von google-suche zu ihavenet.com oder anderen Werbeseiten

abimama · 25.09.2013, 10:34

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-09-2013
Ran by studentin mama at 2013-09-25 11:30:46 Run:2
Running from C:\Users\studentin mama\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKCU - URL hxxp://search.chatzum.com/?q={searchTerms}
SearchScopes: HKCU - TopResultURLFallback hxxp://search.chatzum.com/?q={searchTerms}
2013-09-24 08:03 - 2013-09-25 09:03 - 00000316 _____ C:\Windows\Tasks\UpdaterEX.job
Task: C:\Windows\Tasks\UpdaterEX.job => C:\Users\STUDEN~1\AppData\Roaming\UPDATE~1\UPDATE~1\UPDATE~1.EXE
C:\Users\STUDEN~1\AppData\Roaming\UPDATE~1
C:\Users\studentin mama\Downloads\Bibi_Blocksberg_mp3_Hoerbuch_1_85.exe
C:\Windows\Tasks\UpdaterEX.job
         
*****************

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\URL => Value deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\TopResultURLFallback => Value deleted successfully.
C:\Windows\Tasks\UpdaterEX.job => Moved successfully.
C:\Windows\Tasks\UpdaterEX.job not found.
C:\Users\STUDEN~1\AppData\Roaming\UPDATE~1 => Moved successfully.
C:\Users\studentin mama\Downloads\Bibi_Blocksberg_mp3_Hoerbuch_1_85.exe => Moved successfully.
"C:\Windows\Tasks\UpdaterEX.job" => File/Directory not found.

==== End of Fixlog ====

FRST.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2013
Ran by studentin mama (administrator) on STUDENTINMAMA on 25-09-2013 11:31:14
Running from C:\Users\studentin mama\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2011-10-30] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-09] (IDT, Inc.)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKCU\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [434168 2012-05-18] (TomTom)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKCU\...\Run: [EPSON Stylus DX5000 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Users\STUDEN~1\AppData\Local\Temp\E_S4C5B.tmp" /EF "HKCU"
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
MountPoints2: {2c95361d-2ce3-11e1-9892-f1a06df124b6} - G:\Setup.exe
MountPoints2: {4b0a9f3a-eeb7-11e0-9f2b-806e6f6e6963} - E:\DocStart.Exe "index.pdf"
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-04-16] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [602168 2010-06-29] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-20] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [548864 2009-02-04] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Gast\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
HKU\Gast\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Gast\...\Run: [EPSON Stylus DX5000 Series] - C:\Users\Gast\AppData\Local\Temp\E_SC310.tmp [106 2012-03-27] ()
HKU\Kinder\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Kinder\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Kinder\...\Run: [EPSON Stylus DX5000 Series] - C:\Users\Kinder\AppData\Local\Temp\E_SA18C.tmp [106 2013-03-10] ()
AppInit_DLLs:    [0 ] ()
Startup: C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {22BC9D89-4AFD-4FD9-93D7-FDC19F581E42} URL = hxxp://searchya.com/?chnl=ft-102&s=1&cr=1395955839&cd=2XzutAtN2Y1L1Qzu0E0CyDyD0FzytAyE0AyBzy0FyD0CtD0DyEtN0D0TzutBtDtCtBtDtAtDyB&q={searchTerms}
SearchScopes: HKCU - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU -  No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\studentin mama\AppData\Roaming\Mozilla\Firefox\Profiles\cknca95t.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\studentin mama\AppData\Roaming\Mozilla\Firefox\Profiles\cknca95t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

Chrome: 
=======
CHR Extension: () - C:\Users\STUDEN~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gladcbhcbkdeddbidiblppadjdjalidb\1.6
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [27192 2010-06-29] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 vpnva; system32\DRIVERS\vpnva64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-25 09:04 - 2013-09-25 09:04 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-24 14:34 - 2013-09-24 14:34 - 02347384 _____ (ESET) C:\Users\studentin mama\Downloads\esetsmartinstaller_enu.exe
2013-09-24 14:06 - 2013-09-24 14:06 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-24 14:06 - 2013-09-24 14:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-24 14:06 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-24 14:05 - 2013-09-24 14:05 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\studentin mama\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-24 13:18 - 2013-09-24 13:18 - 01042066 _____ C:\Users\studentin mama\Downloads\adwcleaner(1).exe
2013-09-24 12:27 - 2013-09-24 12:30 - 00065349 _____ C:\Users\studentin mama\Downloads\Addition.txt
2013-09-24 12:25 - 2013-09-24 12:25 - 00000000 ____D C:\FRST
2013-09-24 12:24 - 2013-09-24 12:25 - 01955802 _____ (Farbar) C:\Users\studentin mama\Desktop\FRST64.exe
2013-09-24 11:28 - 2013-09-24 11:28 - 00129080 _____ C:\Users\studentin mama\Downloads\Extras.Txt
2013-09-24 09:06 - 2013-09-24 12:25 - 00000002 _____ C:\Users\studentin mama\Downloads\OTL.Txt
2013-09-24 08:36 - 2013-09-24 08:36 - 00602112 _____ (OldTimer Tools) C:\Users\studentin mama\Downloads\OTL.exe
2013-09-24 08:20 - 2013-09-24 08:20 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-24 08:20 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-24 08:18 - 2013-09-24 08:18 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0 (1).exe
2013-09-24 08:09 - 2013-09-25 11:25 - 00000280 _____ C:\Windows\setupact.log
2013-09-24 08:09 - 2013-09-25 11:24 - 00019908 _____ C:\Windows\PFRO.log
2013-09-24 08:09 - 2013-09-24 08:09 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 08:07 - 2013-09-24 08:07 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0.exe
2013-09-24 08:03 - 2013-09-24 08:14 - 00000000 ____D C:\Users\studentin mama\AppData\Local\avgchrome
2013-09-24 08:03 - 2013-09-24 08:03 - 00003284 _____ C:\Windows\System32\Tasks\UpdaterEX
2013-09-24 08:02 - 2013-09-24 08:02 - 22404568 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox_Setup [1].exe
2013-09-24 08:02 - 2013-09-24 08:02 - 00001874 _____ C:\Users\studentin mama\Desktop\Search.lnk
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-23 18:23 - 2013-09-23 18:23 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-09-23 18:23 - 2013-09-23 18:23 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 18:23 - 2013-09-23 18:23 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 18:22 - 2013-09-23 18:22 - 04454952 _____ (Piriform Ltd) C:\Users\studentin mama\Downloads\ccsetup405.exe
2013-09-22 13:51 - 2013-09-24 13:21 - 00000000 ____D C:\AdwCleaner
2013-09-22 13:51 - 2013-09-22 13:51 - 01039554 _____ C:\Users\studentin mama\Downloads\adwcleaner.exe
2013-09-21 15:45 - 2013-09-21 15:45 - 98547399 _____ C:\Windows\SysWOW64\㔼䛶皴#
2013-09-21 12:44 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-20 19:21 - 2013-09-25 11:25 - 00000330 _____ C:\Windows\Tasks\Jjjuxgi.job
2013-09-20 19:21 - 2013-09-20 19:21 - 00270336 __RSH C:\Windows\SysWOW64\XPSViewer5.dll
2013-09-20 19:21 - 2013-09-20 19:21 - 00002610 _____ C:\Windows\System32\Tasks\Jjjuxgi
2013-09-19 16:20 - 2013-09-24 06:59 - 00015673 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Lehrgang Mimen für Wettbewerbe.xlsx
2013-09-19 16:12 - 2013-09-24 07:00 - 00015771 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Grundlehrgang ND.xlsx
2013-09-16 12:40 - 2013-09-25 09:10 - 69933798 _____ C:\Users\studentin mama\Desktop\Documents\Klassenfahrt Nieblum.pptx
2013-09-16 09:42 - 2013-09-16 09:42 - 00017667 _____ C:\Users\studentin mama\Downloads\StudiSoft_ Bestaetigung der Bestellung  0-00001349.eml
2013-09-16 00:03 - 2012-12-10 15:00 - 00112080 ____R (Cisco Systems, Inc.) C:\Windows\system32\Drivers\acsock64.sys
2013-09-16 00:02 - 2013-09-16 00:02 - 02719064 _____ (Cisco Systems, Inc.) C:\Users\studentin mama\Downloads\anyconnect-win-3.0.11042-web-deploy-k9(5).exe
2013-09-16 00:00 - 2013-09-16 00:00 - 00000000 ____D C:\ProgramData\Oracle
2013-09-16 00:00 - 2013-09-15 23:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-15 23:56 - 2013-09-15 23:56 - 00913832 _____ (Oracle Corporation) C:\Users\studentin mama\Downloads\jxpiinstall(1).exe
2013-09-11 23:26 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 23:26 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 23:26 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 23:26 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 23:26 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 23:26 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 23:26 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-11 23:26 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-11 23:26 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 23:26 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-11 23:26 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-11 23:26 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 17:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 17:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 17:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 17:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 17:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 17:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 17:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 17:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 17:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 17:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 17:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 17:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 17:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 17:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 17:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 17:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-10 06:41 - 2013-09-10 06:41 - 96866131 _____ C:\Windows\SysWOW64\炙皴¢
2013-09-06 20:47 - 2013-09-06 20:55 - 296266475 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.wmv
2013-09-06 18:53 - 2013-09-06 19:07 - 290211901 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.wmv
2013-09-06 16:44 - 2013-09-06 17:19 - 336720539 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.wmv
2013-09-06 16:44 - 2013-09-06 17:19 - 246707835 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.wmv
2013-09-06 13:17 - 2013-09-06 14:17 - 215862364 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.flv
2013-09-06 13:16 - 2013-09-06 14:15 - 213279948 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.flv
2013-09-06 13:07 - 2013-09-06 13:23 - 239375517 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.flv
2013-09-06 13:06 - 2013-09-06 13:23 - 185639600 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.flv
2013-09-03 09:09 - 2013-09-03 09:09 - 95452537 _____ C:\Windows\SysWOW64\壥䢖皴¹
2013-08-31 12:02 - 2013-08-31 12:02 - 00000000 ____D C:\Users\studentin mama\AppData\Local\{5122E9B6-E1E9-4931-A1D5-26F83E1022FB}
2013-08-29 22:03 - 2013-08-29 22:41 - 00013128 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand September 2013.xlsx
2013-08-28 18:18 - 2013-08-28 18:18 - 00689724 _____ C:\Users\studentin mama\Desktop\tmnt_stundenplan_000 Copy.wwf

