Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 06.11.2013, 14:53   #1
Celeste
 
Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Hallo,

folgendes Problem unter Betriebssystem (32 bit) Windows 7 Professional:

Meine Standard Suchmaschine ist Google. Gerne möchte ich sofort meine Suche direkt in der Adresszeile des Internet Explorer Browsers beginnen.

Gebe ich da ein Suchwort ein, gelange ich aber auf Certifed-Toolbar Search.

Wie kann ich das Ändern?

Ich habe bereits aus Anleitungen anderer Threads versucht mir selbst zu helfen mit:
  • adwcleaner
  • JRT

Log files:

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:33 on 06/11/2013 (Celeste)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Celeste (administrator) on Celeste-PC on 06-11-2013 12:44:03
Running from C:\Users\Celeste\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dropbox, Inc.) C:\Users\Celeste\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_9_900_117_ActiveX.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7731744 2009-08-31] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1190920 2010-02-25] (Dritek System Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-10] (Avira Operations GmbH & Co. KG)
MountPoints2: {18b0acbe-e47c-11e0-bf76-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236ee4-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236ef8-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236f21-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236f33-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {b64978db-e1fb-11e0-bec1-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {ccab6764-f22a-11e0-b2aa-00238b494f5d} - F:\AutoRun.exe
Startup: C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Celeste\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC4D31C4F4BB6CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: af0.Adblock.BHO - {90EFF544-3981-4d46-85C9-C0361D0931D6} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: haufereader - No CLSID Value - 
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=Somoto&dpid=Somoto&co=DE&userid=db2b82a3-a4e1-0ccc-7634-87e14194ce13&searchtype=hp&installDate=04/11/2013
CHR RestoreOnStartup:         "urls_to_restore_on_startup": [
CHR DefaultSearchURL: (Web) - hxxp://feed.snapdo.com/?publisher=Somoto&dpid=Somoto&co=DE&userid=db2b82a3-a4e1-0ccc-7634-87e14194ce13&searchtype=ds&q={searchTerms}&installDate=04/11/2013
CHR DefaultSuggestURL: (Web) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\Celeste\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File
CHR Extension: (Google Wallet) - C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

========================== Services (Whitelisted) =================

S4 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-14] ()
S3 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-07-16] (soft Xpansion)
S3 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [x]

