACHE.DAT
2013-09-20 18:09 - 2012-05-22 13:18 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-09-20 18:09 - 2012-05-22 13:18 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-09-20 18:08 - 2012-09-09 17:34 - 00000000 ____D C:\Users\Marita.Marita-PC\AppData\Local\89776623
2013-09-20 18:07 - 2013-09-20 18:07 - 00000000 _____ C:\windows\SysWOW64\shoA75.tmp
2013-09-20 18:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-09-20 18:03 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-09-20 18:02 - 2009-07-29 09:23 - 00000000 ____D C:\Program Files\Windows Journal
2013-09-20 17:37 - 2011-01-09 15:38 - 01701670 _____ C:\windows\SysWOW64\PerfStringBackup.INI
2013-09-20 17:37 - 2011-01-09 15:38 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-20 16:48 - 2013-09-20 16:48 - 00000000 ____D C:\windows\system32\MRT
2013-09-20 15:19 - 2013-09-20 15:23 - 00891144 _____ C:\Users\marita1\Desktop\SecurityCheck.exe
2013-09-20 15:19 - 2013-09-20 15:17 - 00891144 _____ C:\Users\marita1\Downloads\SecurityCheck.exe
2013-09-20 15:16 - 2013-09-20 15:17 - 02347384 _____ (ESET) C:\Users\marita1\Desktop\esetsmartinstaller_enu.exe
2013-09-20 15:16 - 2013-09-20 15:15 - 02347384 _____ (ESET) C:\Users\marita1\Downloads\esetsmartinstaller_enu.exe
2013-09-19 20:13 - 2012-08-20 18:38 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-09-19 20:12 - 2012-08-20 18:38 - 00692616 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-09-19 20:12 - 2011-07-07 10:32 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-19 18:45 - 2013-09-19 18:45 - 00000000 ____D C:\windows\ERUNT
2013-09-19 18:34 - 2013-09-19 18:28 - 00000000 ____D C:\AdwCleaner
2013-09-19 18:32 - 2010-12-30 19:10 - 00000000 ____D C:\ProgramData\ICQ
2013-09-19 18:09 - 2012-09-02 17:20 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-50-8964-7854-4678
2013-09-19 18:09 - 2012-08-28 15:02 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-25-6788-7854-2457
2013-09-19 18:09 - 2012-08-25 12:22 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-5845-8588-3464
2013-09-19 18:09 - 2012-08-23 20:49 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-7960-8588-3464
2013-09-19 18:09 - 2012-08-21 20:57 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-0-5778-6436-2457
2013-09-19 18:09 - 2012-08-20 12:01 - 00000000 _RSHD C:\Users\Marita.Marita-PC\M-10-6897-8685-3464
2013-09-19 17:42 - 2013-09-19 17:42 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:40 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-19 17:40 - 2013-09-19 17:40 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-19 17:40 - 2013-09-19 17:39 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-19 17:38 - 2013-09-19 17:38 - 01029675 _____ (Thisisu) C:\Users\marita1\Desktop\JRT.exe
2013-09-19 17:38 - 2013-09-19 17:37 - 01029675 _____ (Thisisu) C:\Users\marita1\Downloads\JRT.exe
2013-09-19 17:35 - 2013-09-19 17:30 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\marita1\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-19 17:34 - 2013-09-19 17:34 - 01039554 _____ C:\Users\marita1\Desktop\adwcleaner.exe
2013-09-19 17:34 - 2013-09-19 17:33 - 01039554 _____ C:\Users\marita1\Downloads\adwcleaner.exe
2013-09-18 22:21 - 2013-09-18 22:21 - 00000994 _____ C:\Users\marita1\Desktop\Anno 2070.lnk
2013-09-18 22:20 - 2013-09-18 22:20 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Anno 2170 - A.R.R.C
2013-09-18 21:52 - 2013-09-18 20:55 - 00000000 ____D C:\Qoobox
2013-09-18 21:51 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-18 21:48 - 2013-09-18 20:55 - 00000000 ____D C:\windows\erdnt
2013-09-18 21:42 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini
2013-09-18 20:55 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-09-18 19:53 - 2013-09-18 19:55 - 05128653 ____R (Swearware) C:\Users\marita1\Desktop\ComboFix.exe
2013-09-18 19:53 - 2013-09-18 19:46 - 05128653 _____ (Swearware) C:\Users\marita1\Downloads\ComboFix.exe
2013-09-17 22:18 - 2013-09-17 22:18 - 00000000 ____D C:\FRST
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Downloads\FRST64.exe