==================== One Month Modified Files and Folders =======

2013-09-25 11:26 - 2013-03-29 14:31 - 00000358 _____ C:\Windows\Tasks\dsmonitor.job
2013-09-25 11:26 - 2012-02-26 15:04 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-25 11:25 - 2013-09-24 08:09 - 00000280 _____ C:\Windows\setupact.log
2013-09-25 11:25 - 2013-09-20 19:21 - 00000330 _____ C:\Windows\Tasks\Jjjuxgi.job
2013-09-25 11:25 - 2013-05-20 16:04 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-25 11:25 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-25 11:24 - 2013-09-24 08:09 - 00019908 _____ C:\Windows\PFRO.log
2013-09-25 09:24 - 2011-03-10 02:07 - 01462411 _____ C:\Windows\WindowsUpdate.log
2013-09-25 09:21 - 2010-07-31 19:11 - 00697098 _____ C:\Windows\system32\perfh007.dat
2013-09-25 09:21 - 2010-07-31 19:11 - 00148362 _____ C:\Windows\system32\perfc007.dat
2013-09-25 09:21 - 2009-07-14 07:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-25 09:20 - 2012-02-26 15:04 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-25 09:10 - 2013-09-16 12:40 - 69933798 _____ C:\Users\studentin mama\Desktop\Documents\Klassenfahrt Nieblum.pptx
2013-09-25 09:10 - 2011-10-31 17:48 - 00000356 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-09-25 09:04 - 2013-09-25 09:04 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-25 09:04 - 2011-10-04 16:11 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Adobe
2013-09-25 09:04 - 2010-07-31 11:07 - 00000000 ____D C:\ProgramData\Adobe
2013-09-25 09:04 - 2010-07-31 11:07 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-25 08:57 - 2013-05-28 01:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-25 07:02 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-25 07:02 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-24 22:51 - 2011-10-04 15:20 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Skype
2013-09-24 14:34 - 2013-09-24 14:34 - 02347384 _____ (ESET) C:\Users\studentin mama\Downloads\esetsmartinstaller_enu.exe
2013-09-24 14:06 - 2013-09-24 14:06 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-24 14:06 - 2013-09-24 14:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-24 14:05 - 2013-09-24 14:05 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\studentin mama\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-24 13:21 - 2013-09-22 13:51 - 00000000 ____D C:\AdwCleaner
2013-09-24 13:18 - 2013-09-24 13:18 - 01042066 _____ C:\Users\studentin mama\Downloads\adwcleaner(1).exe
2013-09-24 12:30 - 2013-09-24 12:27 - 00065349 _____ C:\Users\studentin mama\Downloads\Addition.txt
2013-09-24 12:25 - 2013-09-24 12:25 - 00000000 ____D C:\FRST
2013-09-24 12:25 - 2013-09-24 12:24 - 01955802 _____ (Farbar) C:\Users\studentin mama\Desktop\FRST64.exe
2013-09-24 12:25 - 2013-09-24 09:06 - 00000002 _____ C:\Users\studentin mama\Downloads\OTL.Txt
2013-09-24 11:53 - 2013-01-09 20:35 - 00003986 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D3FEFDA5-19CA-46DA-9710-E509D83A4478}
2013-09-24 11:28 - 2013-09-24 11:28 - 00129080 _____ C:\Users\studentin mama\Downloads\Extras.Txt
2013-09-24 08:36 - 2013-09-24 08:36 - 00602112 _____ (OldTimer Tools) C:\Users\studentin mama\Downloads\OTL.exe
2013-09-24 08:20 - 2013-09-24 08:20 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-24 08:20 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-24 08:20 - 2013-09-21 12:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-24 08:18 - 2013-09-24 08:18 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0 (1).exe
2013-09-24 08:17 - 2011-10-04 13:46 - 00000000 ___RD C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-24 08:14 - 2013-09-24 08:03 - 00000000 ____D C:\Users\studentin mama\AppData\Local\avgchrome
2013-09-24 08:09 - 2013-09-24 08:09 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 08:07 - 2013-09-24 08:07 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0.exe
2013-09-24 08:03 - 2013-09-24 08:03 - 00003284 _____ C:\Windows\System32\Tasks\UpdaterEX
2013-09-24 08:03 - 2011-10-07 23:01 - 00000000 ____D C:\Users\studentin mama\AppData\Local\CrashDumps
2013-09-24 08:02 - 2013-09-24 08:02 - 22404568 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox_Setup [1].exe
2013-09-24 08:02 - 2013-09-24 08:02 - 00001874 _____ C:\Users\studentin mama\Desktop\Search.lnk
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-24 07:56 - 2012-11-24 02:34 - 00011357 _____ C:\Users\studentin mama\Desktop\Documents\wortpassme.xlsx
2013-09-24 07:00 - 2013-09-19 16:12 - 00015771 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Grundlehrgang ND.xlsx
2013-09-24 06:59 - 2013-09-19 16:20 - 00015673 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Lehrgang Mimen für Wettbewerbe.xlsx
2013-09-23 18:26 - 2013-04-27 10:51 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-09-23 18:25 - 2012-02-03 22:18 - 00000000 ____D C:\Windows\Minidump
2013-09-23 18:25 - 2009-09-07 03:57 - 00000000 ____D C:\Windows\Panther
2013-09-23 18:23 - 2013-09-23 18:23 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-09-23 18:23 - 2013-09-23 18:23 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 18:23 - 2013-09-23 18:23 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 18:22 - 2013-09-23 18:22 - 04454952 _____ (Piriform Ltd) C:\Users\studentin mama\Downloads\ccsetup405.exe
2013-09-22 13:53 - 2013-03-29 14:31 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Uniblue
2013-09-22 13:53 - 2013-03-29 14:31 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-09-22 13:53 - 2011-11-10 21:04 - 00000000 ____D C:\ProgramData\ICQ
2013-09-22 13:51 - 2013-09-22 13:51 - 01039554 _____ C:\Users\studentin mama\Downloads\adwcleaner.exe
2013-09-21 16:29 - 2013-03-05 22:06 - 00000000 ____D C:\Users\Kinder\AppData\Local\Mozilla
2013-09-21 15:45 - 2013-09-21 15:45 - 98547399 _____ C:\Windows\SysWOW64\㔼䛶皴#
2013-09-21 12:45 - 2011-10-04 13:52 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Mozilla
2013-09-20 19:21 - 2013-09-20 19:21 - 00270336 __RSH C:\Windows\SysWOW64\XPSViewer5.dll
2013-09-20 19:21 - 2013-09-20 19:21 - 00002610 _____ C:\Windows\System32\Tasks\Jjjuxgi
2013-09-18 14:37 - 2011-11-09 22:07 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-18 14:37 - 2011-10-05 12:45 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-17 16:45 - 2013-06-16 17:41 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-16 09:42 - 2013-09-16 09:42 - 00017667 _____ C:\Users\studentin mama\Downloads\StudiSoft_ Bestaetigung der Bestellung  0-00001349.eml
2013-09-16 00:02 - 2013-09-16 00:02 - 02719064 _____ (Cisco Systems, Inc.) C:\Users\studentin mama\Downloads\anyconnect-win-3.0.11042-web-deploy-k9(5).exe
2013-09-16 00:00 - 2013-09-16 00:00 - 00000000 ____D C:\ProgramData\Oracle
2013-09-15 23:59 - 2013-09-16 00:00 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-15 23:59 - 2012-06-02 10:17 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-09-15 23:59 - 2012-06-02 10:17 - 00000000 ____D C:\Program Files (x86)\Java
2013-09-15 23:59 - 2010-07-31 12:09 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-09-15 23:56 - 2013-09-15 23:56 - 00913832 _____ (Oracle Corporation) C:\Users\studentin mama\Downloads\jxpiinstall(1).exe
2013-09-12 18:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 13:56 - 2013-03-03 20:03 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 13:56 - 2013-03-03 20:03 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 12:03 - 2011-10-04 13:46 - 00000000 ___RD C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:50 - 2009-07-14 06:45 - 00397528 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 23:26 - 2011-10-04 14:15 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 16:57 - 2013-05-28 01:13 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-11 16:57 - 2013-04-24 09:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-11 16:57 - 2013-04-24 09:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-10 06:41 - 2013-09-10 06:41 - 96866131 _____ C:\Windows\SysWOW64\炙皴¢
2013-09-06 20:55 - 2013-09-06 20:47 - 296266475 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.wmv
2013-09-06 19:07 - 2013-09-06 18:53 - 290211901 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.wmv
2013-09-06 17:19 - 2013-09-06 16:44 - 336720539 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.wmv
2013-09-06 17:19 - 2013-09-06 16:44 - 246707835 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.wmv
2013-09-06 14:17 - 2013-09-06 13:17 - 215862364 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.flv
2013-09-06 14:15 - 2013-09-06 13:16 - 213279948 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.flv
2013-09-06 13:23 - 2013-09-06 13:07 - 239375517 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.flv
2013-09-06 13:23 - 2013-09-06 13:06 - 185639600 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.flv
2013-09-05 18:12 - 2012-11-26 23:59 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-05 18:12 - 2011-10-04 15:20 - 00000000 ____D C:\ProgramData\Skype
2013-09-03 19:06 - 2011-10-08 21:08 - 00000000 ____D C:\Users\studentin mama\Desktop\Documents\OpenTTD
2013-09-03 18:36 - 2012-03-16 21:50 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\DivX
2013-09-03 18:34 - 2011-10-30 20:39 - 00003584 _____ C:\Users\studentin mama\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-03 09:09 - 2013-09-03 09:09 - 95452537 _____ C:\Windows\SysWOW64\壥䢖皴¹
2013-08-31 12:02 - 2013-08-31 12:02 - 00000000 ____D C:\Users\studentin mama\AppData\Local\{5122E9B6-E1E9-4931-A1D5-26F83E1022FB}
2013-08-29 22:41 - 2013-08-29 22:03 - 00013128 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand September 2013.xlsx
2013-08-28 23:34 - 2013-07-30 08:08 - 00012338 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand 30.07.13.xlsx
2013-08-28 18:18 - 2013-08-28 18:18 - 00689724 _____ C:\Users\studentin mama\Desktop\tmnt_stundenplan_000 Copy.wwf

Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\AskSLib.dll
C:\Users\Gast\AppData\Local\Temp\DivXSetup.exe
C:\Users\Gast\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Kinder\AppData\Local\Temp\AskSLib.dll
C:\Users\Kinder\AppData\Local\Temp\DivXSetup.exe
C:\Users\Kinder\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Kinder\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kinder\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\studentin mama\AppData\Local\Temp\BackupSetup.exe
C:\Users\studentin mama\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\studentin mama\AppData\Local\Temp\Quarantine.exe
C:\Users\studentin mama\AppData\Local\Temp\uninst1.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-12 18:41

==================== End Of Log ============================

--- --- ---

--- --- ---

Aneri · 25.09.2013, 15:23

Hi

ich hab da noch was:

Schritt 1:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

Task: C:\Windows\Tasks\Jjjuxgi.job => C:\Windows\SysWOW64\XPSViewer5.dll
C:\Windows\Tasks\Jjjuxgi.job
C:\Windows\SysWOW64\XPSViewer5.dll
C:\Windows\System32\Tasks\Jjjuxgi

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2:

erstelle bitte ein neues FRST Logfile;

Schritt 3:

Ist das Problem mit ihavenet jetzt behoben? Überprüfe das bitte

abimama · 25.09.2013, 15:40

Oh mensch Aneri,

jetzt läuft es ja wieder wie am Schnürrchen!!!!!!!!!!!!! Wie soll ich dir bloß danken??? Habe die Sache mit softonic bereits in der WG verbreitet. Betretene Gesichter gab es auf jeden Fall. Ist ja der Knaller!!!!

Welches Anti-Viren Programm kannst du empfehlen??? Gibt es etwas Gutes, dass auch freeload ist???

LG
abimama

Aneri · 25.09.2013, 15:48

Na wunderbar

es wär noch richtig toll wenn du Schritt 2 erledigst

abimama · 25.09.2013, 15:53

uuups.....

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-09-2013
Ran by studentin mama at 2013-09-25 16:32:37 Run:3
Running from C:\Users\studentin mama\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: C:\Windows\Tasks\Jjjuxgi.job => C:\Windows\SysWOW64\XPSViewer5.dll
C:\Windows\Tasks\Jjjuxgi.job
C:\Windows\SysWOW64\XPSViewer5.dll
C:\Windows\System32\Tasks\Jjjuxgi

*****************

C:\Windows\Tasks\Jjjuxgi.job => Moved successfully.
"C:\Windows\Tasks\Jjjuxgi.job" => File/Directory not found.
Could not move "C:\Windows\SysWOW64\XPSViewer5.dll" => Scheduled to move on reboot.
C:\Windows\System32\Tasks\Jjjuxgi => Moved successfully.

=========== Result of Scheduled Files to move ===========

C:\Windows\SysWOW64\XPSViewer5.dll => Moved successfully.

==== End of Fixlog ===="C:\Windows\SysWOW64\XPSViewer5.dll" => File could not move.

==== End of Fixlog ====

Aneri · 25.09.2013, 15:54

Schritt 2

das war Schritt 1

abimama · 25.09.2013, 15:56

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-09-2013
Ran by studentin mama (administrator) on STUDENTINMAMA on 25-09-2013 16:53:36
Running from C:\Users\studentin mama\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2011-10-30] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-09] (IDT, Inc.)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKCU\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [434168 2012-05-18] (TomTom)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKCU\...\Run: [EPSON Stylus DX5000 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Users\STUDEN~1\AppData\Local\Temp\E_S4C5B.tmp" /EF "HKCU"
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
MountPoints2: {2c95361d-2ce3-11e1-9892-f1a06df124b6} - G:\Setup.exe
MountPoints2: {4b0a9f3a-eeb7-11e0-9f2b-806e6f6e6963} - E:\DocStart.Exe "index.pdf"
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-04-16] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [602168 2010-06-29] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-20] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [548864 2009-02-04] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Gast\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
HKU\Gast\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Gast\...\Run: [EPSON Stylus DX5000 Series] - C:\Users\Gast\AppData\Local\Temp\E_SC310.tmp [106 2012-03-27] ()
HKU\Kinder\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Kinder\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Kinder\...\Run: [EPSON Stylus DX5000 Series] - C:\Users\Kinder\AppData\Local\Temp\E_SA18C.tmp [106 2013-03-10] ()
AppInit_DLLs:    [0 ] ()
Startup: C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {22BC9D89-4AFD-4FD9-93D7-FDC19F581E42} URL = hxxp://searchya.com/?chnl=ft-102&s=1&cr=1395955839&cd=2XzutAtN2Y1L1Qzu0E0CyDyD0FzytAyE0AyBzy0FyD0CtD0DyEtN0D0TzutBtDtCtBtDtAtDyB&q={searchTerms}
SearchScopes: HKCU - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU -  No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\studentin mama\AppData\Roaming\Mozilla\Firefox\Profiles\cknca95t.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\studentin mama\AppData\Roaming\Mozilla\Firefox\Profiles\cknca95t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