==================== Drivers (Whitelisted) ====================

S2 agfucapi; C:\Windows\System32\DRIVERS\AGFUCAPI.SYS [202336 2000-08-09] (AGFEO GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-10] (Avira Operations GmbH & Co. KG)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-02] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
R1 StarPortLite; C:\Windows\System32\DRIVERS\StarPortLite.sys [95592 2009-03-02] (Rocket Division Software)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-03-31] (Symantec Corporation)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [217088 2006-02-06] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [17792 2006-02-06] (eMPIA Technology, Inc.)
R3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [43008 2007-03-28] (Winbond Electronics Corporation)
S1 DritekPortIO; \??\C:\Program Files\Launch Manager\DPortIO.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [x]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [x]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-06 12:33 - 2013-11-06 12:33 - 00000630 _____ C:\Users\Celeste\Desktop\defogger_disable.log
2013-11-06 12:32 - 2013-11-06 12:32 - 00050477 _____ C:\Users\Celeste\Desktop\Defogger.exe
2013-11-06 12:28 - 2013-11-06 12:33 - 00000020 _____ C:\Users\Celeste\defogger_reenable
2013-11-06 12:25 - 2013-11-06 12:25 - 00377856 _____ C:\Users\Celeste\Desktop\gmer_2.1.19163.exe
2013-11-06 12:13 - 2013-11-06 12:13 - 00000000 ____D C:\FRST
2013-11-06 12:11 - 2013-11-06 12:11 - 00000624 _____ C:\Users\Celeste\Desktop\JRT.txt
2013-11-06 12:08 - 2013-11-06 12:08 - 01089445 _____ (Farbar) C:\Users\Celeste\Desktop\FRST.exe
2013-11-06 11:45 - 2013-11-06 12:34 - 00000168 _____ C:\Windows\setupact.log
2013-11-06 11:45 - 2013-11-06 11:45 - 00000000 _____ C:\Windows\setuperr.log
2013-11-06 08:41 - 2013-11-06 08:41 - 00891167 _____ C:\Users\Celeste\Desktop\SecurityCheck.exe
2013-11-06 08:34 - 2013-11-06 08:34 - 02347384 _____ (ESET) C:\Users\Celeste\Desktop\esetsmartinstaller_enu.exe
2013-11-06 08:26 - 2013-11-06 08:26 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:25 - 2013-11-06 08:25 - 01034531 _____ (Thisisu) C:\Users\Celeste\Desktop\JRT.exe
2013-11-06 08:11 - 2013-11-06 12:00 - 00000000 ____D C:\AdwCleaner
2013-11-06 08:10 - 2013-11-06 08:10 - 01073262 _____ C:\Users\Celeste\Desktop\adwcleaner.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Celeste\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-06 07:39 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-06 07:21 - 2013-11-06 07:21 - 00000000 ____D C:\Users\Celeste\AppData\Local\AskPartnerNetwork
2013-11-06 07:16 - 2013-11-06 07:16 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Avira
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-06 07:11 - 2013-11-06 07:11 - 00000000 ____D C:\Program Files\Avira
2013-11-06 07:11 - 2013-10-10 19:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-06 07:08 - 2013-11-06 07:09 - 123853152 _____ C:\Users\Celeste\Downloads\avira_free_antivirus_de (2).exe
2013-11-05 14:46 - 2013-11-05 14:46 - 00004149 _____ C:\Users\Celeste\.recently-used.xbel
2013-11-05 13:11 - 2013-11-05 13:21 - 00000000 ____D C:\Users\Celeste\Desktop\New PDF
2013-11-05 08:43 - 2013-11-05 08:44 - 00000000 ____D C:\Users\Kinder
2013-11-05 08:43 - 2013-11-05 08:43 - 00001385 _____ C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 08:43 - 2013-11-05 08:43 - 00000020 ___SH C:\Users\Kinder\ntuser.ini
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Startmenü
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Netzwerkumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Druckumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Musik
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Bilder
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Local\Verlauf
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Adobe
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Local\VirtualStore
2013-11-05 08:43 - 2010-11-09 09:55 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Macromedia
2013-11-05 08:43 - 2010-06-08 22:54 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-05 08:43 - 2010-06-08 22:54 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-05 08:43 - 2010-02-26 23:09 - 00000000 ____D C:\Users\Kinder\AppData\Local\Microsoft Help
2013-11-05 07:42 - 2013-11-05 07:42 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (2).exe
2013-11-05 07:37 - 2013-11-05 07:37 - 02378752 _____ C:\Users\Celeste\Downloads\Adblock_Installer.msi
2013-11-05 07:37 - 2013-11-05 07:37 - 00000000 ____D C:\Program Files\af0.net
2013-11-04 23:52 - 2013-11-04 23:52 - 00000000 ____D C:\Users\Celeste\AppData\Local\PDF24
2013-11-04 23:51 - 2013-11-04 23:51 - 00000000 ____D C:\Program Files\PDF24
2013-11-04 23:50 - 2013-11-04 23:50 - 16198832 _____ (Geek Software GmbH                                          ) C:\Users\Celeste\Downloads\pdf24-creator-6.0.1.exe
2013-11-04 18:57 - 2013-11-06 10:32 - 00000000 ____D C:\Users\Celeste\Desktop\Meisterchorsingen Bopard
2013-11-04 18:57 - 2013-11-04 18:57 - 00001073 _____ C:\Users\Celeste\Desktop\Free M4a to MP3 Converter.lnk
2013-11-04 18:57 - 2013-11-04 18:57 - 00000000 ____D C:\Program Files\Free M4a to MP3 Converter
2013-11-04 18:56 - 2013-11-04 23:38 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:57 - 00000000 ____D C:\Users\Celeste\Documents\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00001150 _____ C:\Users\Celeste\Desktop\Free Audio Dub.lnk
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-11-04 18:53 - 2013-11-04 18:53 - 16877344 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Celeste\Downloads\FreeAudioDub1.7.9.908 (1).exe
2013-11-04 18:51 - 2013-11-04 18:51 - 05834488 _____ (ManiacTools.com                                             ) C:\Users\Celeste\Downloads\m4a-to80-mp3-converter.exe
2013-11-04 09:05 - 2013-11-04 09:05 - 00008158 _____ C:\Users\Celeste\Downloads\MC900334436.WMF
2013-11-04 09:04 - 2013-11-04 09:05 - 00000000 ___HD C:\Windows\AxInstSV
2013-11-01 11:41 - 2013-11-06 06:50 - 00000000 ____D C:\Users\Celeste\Sonets
2013-11-01 09:52 - 2013-11-01 09:52 - 00001084 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-11-01 09:51 - 2013-11-01 09:52 - 00000000 ____D C:\Program Files\TeamViewer
2013-10-27 10:34 - 2013-10-27 10:35 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-27 10:34 - 2013-10-27 10:35 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 10:34 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iPod
2013-10-22 17:11 - 2013-10-26 08:37 - 102329055 _____ C:\Windows\system32\엲啙ངd
2013-10-21 18:30 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-20 13:24 - 2013-10-20 13:24 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (1).exe
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-18 17:13 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-18 17:12 - 2013-10-08 06:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-18 17:12 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-18 17:12 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-18 17:11 - 2013-10-18 17:12 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-14 22:36 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-14 22:36 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-14 22:36 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-14 22:36 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-14 22:36 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-14 22:36 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-14 18:34 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-14 18:34 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-14 18:34 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-14 18:34 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-14 18:34 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-14 18:34 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-14 18:34 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-14 18:34 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-14 18:34 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-14 18:34 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-14 18:34 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-14 18:34 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-14 18:34 - 2013-07-12 11:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-14 18:34 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-14 18:34 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-14 18:34 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-14 18:34 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-14 18:34 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-14 18:34 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-14 18:34 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-14 18:34 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-14 18:34 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-14 18:34 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-14 18:34 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-14 18:34 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-14 18:34 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-14 18:33 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-14 18:14 - 2013-10-14 18:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job
2013-10-14 18:14 - 2013-10-14 18:14 - 00000000 ____D C:\Program Files\GUMFA36.tmp