2013-09-17 22:15 - 2013-09-17 22:15 - 01950524 _____ (Farbar) C:\Users\marita1\Desktop\FRST64.exe
2013-09-16 19:27 - 2013-09-16 19:27 - 00000000 _____ C:\windows\setuperr.log
2013-09-16 17:08 - 2011-05-21 20:09 - 00000000 ____D C:\Program Files (x86)\Steam
2013-09-16 16:23 - 2013-09-16 14:22 - 278232829 _____ C:\Users\marita1\Downloads\Setup_Anno2170_A.R.R.C._v2.06.exe
2013-09-16 14:11 - 2013-09-16 14:09 - 00083540 _____ C:\Users\marita1\Downloads\AnnoCookie_v0.30.zip
2013-09-15 22:00 - 2013-09-15 22:00 - 00000000 ____D C:\Program Files (x86)\Ubisoft
2013-09-14 21:23 - 2013-09-14 21:23 - 00003080 _____ C:\windows\System32\Tasks\{6C2172F1-0D6C-4949-8275-53E56E78E923}
2013-09-14 17:14 - 2013-09-14 17:14 - 00000655 _____ C:\Users\Public\Desktop\MDK2.lnk
2013-09-14 17:09 - 2010-11-25 10:50 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-09-14 17:07 - 2010-11-25 11:34 - 00000000 ____D C:\windows\SysWOW64\Macromed
2013-09-13 16:22 - 2013-09-13 16:22 - 00002046 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk
2013-09-13 16:22 - 2013-09-11 16:20 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-09-12 21:44 - 2013-09-11 20:53 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Audacity
2013-09-12 17:17 - 2013-09-12 14:41 - 00000000 ____D C:\Users\marita1\Desktop\GL
2013-09-11 21:28 - 2013-09-11 21:28 - 00000000 ____D C:\Program Files (x86)\Lame For Audacity
2013-09-11 20:53 - 2013-09-11 20:53 - 00000553 _____ C:\Users\Public\Desktop\Audacity.lnk
2013-09-11 19:42 - 2012-09-19 22:28 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.minecraft
2013-09-11 16:22 - 2012-10-05 20:58 - 00000000 ____D C:\Users\marita1\AppData\Local\Adobe
2013-09-11 16:20 - 2013-09-11 16:20 - 00000000 ____D C:\ProgramData\McAfee Security Scan
2013-09-11 16:20 - 2010-11-25 11:25 - 00000000 ____D C:\ProgramData\McAfee
2013-09-10 19:40 - 2013-09-10 19:40 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Blender Foundation
2013-09-10 14:09 - 2013-09-03 19:36 - 00014816 _____ C:\Users\marita1\Desktop\BEWERBUNG.odt
2013-09-09 21:39 - 2013-09-09 21:39 - 00000000 ____D C:\Users\marita1\.thumbnails
2013-09-09 21:39 - 2012-09-09 17:52 - 00000000 ____D C:\Users\marita1
2013-09-09 21:37 - 2013-09-09 21:37 - 00000587 _____ C:\Users\Public\Desktop\Blender.lnk
2013-09-07 18:24 - 2013-09-04 22:12 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Craften Terminal
2013-09-07 13:55 - 2013-09-04 22:06 - 00000706 _____ C:\Users\Public\Desktop\Craften Terminal.lnk
2013-09-04 22:07 - 2012-12-21 22:10 - 00000000 ____D C:\Users\marita1\AppData\Local\craften.de
2013-09-03 17:24 - 2012-09-09 21:01 - 00000000 ___RD C:\Users\marita1\Desktop\Hauke
2013-09-01 17:08 - 2010-12-26 18:27 - 79143768 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-09-01 16:56 - 2013-09-01 16:56 - 00000000 ____D C:\Users\marita1\AppData\Roaming\.mono
2013-08-22 21:30 - 2013-08-22 21:30 - 00000000 ____D C:\Users\marita1\Documents\Ascaron Entertainment
2013-08-22 21:21 - 2013-08-22 21:21 - 00000676 _____ C:\Users\marita1\Desktop\Darkstar One.lnk
2013-08-22 18:31 - 2013-02-21 18:32 - 00000000 ____D C:\Users\marita1\Documents\My Games
2013-08-22 18:31 - 2012-10-24 17:22 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-08-22 18:24 - 2013-08-22 18:24 - 00000000 ____D C:\Users\marita1\AppData\Roaming\Stardock
2013-08-22 18:23 - 2013-08-22 18:23 - 00001106 _____ C:\Users\Public\Desktop\Impulse.lnk
2013-08-22 18:23 - 2013-08-22 18:23 - 00000000 __HDC C:\ProgramData\{749D76AB-9E81-4537-9AA0-EA64477AFC5A}
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\ProgramData\Stardock
2013-08-22 18:21 - 2013-08-22 18:21 - 00000000 ____D C:\Program Files (x86)\Stardock
2013-08-22 17:49 - 2013-08-22 17:49 - 00000000 ____D C:\Users\marita1\AppData\Local\Ironclad Games
2013-08-22 17:35 - 2013-08-22 17:35 - 00000000 ___HD C:\ProgramData\{A4B500C8-F3EB-4AD9-9762-515CCA35FD16}
2013-08-22 17:27 - 2013-08-22 17:27 - 00000000 ____D C:\Users\marita1\AppData\Local\Stardock
2013-08-22 14:16 - 2013-07-29 13:42 - 00000000 ____D C:\Users\marita1\Documents\Flight Simulator X-Dateien