Chrome: 
=======
CHR Extension: () - C:\Users\STUDEN~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gladcbhcbkdeddbidiblppadjdjalidb\1.6
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [27192 2010-06-29] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 vpnva; system32\DRIVERS\vpnva64.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-25 09:04 - 2013-09-25 09:04 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-24 14:34 - 2013-09-24 14:34 - 02347384 _____ (ESET) C:\Users\studentin mama\Downloads\esetsmartinstaller_enu.exe
2013-09-24 14:06 - 2013-09-24 14:06 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-24 14:06 - 2013-09-24 14:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-24 14:06 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-24 14:05 - 2013-09-24 14:05 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\studentin mama\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-24 13:18 - 2013-09-24 13:18 - 01042066 _____ C:\Users\studentin mama\Downloads\adwcleaner(1).exe
2013-09-24 12:27 - 2013-09-24 12:30 - 00065349 _____ C:\Users\studentin mama\Downloads\Addition.txt
2013-09-24 12:25 - 2013-09-25 16:35 - 00000000 ____D C:\FRST
2013-09-24 12:24 - 2013-09-24 12:25 - 01955802 _____ (Farbar) C:\Users\studentin mama\Desktop\FRST64.exe
2013-09-24 11:28 - 2013-09-24 11:28 - 00129080 _____ C:\Users\studentin mama\Downloads\Extras.Txt
2013-09-24 09:06 - 2013-09-24 12:25 - 00000002 _____ C:\Users\studentin mama\Downloads\OTL.Txt
2013-09-24 08:36 - 2013-09-24 08:36 - 00602112 _____ (OldTimer Tools) C:\Users\studentin mama\Downloads\OTL.exe
2013-09-24 08:20 - 2013-09-24 08:20 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-24 08:20 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-24 08:18 - 2013-09-24 08:18 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0 (1).exe
2013-09-24 08:09 - 2013-09-25 16:33 - 00020232 _____ C:\Windows\PFRO.log
2013-09-24 08:09 - 2013-09-25 16:33 - 00000336 _____ C:\Windows\setupact.log
2013-09-24 08:09 - 2013-09-24 08:09 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 08:07 - 2013-09-24 08:07 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0.exe
2013-09-24 08:03 - 2013-09-24 08:14 - 00000000 ____D C:\Users\studentin mama\AppData\Local\avgchrome
2013-09-24 08:03 - 2013-09-24 08:03 - 00003284 _____ C:\Windows\System32\Tasks\UpdaterEX
2013-09-24 08:02 - 2013-09-24 08:02 - 22404568 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox_Setup [1].exe
2013-09-24 08:02 - 2013-09-24 08:02 - 00001874 _____ C:\Users\studentin mama\Desktop\Search.lnk
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-23 18:23 - 2013-09-23 18:23 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-09-23 18:23 - 2013-09-23 18:23 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 18:23 - 2013-09-23 18:23 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 18:22 - 2013-09-23 18:22 - 04454952 _____ (Piriform Ltd) C:\Users\studentin mama\Downloads\ccsetup405.exe
2013-09-22 13:51 - 2013-09-24 13:21 - 00000000 ____D C:\AdwCleaner
2013-09-22 13:51 - 2013-09-22 13:51 - 01039554 _____ C:\Users\studentin mama\Downloads\adwcleaner.exe
2013-09-21 15:45 - 2013-09-21 15:45 - 98547399 _____ C:\Windows\SysWOW64\㔼䛶皴#
2013-09-21 12:44 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-19 16:20 - 2013-09-24 06:59 - 00015673 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Lehrgang Mimen für Wettbewerbe.xlsx
2013-09-19 16:12 - 2013-09-24 07:00 - 00015771 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Grundlehrgang ND.xlsx
2013-09-16 12:40 - 2013-09-25 09:10 - 69933798 _____ C:\Users\studentin mama\Desktop\Documents\Klassenfahrt Nieblum.pptx
2013-09-16 09:42 - 2013-09-16 09:42 - 00017667 _____ C:\Users\studentin mama\Downloads\StudiSoft_ Bestaetigung der Bestellung  0-00001349.eml
2013-09-16 00:03 - 2012-12-10 15:00 - 00112080 ____R (Cisco Systems, Inc.) C:\Windows\system32\Drivers\acsock64.sys
2013-09-16 00:02 - 2013-09-16 00:02 - 02719064 _____ (Cisco Systems, Inc.) C:\Users\studentin mama\Downloads\anyconnect-win-3.0.11042-web-deploy-k9(5).exe
2013-09-16 00:00 - 2013-09-16 00:00 - 00000000 ____D C:\ProgramData\Oracle
2013-09-16 00:00 - 2013-09-15 23:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-15 23:56 - 2013-09-15 23:56 - 00913832 _____ (Oracle Corporation) C:\Users\studentin mama\Downloads\jxpiinstall(1).exe
2013-09-11 23:26 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 23:26 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 23:26 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 23:26 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 23:26 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 23:26 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 23:26 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-11 23:26 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-11 23:26 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 23:26 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-11 23:26 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-11 23:26 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 17:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 17:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 17:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 17:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 17:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 17:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 17:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 17:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 17:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 17:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 17:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 17:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 17:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 17:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 17:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 17:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-10 06:41 - 2013-09-10 06:41 - 96866131 _____ C:\Windows\SysWOW64\炙皴¢
2013-09-06 20:47 - 2013-09-06 20:55 - 296266475 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.wmv
2013-09-06 18:53 - 2013-09-06 19:07 - 290211901 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.wmv
2013-09-06 16:44 - 2013-09-06 17:19 - 336720539 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.wmv
2013-09-06 16:44 - 2013-09-06 17:19 - 246707835 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.wmv
2013-09-06 13:17 - 2013-09-06 14:17 - 215862364 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.flv
2013-09-06 13:16 - 2013-09-06 14:15 - 213279948 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.flv
2013-09-06 13:07 - 2013-09-06 13:23 - 239375517 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.flv
2013-09-06 13:06 - 2013-09-06 13:23 - 185639600 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.flv
2013-09-03 09:09 - 2013-09-03 09:09 - 95452537 _____ C:\Windows\SysWOW64\壥䢖皴¹
2013-08-31 12:02 - 2013-08-31 12:02 - 00000000 ____D C:\Users\studentin mama\AppData\Local\{5122E9B6-E1E9-4931-A1D5-26F83E1022FB}
2013-08-29 22:03 - 2013-08-29 22:41 - 00013128 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand September 2013.xlsx
2013-08-28 18:18 - 2013-08-28 18:18 - 00689724 _____ C:\Users\studentin mama\Desktop\tmnt_stundenplan_000 Copy.wwf