==================== One Month Modified Files and Folders =======

2013-11-06 12:42 - 2009-07-14 05:34 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-06 12:42 - 2009-07-14 05:34 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-06 12:40 - 2010-02-25 19:48 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-06 12:38 - 2010-02-25 19:41 - 01120169 _____ C:\Windows\WindowsUpdate.log
2013-11-06 12:36 - 2013-02-14 15:45 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Dropbox
2013-11-06 12:35 - 2013-02-14 15:48 - 00000000 ___RD C:\Users\Celeste\Dropbox
2013-11-06 12:34 - 2013-11-06 11:45 - 00000168 _____ C:\Windows\setupact.log
2013-11-06 12:34 - 2013-01-19 11:49 - 00000386 ____H C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job
2013-11-06 12:34 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-06 12:33 - 2013-11-06 12:33 - 00000630 _____ C:\Users\Celeste\Desktop\defogger_disable.log
2013-11-06 12:33 - 2013-11-06 12:28 - 00000020 _____ C:\Users\Celeste\defogger_reenable
2013-11-06 12:32 - 2013-11-06 12:32 - 00050477 _____ C:\Users\Celeste\Desktop\Defogger.exe
2013-11-06 12:28 - 2010-02-25 19:46 - 00000000 ____D C:\Users\Celeste
2013-11-06 12:25 - 2013-11-06 12:25 - 00377856 _____ C:\Users\Celeste\Desktop\gmer_2.1.19163.exe
2013-11-06 12:15 - 2012-08-26 10:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-06 12:15 - 2011-05-22 19:48 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA.job
2013-11-06 12:13 - 2013-11-06 12:13 - 00000000 ____D C:\FRST
2013-11-06 12:11 - 2013-11-06 12:11 - 00000624 _____ C:\Users\Celeste\Desktop\JRT.txt
2013-11-06 12:08 - 2013-11-06 12:08 - 01089445 _____ (Farbar) C:\Users\Celeste\Desktop\FRST.exe
2013-11-06 12:00 - 2013-11-06 08:11 - 00000000 ____D C:\AdwCleaner
2013-11-06 11:48 - 2012-08-26 10:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-06 11:45 - 2013-11-06 11:45 - 00000000 _____ C:\Windows\setuperr.log
2013-11-06 11:45 - 2010-02-25 20:04 - 00925588 _____ C:\Windows\PFRO.log
2013-11-06 11:36 - 2012-09-29 08:44 - 00000000 ____D C:\Windows\Minidump
2013-11-06 11:29 - 2013-02-08 15:15 - 00000000 ____D C:\Users\Celeste\AppData\Local\1F198B4F-E6AD-4E83-8101-788D3C314901.aplzod
2013-11-06 10:32 - 2013-11-04 18:57 - 00000000 ____D C:\Users\Celeste\Desktop\Meisterchorsingen Bopard
2013-11-06 09:25 - 2010-06-19 10:29 - 00000000 ____D C:\Users\Celeste\AppData\Local\CrashDumps
2013-11-06 08:41 - 2013-11-06 08:41 - 00891167 _____ C:\Users\Celeste\Desktop\SecurityCheck.exe
2013-11-06 08:34 - 2013-11-06 08:34 - 02347384 _____ (ESET) C:\Users\Celeste\Desktop\esetsmartinstaller_enu.exe
2013-11-06 08:26 - 2013-11-06 08:26 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:25 - 2013-11-06 08:25 - 01034531 _____ (Thisisu) C:\Users\Celeste\Desktop\JRT.exe
2013-11-06 08:17 - 2012-02-07 10:43 - 00000000 ____D C:\ProgramData\Uniblue
2013-11-06 08:17 - 2010-02-26 20:46 - 00000000 ____D C:\ProgramData\ICQ
2013-11-06 08:10 - 2013-11-06 08:10 - 01073262 _____ C:\Users\Celeste\Desktop\adwcleaner.exe
2013-11-06 08:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Vss
2013-11-06 07:39 - 2013-11-06 07:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Celeste\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-06 07:25 - 2010-02-25 20:29 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-06 07:21 - 2013-11-06 07:21 - 00000000 ____D C:\Users\Celeste\AppData\Local\AskPartnerNetwork
2013-11-06 07:16 - 2013-11-06 07:16 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Avira
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-06 07:11 - 2013-11-06 07:11 - 00000000 ____D C:\Program Files\Avira
2013-11-06 07:11 - 2011-11-07 18:16 - 00000000 ____D C:\ProgramData\Avira
2013-11-06 07:09 - 2013-11-06 07:08 - 123853152 _____ C:\Users\Celeste\Downloads\avira_free_antivirus_de (2).exe
2013-11-06 06:50 - 2013-11-01 11:41 - 00000000 ____D C:\Users\Celeste\Sonets
2013-11-05 18:59 - 2011-05-22 19:48 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core.job
2013-11-05 14:46 - 2013-11-05 14:46 - 00004149 _____ C:\Users\Celeste\.recently-used.xbel
2013-11-05 14:46 - 2011-02-20 22:50 - 00000000 ____D C:\Users\Celeste\.gimp-2.6
2013-11-05 13:21 - 2013-11-05 13:11 - 00000000 ____D C:\Users\Celeste\Desktop\New PDF
2013-11-05 08:50 - 2011-04-17 13:54 - 00000000 ____D C:\Windows\pss
2013-11-05 08:44 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder
2013-11-05 08:43 - 2013-11-05 08:43 - 00001385 _____ C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 08:43 - 2013-11-05 08:43 - 00000020 ___SH C:\Users\Kinder\ntuser.ini
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Startmenü
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Netzwerkumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Druckumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Musik
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Bilder
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Local\Verlauf
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Adobe