ZeroAccess:
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@

Files to move or delete:
====================
C:\Users\Marita\jagex_cl_runescape_LIVE.dat
C:\Users\Marita\jagex_runescape_preferences.dat
C:\Users\Marita\jagex_runescape_preferences2.dat


Some content of TEMP:
====================
C:\Users\marita1\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-11 10:51

==================== End Of Log ============================

--- --- ---

schrauber · 21.09.2013, 16:40

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

HKU\Marita\...\Policies\system: [DisableTaskMgr] 1
HKU\Marita\...\Policies\system: [DisableRegistryTools] 1
HKU\Marita\...\Policies\Explorer: [NoDesktop] 1
HKU\Marita\...\Winlogon: [Shell] Explorer.exe <==== ATTENTION 
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Manager] - C:\Users\Marita.Marita-PC\M-50-8964-7854-4678\winmgr.exe
HKU\Marita.Marita-PC\...\Run: [Microsoft Windows Service] - C:\Users\Marita.Marita-PC\M-25-6788-7854-2457\winmgr.exe
C:\Users\Marita.Marita-PC\M-50-8964-7854-4678
C:\Users\Marita.Marita-PC\M-25-6788-7854-2457
HKU\Marita.Marita-PC\...\CurrentVersion\Windows: [Load] C:\Users\MARITA~1.MAR\LOCALS~1\Temp\msuoawy.com <===== ATTENTION
C:\Users\MARITA~1.MAR\LOCALS~1\Temp\msuoawy.com
S3 X6va008; \??\C:\windows\SysWOW64\Drivers\X6va008 [x]
S1 yitmugol; \??\C:\windows\system32\drivers\yitmugol.sys [x]
ZeroAccess:
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\@
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\n
C:\Users\Marita.Marita-PC\AppData\Local\{45be79c4-a4d7-75f6-a6dc-dfd5d6a042cb}\U\00000004.@

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

und ein frisches FRST log bitte.

18.09.2013, 18:05	#6
schrauber /// the machine /// TB-Ausbilder	TR/ATRAPS.Gen2 Virus/Trojaner Das ist kein Setup und keine Installation. Das ist ein Standalone Tool, einfach Doppelklick und es läuft. __________________ --> TR/ATRAPS.Gen2 Virus/Trojaner

21.09.2013, 10:41	#13
schrauber /// the machine /// TB-Ausbilder	TR/ATRAPS.Gen2 Virus/Trojaner Nö passt. Frisches FRST log bitte. Noch PRobleme? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

TR/ATRAPS.Gen2 Virus/Trojaner

Plagegeister aller Art und deren Bekämpfung: TR/ATRAPS.Gen2 Virus/Trojaner