==================== One Month Modified Files and Folders =======

2013-09-25 16:40 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-25 16:40 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-25 16:35 - 2013-09-24 12:25 - 00000000 ____D C:\FRST
2013-09-25 16:33 - 2013-09-24 08:09 - 00020232 _____ C:\Windows\PFRO.log
2013-09-25 16:33 - 2013-09-24 08:09 - 00000336 _____ C:\Windows\setupact.log
2013-09-25 16:33 - 2013-05-20 16:04 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-25 16:33 - 2013-03-29 14:31 - 00000358 _____ C:\Windows\Tasks\dsmonitor.job
2013-09-25 16:33 - 2012-02-26 15:04 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-25 16:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-25 16:32 - 2011-03-10 02:07 - 01507873 _____ C:\Windows\WindowsUpdate.log
2013-09-25 16:20 - 2012-02-26 15:04 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-25 16:10 - 2011-10-31 17:48 - 00000356 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-09-25 15:57 - 2013-05-28 01:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-25 14:44 - 2011-11-09 22:07 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-25 14:44 - 2011-10-05 12:45 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-25 12:34 - 2013-01-09 20:35 - 00003986 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D3FEFDA5-19CA-46DA-9710-E509D83A4478}
2013-09-25 09:21 - 2010-07-31 19:11 - 00697098 _____ C:\Windows\system32\perfh007.dat
2013-09-25 09:21 - 2010-07-31 19:11 - 00148362 _____ C:\Windows\system32\perfc007.dat
2013-09-25 09:21 - 2009-07-14 07:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-25 09:10 - 2013-09-16 12:40 - 69933798 _____ C:\Users\studentin mama\Desktop\Documents\Klassenfahrt Nieblum.pptx
2013-09-25 09:04 - 2013-09-25 09:04 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-25 09:04 - 2011-10-04 16:11 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Adobe
2013-09-25 09:04 - 2010-07-31 11:07 - 00000000 ____D C:\ProgramData\Adobe
2013-09-25 09:04 - 2010-07-31 11:07 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-24 22:51 - 2011-10-04 15:20 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Skype
2013-09-24 14:34 - 2013-09-24 14:34 - 02347384 _____ (ESET) C:\Users\studentin mama\Downloads\esetsmartinstaller_enu.exe
2013-09-24 14:06 - 2013-09-24 14:06 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-24 14:06 - 2013-09-24 14:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-24 14:05 - 2013-09-24 14:05 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\studentin mama\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-24 13:21 - 2013-09-22 13:51 - 00000000 ____D C:\AdwCleaner
2013-09-24 13:18 - 2013-09-24 13:18 - 01042066 _____ C:\Users\studentin mama\Downloads\adwcleaner(1).exe
2013-09-24 12:30 - 2013-09-24 12:27 - 00065349 _____ C:\Users\studentin mama\Downloads\Addition.txt
2013-09-24 12:25 - 2013-09-24 12:24 - 01955802 _____ (Farbar) C:\Users\studentin mama\Desktop\FRST64.exe
2013-09-24 12:25 - 2013-09-24 09:06 - 00000002 _____ C:\Users\studentin mama\Downloads\OTL.Txt
2013-09-24 11:28 - 2013-09-24 11:28 - 00129080 _____ C:\Users\studentin mama\Downloads\Extras.Txt
2013-09-24 08:36 - 2013-09-24 08:36 - 00602112 _____ (OldTimer Tools) C:\Users\studentin mama\Downloads\OTL.exe
2013-09-24 08:20 - 2013-09-24 08:20 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-24 08:20 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-24 08:20 - 2013-09-21 12:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-24 08:18 - 2013-09-24 08:18 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0 (1).exe
2013-09-24 08:17 - 2011-10-04 13:46 - 00000000 ___RD C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-24 08:14 - 2013-09-24 08:03 - 00000000 ____D C:\Users\studentin mama\AppData\Local\avgchrome
2013-09-24 08:09 - 2013-09-24 08:09 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 08:07 - 2013-09-24 08:07 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0.exe
2013-09-24 08:03 - 2013-09-24 08:03 - 00003284 _____ C:\Windows\System32\Tasks\UpdaterEX
2013-09-24 08:03 - 2011-10-07 23:01 - 00000000 ____D C:\Users\studentin mama\AppData\Local\CrashDumps
2013-09-24 08:02 - 2013-09-24 08:02 - 22404568 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox_Setup [1].exe
2013-09-24 08:02 - 2013-09-24 08:02 - 00001874 _____ C:\Users\studentin mama\Desktop\Search.lnk
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-24 08:02 - 2013-09-24 08:02 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-24 07:56 - 2012-11-24 02:34 - 00011357 _____ C:\Users\studentin mama\Desktop\Documents\wortpassme.xlsx
2013-09-24 07:00 - 2013-09-19 16:12 - 00015771 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Grundlehrgang ND.xlsx
2013-09-24 06:59 - 2013-09-19 16:20 - 00015673 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Lehrgang Mimen für Wettbewerbe.xlsx
2013-09-23 18:26 - 2013-04-27 10:51 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-09-23 18:25 - 2012-02-03 22:18 - 00000000 ____D C:\Windows\Minidump
2013-09-23 18:25 - 2009-09-07 03:57 - 00000000 ____D C:\Windows\Panther
2013-09-23 18:23 - 2013-09-23 18:23 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-09-23 18:23 - 2013-09-23 18:23 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 18:23 - 2013-09-23 18:23 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 18:22 - 2013-09-23 18:22 - 04454952 _____ (Piriform Ltd) C:\Users\studentin mama\Downloads\ccsetup405.exe
2013-09-22 13:53 - 2013-03-29 14:31 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Uniblue
2013-09-22 13:53 - 2013-03-29 14:31 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-09-22 13:53 - 2011-11-10 21:04 - 00000000 ____D C:\ProgramData\ICQ
2013-09-22 13:51 - 2013-09-22 13:51 - 01039554 _____ C:\Users\studentin mama\Downloads\adwcleaner.exe
2013-09-21 16:29 - 2013-03-05 22:06 - 00000000 ____D C:\Users\Kinder\AppData\Local\Mozilla
2013-09-21 15:45 - 2013-09-21 15:45 - 98547399 _____ C:\Windows\SysWOW64\㔼䛶皴#
2013-09-21 12:45 - 2011-10-04 13:52 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Mozilla
2013-09-17 16:45 - 2013-06-16 17:41 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-16 09:42 - 2013-09-16 09:42 - 00017667 _____ C:\Users\studentin mama\Downloads\StudiSoft_ Bestaetigung der Bestellung  0-00001349.eml
2013-09-16 00:02 - 2013-09-16 00:02 - 02719064 _____ (Cisco Systems, Inc.) C:\Users\studentin mama\Downloads\anyconnect-win-3.0.11042-web-deploy-k9(5).exe
2013-09-16 00:00 - 2013-09-16 00:00 - 00000000 ____D C:\ProgramData\Oracle
2013-09-15 23:59 - 2013-09-16 00:00 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-15 23:59 - 2012-06-02 10:17 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-09-15 23:59 - 2012-06-02 10:17 - 00000000 ____D C:\Program Files (x86)\Java
2013-09-15 23:59 - 2010-07-31 12:09 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-09-15 23:56 - 2013-09-15 23:56 - 00913832 _____ (Oracle Corporation) C:\Users\studentin mama\Downloads\jxpiinstall(1).exe
2013-09-12 18:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 13:56 - 2013-03-03 20:03 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 13:56 - 2013-03-03 20:03 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 12:03 - 2011-10-04 13:46 - 00000000 ___RD C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:50 - 2009-07-14 06:45 - 00397528 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 23:26 - 2011-10-04 14:15 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 16:57 - 2013-05-28 01:13 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-11 16:57 - 2013-04-24 09:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-11 16:57 - 2013-04-24 09:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-10 06:41 - 2013-09-10 06:41 - 96866131 _____ C:\Windows\SysWOW64\炙皴¢
2013-09-06 20:55 - 2013-09-06 20:47 - 296266475 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.wmv
2013-09-06 19:07 - 2013-09-06 18:53 - 290211901 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.wmv
2013-09-06 17:19 - 2013-09-06 16:44 - 336720539 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.wmv
2013-09-06 17:19 - 2013-09-06 16:44 - 246707835 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.wmv
2013-09-06 14:17 - 2013-09-06 13:17 - 215862364 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.flv
2013-09-06 14:15 - 2013-09-06 13:16 - 213279948 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.flv
2013-09-06 13:23 - 2013-09-06 13:07 - 239375517 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.flv
2013-09-06 13:23 - 2013-09-06 13:06 - 185639600 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.flv
2013-09-05 18:12 - 2012-11-26 23:59 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-05 18:12 - 2011-10-04 15:20 - 00000000 ____D C:\ProgramData\Skype
2013-09-03 19:06 - 2011-10-08 21:08 - 00000000 ____D C:\Users\studentin mama\Desktop\Documents\OpenTTD
2013-09-03 18:36 - 2012-03-16 21:50 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\DivX
2013-09-03 18:34 - 2011-10-30 20:39 - 00003584 _____ C:\Users\studentin mama\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-03 09:09 - 2013-09-03 09:09 - 95452537 _____ C:\Windows\SysWOW64\壥䢖皴¹
2013-08-31 12:02 - 2013-08-31 12:02 - 00000000 ____D C:\Users\studentin mama\AppData\Local\{5122E9B6-E1E9-4931-A1D5-26F83E1022FB}
2013-08-29 22:41 - 2013-08-29 22:03 - 00013128 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand September 2013.xlsx
2013-08-28 23:34 - 2013-07-30 08:08 - 00012338 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand 30.07.13.xlsx
2013-08-28 18:18 - 2013-08-28 18:18 - 00689724 _____ C:\Users\studentin mama\Desktop\tmnt_stundenplan_000 Copy.wwf

Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\AskSLib.dll
C:\Users\Gast\AppData\Local\Temp\DivXSetup.exe
C:\Users\Gast\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Kinder\AppData\Local\Temp\AskSLib.dll
C:\Users\Kinder\AppData\Local\Temp\DivXSetup.exe
C:\Users\Kinder\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Kinder\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kinder\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\studentin mama\AppData\Local\Temp\BackupSetup.exe
C:\Users\studentin mama\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\studentin mama\AppData\Local\Temp\Quarantine.exe
C:\Users\studentin mama\AppData\Local\Temp\uninst1.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-12 18:41

==================== End Of Log ============================

--- --- ---

--- --- ---

also ich und zahlen... naja.....

Aneri · 26.09.2013, 14:44

Hi

leider nochmal ein Fix, da sind noch Reste von der Ihavenet Seuche auf dem System

Schritt 1:

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
C:\Users\studentin mama\AppData\Local\avgchrome
C:\Windows\System32\Tasks\UpdaterEX
C:\Users\studentin mama\Desktop\Search.lnk
C:\Windows\SysWOW64\searchplugins
C:\Windows\SysWOW64\Extensions
C:\Program Files\Enigma Software Group\

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Schritt 2:

erstelle bitte ein neues FRST Logfile.

abimama · 26.09.2013, 21:43

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 26-09-2013
Ran by studentin mama at 2013-09-26 22:36:55 Run:4
Running from C:\Users\studentin mama\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
C:\Users\studentin mama\AppData\Local\avgchrome
C:\Windows\System32\Tasks\UpdaterEX
C:\Users\studentin mama\Desktop\Search.lnk
C:\Windows\SysWOW64\searchplugins
C:\Windows\SysWOW64\Extensions
C:\Program Files\Enigma Software Group\
         
*****************

esgiguard => Service deleted successfully.
C:\Users\studentin mama\AppData\Local\avgchrome => Moved successfully.
C:\Windows\System32\Tasks\UpdaterEX => Moved successfully.
C:\Users\studentin mama\Desktop\Search.lnk => Moved successfully.
C:\Windows\SysWOW64\searchplugins => Moved successfully.
C:\Windows\SysWOW64\Extensions => Moved successfully.
C:\Program Files\Enigma Software Group\ => Moved successfully.