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Local\VirtualStore
2013-11-05 07:52 - 2009-07-14 05:33 - 00413704 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-05 07:50 - 2012-08-26 10:56 - 00000000 ____D C:\Program Files\Google
2013-11-05 07:42 - 2013-11-05 07:42 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (2).exe
2013-11-05 07:37 - 2013-11-05 07:37 - 02378752 _____ C:\Users\Celeste\Downloads\Adblock_Installer.msi
2013-11-05 07:37 - 2013-11-05 07:37 - 00000000 ____D C:\Program Files\af0.net
2013-11-05 07:24 - 2010-10-27 17:01 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-11-05 07:21 - 2011-01-30 00:13 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-05 07:21 - 2010-02-26 20:46 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Mozilla
2013-11-05 07:18 - 2013-01-19 10:13 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-05 07:14 - 2011-05-22 19:47 - 00000000 ____D C:\Users\Celeste\AppData\Local\Google
2013-11-04 23:52 - 2013-11-04 23:52 - 00000000 ____D C:\Users\Celeste\AppData\Local\PDF24
2013-11-04 23:51 - 2013-11-04 23:51 - 00000000 ____D C:\Program Files\PDF24
2013-11-04 23:50 - 2013-11-04 23:50 - 16198832 _____ (Geek Software GmbH                                          ) C:\Users\Celeste\Downloads\pdf24-creator-6.0.1.exe
2013-11-04 23:50 - 2013-08-13 11:18 - 17810632 _____ (pdfforge GmbH) C:\Users\Celeste\Downloads\PDFCreator-1_7_1_setup.exe
2013-11-04 23:38 - 2013-11-04 18:56 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\DVDVideoSoft
2013-11-04 18:57 - 2013-11-04 18:57 - 00001073 _____ C:\Users\Celeste\Desktop\Free M4a to MP3 Converter.lnk
2013-11-04 18:57 - 2013-11-04 18:57 - 00000000 ____D C:\Program Files\Free M4a to MP3 Converter
2013-11-04 18:57 - 2013-11-04 18:56 - 00000000 ____D C:\Users\Celeste\Documents\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00001150 _____ C:\Users\Celeste\Desktop\Free Audio Dub.lnk
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-11-04 18:53 - 2013-11-04 18:53 - 16877344 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Celeste\Downloads\FreeAudioDub1.7.9.908 (1).exe
2013-11-04 18:51 - 2013-11-04 18:51 - 05834488 _____ (ManiacTools.com                                             ) C:\Users\Celeste\Downloads\m4a-to80-mp3-converter.exe
2013-11-04 10:00 - 2013-02-14 15:46 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-04 09:05 - 2013-11-04 09:05 - 00008158 _____ C:\Users\Celeste\Downloads\MC900334436.WMF
2013-11-04 09:05 - 2013-11-04 09:04 - 00000000 ___HD C:\Windows\AxInstSV
2013-11-01 10:22 - 2010-02-28 21:18 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\TeamViewer
2013-11-01 10:22 - 2010-02-25 20:11 - 00109744 _____ C:\Users\Celeste\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-01 09:52 - 2013-11-01 09:52 - 00001084 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-11-01 09:52 - 2013-11-01 09:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-10-27 10:35 - 2013-10-27 10:34 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-27 10:35 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 10:34 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iPod
2013-10-27 10:34 - 2010-04-10 12:22 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-10-26 09:21 - 2010-04-10 12:22 - 00000000 ____D C:\Users\Celeste\AppData\Local\Apple
2013-10-26 08:37 - 2013-10-22 17:11 - 102329055 _____ C:\Windows\system32\엲啙ངd
2013-10-20 13:24 - 2013-10-20 13:24 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (1).exe
2013-10-18 18:16 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-18 17:12 - 2013-10-18 17:11 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-18 17:12 - 2010-06-20 20:42 - 00000000 ____D C:\Program Files\Java
2013-10-18 16:52 - 2013-08-31 10:05 - 00000000 ____D C:\ProgramData\T-Online
2013-10-15 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-15 17:35 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-15 17:33 - 2010-04-28 08:21 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-14 22:44 - 2010-02-25 20:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-14 22:42 - 2013-07-23 21:16 - 00000000 ____D C:\Windows\system32\MRT
2013-10-14 22:39 - 2010-02-26 20:47 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-14 19:15 - 2012-04-10 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-14 19:15 - 2011-06-11 09:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-14 18:14 - 2013-10-14 18:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job
2013-10-14 18:14 - 2013-10-14 18:14 - 00000000 ____D C:\Program Files\GUMFA36.tmp
2013-10-14 18:14 - 2009-07-14 05:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 19:14 - 2013-11-06 07:11 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-08 06:50 - 2013-10-18 17:12 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 06:46 - 2013-10-18 17:13 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 06:46 - 2013-10-18 17:12 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 06:46 - 2013-10-18 17:12 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe

Files to move or delete:
====================
C:\Users\Celeste\N360v3DE.exe
C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job


Some content of TEMP:
====================
C:\Users\Celeste\AppData\Local\Temp\avgnt.exe
C:\Users\Celeste\AppData\Local\Temp\Installer.exe
C:\Users\Celeste\AppData\Local\Temp\ose00000.exe
C:\Users\Celeste\AppData\Local\Temp\Quarantine.exe
C:\Users\Celeste\AppData\Local\Temp\Tsu7D4A1B33.dll
C:\Users\Celeste\AppData\Local\Temp\_is15B3.exe
C:\Users\Celeste\AppData\Local\Temp\_is314E.exe
C:\Users\Celeste\AppData\Local\Temp\_isFA64.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 12:31

==================== End Of Log ============================
         
--- --- ---

--- --- ---





Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Doro at 2013-11-06 12:45:17
Running from C:\Users\Doro\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 7.1.8)
4660_4680_Help (Version: 1.00.0000)
AAVUpdateManager (Version: 18.00.0000)
Acer Crystal Eye Webcam (Version: 5.2.7.1)
AdblockIE (Version: 1.2)
Adobe AIR (Version: 3.7.0.2090)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133)
Amazon MP3-Downloader 1.0.15 (Version: 1.0.15)
Apple Application Support (Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (Version: 2.1.3.127)
Avira Free Antivirus (Version: 14.0.0.411)
Avira SearchFree Toolbar (Version: 12.6.0.1898)
Bonjour (Version: 3.0.0.10)
bpd_scan (Version: 3.00.0000)
BPDSoftware (Version: 140.0.000.000)
BPDSoftware_Ini (Version: 1.00.0000)
BufferChm (Version: 140.0.213.000)
DataSync Outlook (Version: 7.00.2906)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 140.0.213.000)
DocMgr (Version: 140.0.65.000)
DocProc (Version: 140.0.100.000)
Dropbox (HKCU Version: 2.4.6)
DVD Suite (Version: 5.0.1319)
Fax (Version: 140.0.213.000)
Free Audio Dub version 1.7.9.908 (Version: 1.7.9.908)
Free M4a to MP3 Converter 8.0
Free Mp3 Wma Converter V 2.2 (Version: 2.2.0.0)
GIMP 2.6.11 (Version: 2.6.11)
Google Chrome (HKCU Version: 30.0.1599.101)
Google Update Helper (Version: 1.3.21.165)
GPBaseService2 (Version: 140.0.212.000)
Haufe iDesk-Browser (Version: 9.06.30.7144)
Haufe iDesk-Service (Version: 7.09.07.4355)
Haufe iDesk-Service (Version: 8.08.20.5622)
Haufe iDesk-Service (Version: 9.08.21.7460)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Document Manager 2.0 (Version: 2.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP OfficeJet J4600 All-In-One Series (Version: 14.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (Version: 5.002.006.003)
HPDiagnosticAlert (Version: 1.00.0000)
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000)
HPPhotosmartEssential (Version: 2.04.0000)
HPProductAssistant (Version: 140.0.213.000)
HPSSupply (Version: 140.0.212.000)
iCloud (Version: 3.0.2.163)
Internet-TV für Windows Media Center (Version: 4.2.2.0)
iTunes (Version: 11.1.2.32)
J4680 (Version: 140.0.000.000)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
JMicron Flash Media Controller Driver (Version: 1.00.29.02)
Launch Manager (Version: 3.0.03)
Lexware Info Service (Version: 2.61.00.0033)
LightScribe System Software  1.10.27.1 (Version: 1.10.27.1)
Lyrics Plugin for Windows Media Player (Version: 0.4)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
MarketResearch (Version: 140.0.214.000)
maxdome - Online Videothek Version 3.1.0
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mp3tag v2.54 (Version: v2.54)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
neroxml (Version: 1.0.0)
Network (Version: 140.0.215.000)
NVIDIA Display Control Panel (Version: 1.6)
NVIDIA Drivers (Version: 1.7)
NVIDIA PhysX (Version: 9.10.0129)
OCR Software by I.R.I.S. 14.0 (Version: 14.0)
PDF Split And Merge Basic (Version: 2.2.2)
PDF24 Creator 6.0.1
PDFCreator (Version: 1.7.1)
PowerDVD (Version: 7.0.3409.a)
ProductContext (Version: 140.0.000.000)
QuickTime (Version: 7.74.80.86)
RealPlayer
Realtek High Definition Audio Driver (Version: 6.0.1.5928)
RealUpgrade 1.0 (Version: 1.0.0)
RedMon - Redirection Port Monitor
Scan (Version: 140.0.167.000)
Servicepack Datumsaktualisierung (Version: 1.00.00.0005)
Shop for HP Supplies (Version: 14.0)
Skype™ 5.10 (Version: 5.10.116)
SmartWebPrinting (Version: 140.0.213.000)
SolutionCenter (Version: 140.0.214.000)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Status (Version: 140.0.256.000)
Steuer 2006 (Version: 13.00)
Steuer 2007 (Version: 14.00)
Steuer 2008 (Version: 15.00.00.0033)
Steuer 2009 (Version: 16.12.00.0001)
Steuer Hilfesammlung (Version: 13.0.0.0)
Steuer Hilfesammlung (Version: 14.0.0.0)
Steuer Hilfesammlung (Version: 15.0.0.0)
Steuer Update 13.03 (Version: 13.03)
Steuer Update 14.01 (Version: 14.01)
Steuer Update 15.09 (Version: 15.09)
Steuer-Hilfesammlung 2009 (Version: 16.0.1.0)
Steuer-Spar-Erklärung 2009 (Version: 14.08.0000)
Steuer-Spar-Erklärung 2010 (Version: 15.15)
Steuer-Spar-Erklärung 2011 (Version: 16.16)
Steuer-Spar-Erklärung 2012 (Version: 17.11)
Steuer-Spar-Erklärung 2013 (Version: 18.08)
swMSM (Version: 12.0.0.1)
System Requirements Lab
TeamViewer 8 (Version: 8.0.22298)
Toolbox (Version: 140.0.428.000)
TrayApp (Version: 140.0.213.000)
TuneWiki (Version: 1.0.0.209)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
WebReg (Version: 140.0.213.017)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Media Center Add-in for Silverlight (Version: 4.7.3.0)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Mobile Device Center Driver Update (Version: 6.1.6965.0)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
Yahoo! Detect

==================== Restore Points  =========================

01-10-2013 19:34:31 Windows Update
06-10-2013 10:03:22 Windows Update
14-10-2013 17:33:28 Windows Update
14-10-2013 21:30:05 Windows Update
18-10-2013 15:19:36 Windows Update
18-10-2013 15:52:10 Entfernt Telekom Kinderschutz Software
18-10-2013 16:11:06 Installed Java 7 Update 45
22-10-2013 16:10:33 Windows Update
26-10-2013 07:48:48 Windows Update
30-10-2013 16:56:05 Windows Update
05-11-2013 06:02:53 Windows Update
05-11-2013 06:22:36 Removed Media Go
05-11-2013 06:23:30 Removed Media Go Video Playback Engine 1.84.106.07010
05-11-2013 06:37:37 Installed AdblockIE
06-11-2013 06:24:19 Configured GoGear Mix Device Manager
06-11-2013 06:24:57 Removed GoGear Mix Device Manager
06-11-2013 06:26:10 Removed HP Product Detection

==================== Hosts content: ==========================

2009-07-14 03:04 - 2011-03-13 13:44 - 00001023 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 im.adtech.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adtech.de
127.0.0.1 atwola.com
127.0.0.1 adserver.71i.de
127.0.0.1 adicqserver.71i.de
127.0.0.1 71i.de
127.0.0.1 ar.atwola.com