==== End of Fixlog ====

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-09-2013
Ran by studentin mama (administrator) on STUDENTINMAMA on 26-09-2013 22:37:40
Running from C:\Users\studentin mama\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Hewlett-Packard) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
() C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(TomTom) C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
() C:\Windows\Samsung\PanelMgr\SSMMgr.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe
() C:\Windows\Samsung\PanelMgr\caller64.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(CyberLink) C:\Program Files (x86)\Hewlett-Packard\Media\Webcam\YCMMirage.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2011-10-30] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-06-09] (IDT, Inc.)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKCU\...\Run: [MyTomTomSA.exe] - C:\Program Files (x86)\MyTomTom 3\MyTomTomSA.exe [434168 2012-05-18] (TomTom)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [] - [x]
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1090912 2013-04-19] (Nokia)
HKCU\...\Run: [EPSON Stylus DX5000 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_FATIBVE.EXE /FU "C:\Users\STUDEN~1\AppData\Local\Temp\E_S4C5B.tmp" /EF "HKCU"
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
MountPoints2: {2c95361d-2ce3-11e1-9892-f1a06df124b6} - G:\Setup.exe
MountPoints2: {4b0a9f3a-eeb7-11e0-9f2b-806e6f6e6963} - E:\DocStart.Exe "index.pdf"
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-04-16] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [602168 2010-06-29] (Hewlett-Packard Company)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2010-06-09] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [DivXMediaServer] - C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-05-20] (DivX, LLC)
HKLM-x32\...\Run: [DivXUpdate] - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1263952 2013-02-13] ()
HKLM-x32\...\Run: [Samsung PanelMgr] - C:\Windows\Samsung\PanelMgr\SSMMgr.exe [548864 2009-02-04] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Cisco AnyConnect Secure Mobility Agent for Windows] - C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe [527864 2012-12-10] (Cisco Systems, Inc.)
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Gast\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\Dock\HPAdvisorDock.exe
HKU\Gast\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Gast\...\Run: [EPSON Stylus DX5000 Series] - C:\Users\Gast\AppData\Local\Temp\E_SC310.tmp [106 2012-03-27] ()
HKU\Kinder\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe
HKU\Kinder\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\Kinder\...\Run: [EPSON Stylus DX5000 Series] - C:\Users\Kinder\AppData\Local\Temp\E_SA18C.tmp [106 2013-03-10] ()
AppInit_DLLs:    [0 ] ()
Startup: C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - {19089719-9401-4468-AE0B-8104E8D0D9EF} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {22BC9D89-4AFD-4FD9-93D7-FDC19F581E42} URL = hxxp://searchya.com/?chnl=ft-102&s=1&cr=1395955839&cd=2XzutAtN2Y1L1Qzu0E0CyDyD0FzytAyE0AyBzy0FyD0CtD0DyEtN0D0TzutBtDtCtBtDtAtDyB&q={searchTerms}
SearchScopes: HKCU - {E81CDADA-1F06-414B-A58F-396B22D1CAFD} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKCU -  No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM-x32 {538793D5-659C-4639-A56C-A179AD87ED44} 
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\studentin mama\AppData\Roaming\Mozilla\Firefox\Profiles\cknca95t.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nokia.com/EnablerPlugin - C:\Program Files (x86)\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin-x32: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 - C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\studentin mama\AppData\Roaming\Mozilla\Firefox\Profiles\cknca95t.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

Chrome: 
=======
CHR Extension: () - C:\Users\STUDEN~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gladcbhcbkdeddbidiblppadjdjalidb\1.6
CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx

==================== Services (Whitelisted) =================

R2 EPSON_PM_RPCV4_01; C:\ProgramData\EPSON\EPW!3 SSRP\E_S30RP1.EXE [102400 2006-04-18] (SEIKO EPSON CORPORATION)
R2 HPWMISVC; C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [27192 2010-06-29] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)

==================== Drivers (Whitelisted) ====================

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-26 22:35 - 2013-09-26 22:35 - 01956432 _____ (Farbar) C:\Users\studentin mama\Desktop\FRST64.exe
2013-09-26 07:37 - 2013-09-26 07:37 - 00000000 ____D C:\Program Files (x86)\SecureW2
2013-09-26 07:36 - 2013-09-26 07:37 - 00000000 ____D C:\Users\studentin mama\AppData\Local\TempDIR
2013-09-26 07:36 - 2013-09-26 07:36 - 00611449 _____ C:\Users\studentin mama\Downloads\SecureW2_RZUW(1).exe
2013-09-26 07:36 - 2013-09-26 07:36 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
2013-09-25 21:32 - 2013-09-25 21:48 - 00000000 ____D C:\Windows\system32\MRT
2013-09-25 21:31 - 2013-09-25 21:31 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Cisco
2013-09-25 21:31 - 2013-09-25 21:31 - 00000000 ____D C:\ProgramData\Cisco
2013-09-25 21:31 - 2013-09-25 21:31 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-09-25 21:31 - 2012-12-10 15:00 - 00112080 ____R (Cisco Systems, Inc.) C:\Windows\system32\Drivers\acsock64.sys
2013-09-25 09:04 - 2013-09-25 09:04 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-24 14:34 - 2013-09-24 14:34 - 02347384 _____ (ESET) C:\Users\studentin mama\Downloads\esetsmartinstaller_enu.exe
2013-09-24 14:06 - 2013-09-24 14:06 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-24 14:06 - 2013-09-24 14:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-24 14:06 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-24 14:05 - 2013-09-24 14:05 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\studentin mama\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-24 13:18 - 2013-09-24 13:18 - 01042066 _____ C:\Users\studentin mama\Downloads\adwcleaner(1).exe
2013-09-24 12:27 - 2013-09-24 12:30 - 00065349 _____ C:\Users\studentin mama\Downloads\Addition.txt
2013-09-24 12:25 - 2013-09-25 16:35 - 00000000 ____D C:\FRST
2013-09-24 11:28 - 2013-09-24 11:28 - 00129080 _____ C:\Users\studentin mama\Downloads\Extras.Txt
2013-09-24 09:06 - 2013-09-24 12:25 - 00000002 _____ C:\Users\studentin mama\Downloads\OTL.Txt
2013-09-24 08:36 - 2013-09-24 08:36 - 00602112 _____ (OldTimer Tools) C:\Users\studentin mama\Downloads\OTL.exe
2013-09-24 08:20 - 2013-09-24 08:20 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-24 08:20 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-24 08:18 - 2013-09-24 08:18 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0 (1).exe
2013-09-24 08:09 - 2013-09-26 21:26 - 00000784 _____ C:\Windows\setupact.log
2013-09-24 08:09 - 2013-09-25 16:33 - 00020232 _____ C:\Windows\PFRO.log
2013-09-24 08:09 - 2013-09-24 08:09 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 08:07 - 2013-09-24 08:07 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0.exe
2013-09-24 08:02 - 2013-09-24 08:02 - 22404568 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox_Setup [1].exe
2013-09-23 18:23 - 2013-09-23 18:23 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-09-23 18:23 - 2013-09-23 18:23 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 18:23 - 2013-09-23 18:23 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 18:22 - 2013-09-23 18:22 - 04454952 _____ (Piriform Ltd) C:\Users\studentin mama\Downloads\ccsetup405.exe
2013-09-22 13:51 - 2013-09-24 13:21 - 00000000 ____D C:\AdwCleaner
2013-09-22 13:51 - 2013-09-22 13:51 - 01039554 _____ C:\Users\studentin mama\Downloads\adwcleaner.exe
2013-09-21 15:45 - 2013-09-21 15:45 - 98547399 _____ C:\Windows\SysWOW64\㔼䛶皴#
2013-09-21 12:44 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-19 16:20 - 2013-09-24 06:59 - 00015673 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Lehrgang Mimen für Wettbewerbe.xlsx
2013-09-19 16:12 - 2013-09-24 07:00 - 00015771 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Grundlehrgang ND.xlsx
2013-09-16 12:40 - 2013-09-26 20:58 - 69942455 _____ C:\Users\studentin mama\Desktop\Documents\Klassenfahrt Nieblum.pptx
2013-09-16 09:42 - 2013-09-16 09:42 - 00017667 _____ C:\Users\studentin mama\Downloads\StudiSoft_ Bestaetigung der Bestellung  0-00001349.eml
2013-09-16 00:02 - 2013-09-16 00:02 - 02719064 _____ (Cisco Systems, Inc.) C:\Users\studentin mama\Downloads\anyconnect-win-3.0.11042-web-deploy-k9(5).exe
2013-09-16 00:00 - 2013-09-16 00:00 - 00000000 ____D C:\ProgramData\Oracle
2013-09-16 00:00 - 2013-09-15 23:59 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-15 23:56 - 2013-09-15 23:56 - 00913832 _____ (Oracle Corporation) C:\Users\studentin mama\Downloads\jxpiinstall(1).exe
2013-09-11 23:26 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-11 23:26 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-11 23:26 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-11 23:26 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-11 23:26 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-11 23:26 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-11 23:26 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-11 23:26 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-11 23:26 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-11 23:26 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-11 23:26 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-11 23:26 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-11 23:26 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-11 23:26 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-11 17:28 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-11 17:28 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-11 17:28 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-11 17:28 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-11 17:28 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-11 17:28 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-11 17:28 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-11 17:28 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-11 17:28 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-11 17:28 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-11 17:28 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-11 17:28 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-11 17:28 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-11 17:28 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-11 17:28 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-11 17:28 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-11 17:28 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-11 17:28 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-11 17:28 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-11 17:28 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-11 17:28 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-10 06:41 - 2013-09-10 06:41 - 96866131 _____ C:\Windows\SysWOW64\炙皴¢
2013-09-06 20:47 - 2013-09-06 20:55 - 296266475 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.wmv
2013-09-06 18:53 - 2013-09-06 19:07 - 290211901 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.wmv
2013-09-06 16:44 - 2013-09-06 17:19 - 336720539 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.wmv
2013-09-06 16:44 - 2013-09-06 17:19 - 246707835 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.wmv
2013-09-06 13:17 - 2013-09-06 14:17 - 215862364 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.flv
2013-09-06 13:16 - 2013-09-06 14:15 - 213279948 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.flv
2013-09-06 13:07 - 2013-09-06 13:23 - 239375517 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.flv
2013-09-06 13:06 - 2013-09-06 13:23 - 185639600 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.flv
2013-09-03 09:09 - 2013-09-03 09:09 - 95452537 _____ C:\Windows\SysWOW64\壥䢖皴¹
2013-08-31 12:02 - 2013-08-31 12:02 - 00000000 ____D C:\Users\studentin mama\AppData\Local\{5122E9B6-E1E9-4931-A1D5-26F83E1022FB}
2013-08-29 22:03 - 2013-08-29 22:41 - 00013128 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand September 2013.xlsx
2013-08-28 18:18 - 2013-08-28 18:18 - 00689724 _____ C:\Users\studentin mama\Desktop\tmnt_stundenplan_000 Copy.wwf

==================== One Month Modified Files and Folders =======

2013-09-26 22:35 - 2013-09-26 22:35 - 01956432 _____ (Farbar) C:\Users\studentin mama\Desktop\FRST64.exe
2013-09-26 22:20 - 2012-02-26 15:04 - 00001126 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-26 22:10 - 2011-10-31 17:48 - 00000356 _____ C:\Windows\Tasks\HP Photo Creations Communicator.job
2013-09-26 21:57 - 2013-05-28 01:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-26 21:35 - 2013-01-09 20:35 - 00003986 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D3FEFDA5-19CA-46DA-9710-E509D83A4478}
2013-09-26 21:34 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-26 21:34 - 2009-07-14 06:45 - 00023024 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-26 21:27 - 2013-03-29 14:31 - 00000358 _____ C:\Windows\Tasks\dsmonitor.job
2013-09-26 21:27 - 2012-02-26 15:04 - 00001122 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-26 21:26 - 2013-09-24 08:09 - 00000784 _____ C:\Windows\setupact.log
2013-09-26 21:26 - 2013-05-20 16:04 - 00000374 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-09-26 21:26 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-26 21:00 - 2011-03-10 02:07 - 01721803 _____ C:\Windows\WindowsUpdate.log
2013-09-26 20:58 - 2013-09-16 12:40 - 69942455 _____ C:\Users\studentin mama\Desktop\Documents\Klassenfahrt Nieblum.pptx
2013-09-26 07:37 - 2013-09-26 07:37 - 00000000 ____D C:\Program Files (x86)\SecureW2
2013-09-26 07:37 - 2013-09-26 07:36 - 00000000 ____D C:\Users\studentin mama\AppData\Local\TempDIR
2013-09-26 07:36 - 2013-09-26 07:36 - 00611449 _____ C:\Users\studentin mama\Downloads\SecureW2_RZUW(1).exe
2013-09-26 07:36 - 2013-09-26 07:36 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SecureW2
2013-09-26 07:21 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-25 21:48 - 2013-09-25 21:32 - 00000000 ____D C:\Windows\system32\MRT
2013-09-25 21:33 - 2011-10-04 15:20 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Skype
2013-09-25 21:31 - 2013-09-25 21:31 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Cisco
2013-09-25 21:31 - 2013-09-25 21:31 - 00000000 ____D C:\ProgramData\Cisco
2013-09-25 21:31 - 2013-09-25 21:31 - 00000000 ____D C:\Program Files (x86)\Cisco
2013-09-25 16:35 - 2013-09-24 12:25 - 00000000 ____D C:\FRST
2013-09-25 16:33 - 2013-09-24 08:09 - 00020232 _____ C:\Windows\PFRO.log
2013-09-25 14:44 - 2011-11-09 22:07 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-09-25 14:44 - 2011-10-05 12:45 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-09-25 09:21 - 2010-07-31 19:11 - 00697098 _____ C:\Windows\system32\perfh007.dat
2013-09-25 09:21 - 2010-07-31 19:11 - 00148362 _____ C:\Windows\system32\perfc007.dat
2013-09-25 09:21 - 2009-07-14 07:13 - 01613412 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-25 09:04 - 2013-09-25 09:04 - 00001979 _____ C:\Users\Public\Desktop\Adobe Reader XI.lnk
2013-09-25 09:04 - 2011-10-04 16:11 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Adobe
2013-09-25 09:04 - 2010-07-31 11:07 - 00000000 ____D C:\ProgramData\Adobe
2013-09-25 09:04 - 2010-07-31 11:07 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-09-24 14:34 - 2013-09-24 14:34 - 02347384 _____ (ESET) C:\Users\studentin mama\Downloads\esetsmartinstaller_enu.exe
2013-09-24 14:06 - 2013-09-24 14:06 - 00001073 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-09-24 14:06 - 2013-09-24 14:06 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-24 14:05 - 2013-09-24 14:05 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\studentin mama\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-24 13:21 - 2013-09-22 13:51 - 00000000 ____D C:\AdwCleaner
2013-09-24 13:18 - 2013-09-24 13:18 - 01042066 _____ C:\Users\studentin mama\Downloads\adwcleaner(1).exe
2013-09-24 12:30 - 2013-09-24 12:27 - 00065349 _____ C:\Users\studentin mama\Downloads\Addition.txt
2013-09-24 12:25 - 2013-09-24 09:06 - 00000002 _____ C:\Users\studentin mama\Downloads\OTL.Txt
2013-09-24 11:28 - 2013-09-24 11:28 - 00129080 _____ C:\Users\studentin mama\Downloads\Extras.Txt
2013-09-24 08:36 - 2013-09-24 08:36 - 00602112 _____ (OldTimer Tools) C:\Users\studentin mama\Downloads\OTL.exe
2013-09-24 08:20 - 2013-09-24 08:20 - 00001111 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-24 08:20 - 2013-09-24 08:20 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-24 08:20 - 2013-09-21 12:44 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-24 08:18 - 2013-09-24 08:18 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0 (1).exe
2013-09-24 08:17 - 2011-10-04 13:46 - 00000000 ___RD C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-24 08:09 - 2013-09-24 08:09 - 00000000 _____ C:\Windows\setuperr.log
2013-09-24 08:07 - 2013-09-24 08:07 - 00281896 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox Setup Stub 24.0.exe
2013-09-24 08:03 - 2011-10-07 23:01 - 00000000 ____D C:\Users\studentin mama\AppData\Local\CrashDumps
2013-09-24 08:02 - 2013-09-24 08:02 - 22404568 _____ (Mozilla) C:\Users\studentin mama\Downloads\Firefox_Setup [1].exe
2013-09-24 07:56 - 2012-11-24 02:34 - 00011357 _____ C:\Users\studentin mama\Desktop\Documents\wortpassme.xlsx
2013-09-24 07:00 - 2013-09-19 16:12 - 00015771 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Grundlehrgang ND.xlsx
2013-09-24 06:59 - 2013-09-19 16:20 - 00015673 _____ C:\Users\studentin mama\Desktop\Documents\Zeitplan Lehrgang Mimen für Wettbewerbe.xlsx
2013-09-23 18:26 - 2013-04-27 10:51 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-09-23 18:25 - 2012-02-03 22:18 - 00000000 ____D C:\Windows\Minidump
2013-09-23 18:25 - 2009-09-07 03:57 - 00000000 ____D C:\Windows\Panther
2013-09-23 18:23 - 2013-09-23 18:23 - 00002790 _____ C:\Windows\System32\Tasks\CCleanerSkipUAC
2013-09-23 18:23 - 2013-09-23 18:23 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk
2013-09-23 18:23 - 2013-09-23 18:23 - 00000000 ____D C:\Program Files\CCleaner
2013-09-23 18:22 - 2013-09-23 18:22 - 04454952 _____ (Piriform Ltd) C:\Users\studentin mama\Downloads\ccsetup405.exe
2013-09-22 13:53 - 2013-03-29 14:31 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\Uniblue
2013-09-22 13:53 - 2013-03-29 14:31 - 00000000 ____D C:\Program Files (x86)\Uniblue
2013-09-22 13:53 - 2011-11-10 21:04 - 00000000 ____D C:\ProgramData\ICQ
2013-09-22 13:51 - 2013-09-22 13:51 - 01039554 _____ C:\Users\studentin mama\Downloads\adwcleaner.exe
2013-09-21 16:29 - 2013-03-05 22:06 - 00000000 ____D C:\Users\Kinder\AppData\Local\Mozilla
2013-09-21 15:45 - 2013-09-21 15:45 - 98547399 _____ C:\Windows\SysWOW64\㔼䛶皴#
2013-09-21 12:45 - 2011-10-04 13:52 - 00000000 ____D C:\Users\studentin mama\AppData\Local\Mozilla
2013-09-17 16:45 - 2013-06-16 17:41 - 00000000 ____D C:\Program Files (x86)\Origin
2013-09-16 09:42 - 2013-09-16 09:42 - 00017667 _____ C:\Users\studentin mama\Downloads\StudiSoft_ Bestaetigung der Bestellung  0-00001349.eml
2013-09-16 00:02 - 2013-09-16 00:02 - 02719064 _____ (Cisco Systems, Inc.) C:\Users\studentin mama\Downloads\anyconnect-win-3.0.11042-web-deploy-k9(5).exe
2013-09-16 00:00 - 2013-09-16 00:00 - 00000000 ____D C:\ProgramData\Oracle
2013-09-15 23:59 - 2013-09-16 00:00 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-09-15 23:59 - 2013-09-15 23:59 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-09-15 23:59 - 2012-06-02 10:17 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2013-09-15 23:59 - 2012-06-02 10:17 - 00000000 ____D C:\Program Files (x86)\Java
2013-09-15 23:59 - 2010-07-31 12:09 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-09-15 23:56 - 2013-09-15 23:56 - 00913832 _____ (Oracle Corporation) C:\Users\studentin mama\Downloads\jxpiinstall(1).exe
2013-09-12 18:50 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-12 13:56 - 2013-03-03 20:03 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-12 13:56 - 2013-03-03 20:03 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 12:03 - 2011-10-04 13:46 - 00000000 ___RD C:\Users\studentin mama\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-12 11:50 - 2009-07-14 06:45 - 00397528 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-11 23:26 - 2011-10-04 14:15 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-11 16:57 - 2013-05-28 01:13 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-11 16:57 - 2013-04-24 09:56 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-11 16:57 - 2013-04-24 09:56 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-10 06:41 - 2013-09-10 06:41 - 96866131 _____ C:\Windows\SysWOW64\炙皴¢
2013-09-06 20:55 - 2013-09-06 20:47 - 296266475 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.wmv
2013-09-06 19:07 - 2013-09-06 18:53 - 290211901 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.wmv
2013-09-06 17:19 - 2013-09-06 16:44 - 336720539 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.wmv
2013-09-06 17:19 - 2013-09-06 16:44 - 246707835 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.wmv
2013-09-06 14:17 - 2013-09-06 13:17 - 215862364 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 2v10 - Friedrich II. und der Kreuzzug.flv
2013-09-06 14:15 - 2013-09-06 13:16 - 213279948 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen II 1v10 - Karl der Große und die Sachsen.flv
2013-09-06 13:23 - 2013-09-06 13:07 - 239375517 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 10 - Wilhelm und die Welt.flv
2013-09-06 13:23 - 2013-09-06 13:06 - 185639600 _____ C:\Users\studentin mama\Desktop\Documents\Die Deutschen 09 - Bismarck und das Deutsche Reich.flv
2013-09-05 18:12 - 2012-11-26 23:59 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-09-05 18:12 - 2011-10-04 15:20 - 00000000 ____D C:\ProgramData\Skype
2013-09-03 19:06 - 2011-10-08 21:08 - 00000000 ____D C:\Users\studentin mama\Desktop\Documents\OpenTTD
2013-09-03 18:36 - 2012-03-16 21:50 - 00000000 ____D C:\Users\studentin mama\AppData\Roaming\DivX
2013-09-03 18:34 - 2011-10-30 20:39 - 00003584 _____ C:\Users\studentin mama\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-03 09:09 - 2013-09-03 09:09 - 95452537 _____ C:\Windows\SysWOW64\壥䢖皴¹
2013-09-01 17:08 - 2011-10-17 22:46 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-31 12:02 - 2013-08-31 12:02 - 00000000 ____D C:\Users\studentin mama\AppData\Local\{5122E9B6-E1E9-4931-A1D5-26F83E1022FB}
2013-08-29 22:41 - 2013-08-29 22:03 - 00013128 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand September 2013.xlsx
2013-08-28 23:34 - 2013-07-30 08:08 - 00012338 _____ C:\Users\studentin mama\Desktop\Documents\aktueller Kontostand 30.07.13.xlsx
2013-08-28 18:18 - 2013-08-28 18:18 - 00689724 _____ C:\Users\studentin mama\Desktop\tmnt_stundenplan_000 Copy.wwf