==================== Scheduled Tasks (whitelisted) =============

Task: {135995B5-D214-452F-BAB4-7109FBAFADDB} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2208508394-1456433274-1180839891-1000 => C:\Program Files\Real\RealUpgrade\realupgrade.exe [2010-02-09] (RealNetworks, Inc.)
Task: {4423113D-0813-4F84-8EEC-3856573D9678} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2208508394-1456433274-1180839891-1000 => C:\Program Files\Real\RealUpgrade\realupgrade.exe [2010-02-09] (RealNetworks, Inc.)
Task: {664C2989-6545-44B0-ADD4-52B5534A9270} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {690AB68C-ED8F-44B1-8CCD-4655349F5904} - System32\Tasks\{39AB1BD2-1FDD-43A3-8E25-FB84B3190D26} => C:\Program Files\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {77B29C52-0E3A-4C34-8C2D-B1A7BF32C6B5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-14] (Adobe Systems Incorporated)
Task: {7F2979F5-5E94-4906-AB73-5897663EB552} - System32\Tasks\{E3EB61C6-9451-4DB5-AC9A-3FA523A98F81} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {9D9E813C-5103-4D9B-9C94-DBB888C35C99} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core => C:\Users\Doro\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-22] (Google Inc.)
Task: {B289AF8F-8F60-4C0B-8925-730C1E3616DB} - System32\Tasks\{83A2A084-2023-4E63-BCAD-52982AF358B7} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {B5E84638-8098-4D7D-B178-5AD76695226E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {BE4E90BD-B82D-473F-A68E-923A3D01BED9} - System32\Tasks\{69DA8336-931F-49CA-A96A-7906419B4B6B} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {BF0B8A3F-526E-4D13-9680-7517B9D696F9} - System32\Tasks\{D0FD00A5-B532-4ABA-B654-20044CE6C04A} => C:\Users\Doro\AppData\Local\Temp\7zS38EF\OJJ4600_Scrubber_13\scrub2k.exe
Task: {CDC10BA1-E233-4134-893D-6E5C086CAD76} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA => C:\Users\Doro\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-22] (Google Inc.)
Task: {DFF713E0-01C5-43F2-8498-14440360A55B} - System32\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe
Task: {E57B80B3-0C0B-4504-93EC-58337A372002} - System32\Tasks\{4B34404D-A4EB-40E1-B6B8-94BE589DF63E} => C:\Users\Doro\AppData\Local\Temp\7zS38EF\OJJ4600_Scrubber_13\scrub2k.exe
Task: {F7B23BA0-A528-410E-A0B2-108961FFEB03} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core.job => C:\Users\Doro\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA.job => C:\Users\Doro\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe

==================== Loaded Modules (whitelisted) =============

2010-02-27 11:45 - 2005-01-06 18:33 - 00116224 _____ () C:\Windows\System32\redmonnt.dll
2013-11-06 07:11 - 2013-10-10 19:14 - 00394824 _____ () C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll
2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Doro\AppData\Roaming\Dropbox\bin\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (11/06/2013 00:35:41 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/06/2013 00:34:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Eumex 5000PC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058


Microsoft Office Sessions:
=========================
Error: (07/02/2013 10:06:40 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 929 seconds with 840 seconds of active time.  This session ended with a crash.

Error: (07/02/2013 09:49:32 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3907 seconds with 3420 seconds of active time.  This session ended with a crash.

Error: (05/21/2013 05:14:17 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9603 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:58:25 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 274 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:53:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 150 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:51:05 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16447 seconds with 1080 seconds of active time.  This session ended with a crash.

Error: (02/14/2013 01:50:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3911 seconds with 480 seconds of active time.  This session ended with a crash.

Error: (01/05/2013 09:25:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 462158 seconds with 540 seconds of active time.  This session ended with a crash.

Error: (01/08/2012 04:09:32 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 94663 seconds with 16380 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-10-15 22:46:05.259
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-10-01 22:39:22.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-16 22:33:11.237
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-16 21:41:51.056
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-11 07:29:25.960
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-11 07:15:03.923
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-10 07:31:59.583
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-10 07:10:40.360
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-09 17:19:31.102
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-09 16:43:29.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 33%
Total physical RAM: 3066.87 MB
Available physical RAM: 2029.39 MB
Total Pagefile: 6132.02 MB
Available Pagefile: 4824.75 MB
Total Virtual: 2047.88 MB
Available Virtual: 1916.6 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:91.87 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 66F2CA13)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Code:
ATTFilter
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-11-06 13:42:38
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9250315AS rev.0001SDM1 232,89GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Celeste\AppData\Local\Temp\kxldapog.sys


---- System - GMER 2.1 ----

SSDT   8FC539D6                                                                                                            ZwCreateSection
SSDT   8FC539E0                                                                                                            ZwRequestWaitReplyPort
SSDT   8FC539DB                                                                                                            ZwSetContextThread
SSDT   8FC539E5                                                                                                            ZwSetSecurityObject
SSDT   8FC539EA                                                                                                            ZwSystemDebugControl
SSDT   8FC53977                                                                                                            ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                                            83293A15 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                              832CD212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text  ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                                 832D458C 4 Bytes  [D6, 39, C5, 8F]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                                 832D48E8 4 Bytes  [E0, 39, C5, 8F]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                                 832D492C 4 Bytes  [DB, 39, C5, 8F]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                                 832D49A8 4 Bytes  [E5, 39, C5, 8F]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                                 832D49FC 4 Bytes  JMP B78FC539 
.text  ...                                                                                                                 

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                    
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                 C:\Program Files\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                 0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                 0
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                              0x81 0x76 0xEF 0xB2 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001                           
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                        0x20 0x01 0x00 0x00 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                     0xD2 0xF4 0x27 0x35 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0                      
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                0xB3 0x25 0x84 0x24 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                     C:\Program Files\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                     0x00 0x00 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                     0
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                  0x81 0x76 0xEF 0xB2 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)       
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0                            0x20 0x01 0x00 0x00 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12                         0xD2 0xF4 0x27 0x35 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)  
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12                    0xB3 0x25 0x84 0x24 ...