Some content of TEMP:
====================
C:\Users\Gast\AppData\Local\Temp\AskSLib.dll
C:\Users\Gast\AppData\Local\Temp\DivXSetup.exe
C:\Users\Gast\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Kinder\AppData\Local\Temp\AskSLib.dll
C:\Users\Kinder\AppData\Local\Temp\DivXSetup.exe
C:\Users\Kinder\AppData\Local\Temp\drm_dyndata_7400009.dll
C:\Users\Kinder\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Kinder\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\studentin mama\AppData\Local\Temp\20130925093117132jniverify.dll
C:\Users\studentin mama\AppData\Local\Temp\BackupSetup.exe
C:\Users\studentin mama\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\studentin mama\AppData\Local\Temp\Quarantine.exe
C:\Users\studentin mama\AppData\Local\Temp\uninst1.exe
C:\Users\studentin mama\AppData\Local\Temp\WZCPlugin_VISTA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-12 18:41

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

Ich hoffe, dass ich nichts falsch mache bei dieser ganzen Aktion. Ich arbeite nebenbei weiter mit dem Gerät und schalte dabei dann auch die Firewall wieder ein. Sobald ich etwas hier posten soll oder etwas durchlaufen lasse nach deinen Anweisungen deaktiviere ich die Wall natürlich. Haben wir eventuell Anti-Viren-Programme auf dem Rechner, die wir nicht mehr kennen oder vergessen haben?

Aneri · 27.09.2013, 08:11

Zitat:

Zitat von abimama

Ich hoffe, dass ich nichts falsch mache bei dieser ganzen Aktion. Ich arbeite nebenbei weiter mit dem Gerät und schalte dabei dann auch die Firewall wieder ein. Sobald ich etwas hier posten soll oder etwas durchlaufen lasse nach deinen Anweisungen deaktiviere ich die Wall natürlich. Haben wir eventuell Anti-Viren-Programme auf dem Rechner, die wir nicht mehr kennen oder vergessen haben?

Nö alles bestens

ich lerne auch an jedem Fall etwas neues, solange wir die Probleme elegant gelöst bekommen ist doch alles ok

Als Antivirenlösung empfehle ich dir avast! antivirus; Einfach registrieren (Email Adresse) und schon sind 365 Tage sorgenfreieres Surfen möglich

so gehts weiter:

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Schritt 2:

Aktualisiere bitte deinen Adobe Reader;

Wunderbar dein System ist soweit ich das sehen kann sauber.

Hier noch ein paar optionale Tipps zur Absicherung deines Systems.

Benutzerkonto Einstellungen:

Wir sehen immer wieder User mit Administratorrechten. Hier kann jeder Nutzer eines Windowsrechners schon die erste Türe schließen. Arbeite mit einem eingeschränkten Benutzerkonto anstelle eines Kontos mit Administratorrechten. Diese sind für das tägliche Arbeiten nicht nötig, und solltest du einmal Software installieren wollen wirst du im normalfall nach deinem Passwort gefragt.

Solltest du Hilfe bei der Erstellung eines "eingeschränkten Kontos" benötigen helfe ich dir gern weiter.

Systemupdates:

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Besonders Java erfährt zur Zeit regelmäßig sicherheitsrelevante Updates

Ältere Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können. Falls du Java nutzt gehe wie folgt vor:

Downloade dir bitte die neueste Java-Version von hier
Speichere die jxpiinstall.exe
Schließe alle laufenden Programme. Speziell deinen Browser.
Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 40 ) herunter laden.
Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
Wenn die Installation beendet wurde
Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.

Nach dem Neustart

Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
Klicke auf Dateien löschen....
Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
Klicke erneut OK.

schneller Plugin-Test: PluginCheck

Antivirensoftware

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

alternatives Browsen

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Wenn du möchtest, kannst du das Trojaner Board Forum mit einer kleinen Spende unterstützen.

abimama · 27.09.2013, 09:23

Zitat:

Die Reihenfolge ist hier entscheidend.

1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
Windowstaste + R > Combofix /Uninstall (eingeben) > OK
Alternative: Combofix.exe in uninstall.exe umbenennen und starten
Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.
Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte deinen Rechner abschließend neu.
4.Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Woher weiß ich, was benutzt wurde??? Ich verstehe das leider nicht so richtig.

Aneri · 27.09.2013, 10:41

Hi kein Problem ...

fang bei Downloade dir Delfix an

wir hatten die beiden anderen Tools nicht in Verwendung...

abimama · 27.09.2013, 15:00

Hallo,

ich habe jetzt soweit alles erledigt und danke dir sehr.

ich habe zwar noch ein kleines Problem mit meinem vpn cisco client meiner Uni, aber das kläre ich sonst mal mit dem dortigen Rechenzentrum.

Vielen Dank nochmal!!!!!!!!!!!!!

Lieber Gruß

abimama

Aneri · 14.11.2013, 12:11

Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen schicke mir bitte eine PM.

Jeder andere bitte hier klicken und einen eigenen Thread erstellen

25.09.2013, 15:48	#19
Aneri /// Malwareteam	von google-suche zu ihavenet.com oder anderen Werbeseiten Na wunderbar es wär noch richtig toll wenn du Schritt 2 erledigst __________________ Gruß Aneri Mitglied von UNITE Lob oder Kritik? hier wirst du es los

25.09.2013, 15:54	#21
Aneri /// Malwareteam	von google-suche zu ihavenet.com oder anderen Werbeseiten Schritt 2 das war Schritt 1 __________________ --> von google-suche zu ihavenet.com oder anderen Werbeseiten

27.09.2013, 10:41	#27
Aneri /// Malwareteam	von google-suche zu ihavenet.com oder anderen Werbeseiten Hi kein Problem ... fang bei Downloade dir Delfix an wir hatten die beiden anderen Tools nicht in Verwendung... __________________ Gruß Aneri Mitglied von UNITE Lob oder Kritik? hier wirst du es los

14.11.2013, 12:11	#29
Aneri /// Malwareteam	von google-suche zu ihavenet.com oder anderen Werbeseiten Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen __________________ Gruß Aneri Mitglied von UNITE Lob oder Kritik? hier wirst du es los

von google-suche zu ihavenet.com oder anderen Werbeseiten

Plagegeister aller Art und deren Bekämpfung: von google-suche zu ihavenet.com oder anderen Werbeseiten