---- EOF - GMER 2.1 ----
         

Code:
ATTFilter
# AdwCleaner v3.011 - Bericht erstellt am 06/11/2013 um 08:12:09
# Updated 03/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Celeste - Celeste-PC
# Gestartet von : C:\Users\Celeste\Downloads\adwcleaner (1).exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gefunden : C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\net.lnk
Ordner Gefunden : C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Ordner Gefunden : C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcgmidjhhnnjikpigolabhacfngibde
Ordner Gefunden : C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihcgmidjhhnnjikpigolabhacfngibde
Ordner Gefunden C:\Program Files\Ask.com
Ordner Gefunden C:\Program Files\DAEMON Tools Toolbar
Ordner Gefunden C:\Program Files\FunWebProducts
Ordner Gefunden C:\Program Files\ICQ6Toolbar
Ordner Gefunden C:\Program Files\MyWebSearch
Ordner Gefunden C:\ProgramData\Babylon
Ordner Gefunden C:\ProgramData\clsoft ltd
Ordner Gefunden C:\ProgramData\ICQ\ICQToolbar
Ordner Gefunden C:\ProgramData\Uniblue\DriverScanner
Ordner Gefunden C:\SoftwareUpdater
Ordner Gefunden C:\Users\Celeste\AppData\Local\Babylon
Ordner Gefunden C:\Users\Celeste\AppData\Local\OpenCandy
Ordner Gefunden C:\Users\Celeste\AppData\LocalLow\FunWebProducts
Ordner Gefunden C:\Users\Celeste\AppData\LocalLow\MyWebSearch
Ordner Gefunden C:\Users\Celeste\AppData\LocalLow\SimplyTech
Ordner Gefunden C:\Users\Celeste\AppData\Roaming\pdfforge
Ordner Gefunden C:\Users\Celeste\AppData\Roaming\Windows Net Data
Ordner Gefunden C:\Windows\installer\{86d4b82a-abed-442a-be86-96357b70f4fe}

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\Fun Web Products
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\FunWebProducts
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\MyWebSearch
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gefunden : HKCU\Software\AppDataLow\Software\simplytech
Schlüssel Gefunden : HKCU\Software\BI
Schlüssel Gefunden : HKCU\Software\FoxyDeal
Schlüssel Gefunden : HKCU\Software\IGearSettings
Schlüssel Gefunden : HKCU\Software\Iminent
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\ICQ\ICQToolBar
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA696155-D96E-4281-B467-0367A0456474}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA696155-D96E-4281-B467-0367A0456474}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gefunden : HKCU\Software\MyWebSearch
Schlüssel Gefunden : HKCU\Software\simplytech
Schlüssel Gefunden : HKCU\Software\smartbar
Schlüssel Gefunden : HKCU\Software\YahooPartnerToolbar
Schlüssel Gefunden : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Schlüssel Gefunden : HKLM\Software\Babylon
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{BA696155-D96E-4281-B467-0367A0456474}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\driverscanner
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\DTToolbar.ToolBandObj.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{3E288F79-03E4-4983-A48E-0D879B51FF19}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gefunden : HKLM\Software\FocusInteractive
Schlüssel Gefunden : HKLM\Software\Fun Web Products
Schlüssel Gefunden : HKLM\Software\ICQ\ICQToolbar
Schlüssel Gefunden : HKLM\Software\Iminent
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CFD485F0-96BD-47CD-BB6D-CD7DDA95F102}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\AskSLib_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\driverscanner_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\HomeTab_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SaveByClick_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetim_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasapi32
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Tracing\sweetimsetup_rasmancs
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BA696155-D96E-4281-B467-0367A0456474}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{08858AF6-42AD-4914-95D2-AC3AB0DC8E28}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0238BBE24EA3A70408B81E4BB89C15E5
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\29799DE249E7DBC459FC6C8F07EB8375
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gefunden : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\daemon tools toolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARP
Schlüssel Gefunden : HKLM\Software\MyWebSearch
Schlüssel Gefunden : HKLM\Software\SP Global
Schlüssel Gefunden : HKLM\Software\SProtector
Schlüssel Gefunden : HKLM\Software\Uniblue\DriverScanner
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gefunden : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{32099AAC-C132-4136-9E9A-4E364A424E17}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{BA696155-D96E-4281-B467-0367A0456474}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720

Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [ICQ Search] - hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Search [Search Bar] - hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.7&ts=1373991627290.000001&tguid=46364-3869-1373991627290-9C04084ACBB83DB8DF6D854EF63CD40F&st=chrome&q=
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Search [Search Page] - hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.7&ts=1373991627290.000001&tguid=46364-3869-1373991627290-9C04084ACBB83DB8DF6D854EF63CD40F&st=chrome&q=
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Bar] - hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.7&ts=1373991627290.000001&tguid=46364-3869-1373991627290-9C04084ACBB83DB8DF6D854EF63CD40F&st=chrome&q=
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Search [Search Page] - hxxp://search.certified-toolbar.com?si=46364&tid=3869&ver=3.7&ts=1373991627290.000001&tguid=46364-3869-1373991627290-9C04084ACBB83DB8DF6D854EF63CD40F&st=chrome&q=
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchUrl [(Default)] - hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.7&ts=1373991627290.000001&tguid=46364-3869-1373991627290-9C04084ACBB83DB8DF6D854EF63CD40F&q=%s
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl [(Default)] - hxxp://search.certified-toolbar.com?si=46364&st=bs&tid=3869&ver=3.7&ts=1373991627290.000001&tguid=46364-3869-1373991627290-9C04084ACBB83DB8DF6D854EF63CD40F&q=%s

-\\ Google Chrome v

[ Datei : C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [23037 octets] - [06/11/2013 08:12:09]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [23098 octets] ##########
         


Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.8 (11.05.2013:1)
OS: Windows 7 Professional x86
Ran by Celeste on 06.11.2013 at 12:09:09,58
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 06.11.2013 at 12:11:23,94
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Bitte beachten, dass ich mir meine PC-Anwenderkenntnisse selbst angeeignet habe. Das heißt da gibt es sicherlich noch ganz viel zu lernen

Geändert von Celeste (06.11.2013 um 15:08 Uhr)

Alt 06.11.2013, 15:20   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



AdwCleaner musst Du auch löschen lassen

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


und ein frisches FRST log bitte.
__________________

__________________

Alt 06.11.2013, 16:14   #3
Celeste
 
Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Code:
ATTFilter
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.11.06.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16721
Celeste :: Celeste-PC [Administrator]

06.11.2013 15:30:52
mbam-log-2013-11-06 (15-30-52).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 244558
Laufzeit: 14 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         
Code:
ATTFilter
# AdwCleaner v3.011 - Bericht erstellt am 06/11/2013 um 15:50:57
# Updated 03/11/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (32 bits)
# Benutzername : Celeste - Celeste-PC
# Gestartet von : C:\Users\Celeste\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Google Chrome v

[ Datei : C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [23179 octets] - [06/11/2013 08:12:09]
AdwCleaner[R1].txt - [23240 octets] - [06/11/2013 08:14:49]
AdwCleaner[R2].txt - [1040 octets] - [06/11/2013 11:42:21]
AdwCleaner[R3].txt - [1084 octets] - [06/11/2013 11:59:28]
AdwCleaner[R4].txt - [1198 octets] - [06/11/2013 15:49:45]
AdwCleaner[S0].txt - [22350 octets] - [06/11/2013 08:17:26]
AdwCleaner[S1].txt - [1102 octets] - [06/11/2013 11:43:59]
AdwCleaner[S2].txt - [1146 octets] - [06/11/2013 12:00:39]
AdwCleaner[S3].txt - [1120 octets] - [06/11/2013 15:50:57]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1180 octets] ##########
         

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Celeste (administrator) on Celeste-PC on 06-11-2013 15:57:45
Running from C:\Users\Celeste\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Dropbox, Inc.) C:\Users\Celeste\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7731744 2009-08-31] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1190920 2010-02-25] (Dritek System Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-10] (Avira Operations GmbH & Co. KG)
MountPoints2: {18b0acbe-e47c-11e0-bf76-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236ee4-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236ef8-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236f21-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236f33-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {b64978db-e1fb-11e0-bec1-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {ccab6764-f22a-11e0-b2aa-00238b494f5d} - F:\AutoRun.exe
Startup: C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Celeste\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC4D31C4F4BB6CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: af0.Adblock.BHO - {90EFF544-3981-4d46-85C9-C0361D0931D6} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: haufereader - No CLSID Value - 
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=Somoto&dpid=Somoto&co=DE&userid=db2b82a3-a4e1-0ccc-7634-87e14194ce13&searchtype=hp&installDate=04/11/2013
CHR RestoreOnStartup:         "urls_to_restore_on_startup": [
CHR DefaultSearchURL: (Web) - hxxp://feed.snapdo.com/?publisher=Somoto&dpid=Somoto&co=DE&userid=db2b82a3-a4e1-0ccc-7634-87e14194ce13&searchtype=ds&q={searchTerms}&installDate=04/11/2013
CHR DefaultSuggestURL: (Web) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\Celeste\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File
CHR Extension: (Google Wallet) - C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

========================== Services (Whitelisted) =================

S4 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-14] ()
S3 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-07-16] (soft Xpansion)
S3 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [x]

==================== Drivers (Whitelisted) ====================

S2 agfucapi; C:\Windows\System32\DRIVERS\AGFUCAPI.SYS [202336 2000-08-09] (AGFEO GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-10] (Avira Operations GmbH & Co. KG)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-02] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
R1 StarPortLite; C:\Windows\System32\DRIVERS\StarPortLite.sys [95592 2009-03-02] (Rocket Division Software)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-03-31] (Symantec Corporation)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [217088 2006-02-06] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [17792 2006-02-06] (eMPIA Technology, Inc.)
R3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [43008 2007-03-28] (Winbond Electronics Corporation)
S1 DritekPortIO; \??\C:\Program Files\Launch Manager\DPortIO.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [x]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [x]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-06 15:54 - 2013-11-06 15:55 - 00001272 _____ C:\Users\Celeste\Desktop\AdwCleaner[S3].txt
2013-11-06 13:42 - 2013-11-06 14:09 - 00005425 _____ C:\Users\Celeste\Desktop\gmer.log
2013-11-06 12:33 - 2013-11-06 14:06 - 00000638 _____ C:\Users\Celeste\Desktop\defogger_disable.log
2013-11-06 12:32 - 2013-11-06 12:32 - 00050477 _____ C:\Users\Celeste\Desktop\Defogger.exe
2013-11-06 12:28 - 2013-11-06 12:33 - 00000020 _____ C:\Users\Celeste\defogger_reenable
2013-11-06 12:25 - 2013-11-06 12:25 - 00377856 _____ C:\Users\Celeste\Desktop\gmer_2.1.19163.exe
2013-11-06 12:13 - 2013-11-06 12:13 - 00000000 ____D C:\FRST
2013-11-06 12:11 - 2013-11-06 14:09 - 00000627 _____ C:\Users\Celeste\Desktop\JRT.txt
2013-11-06 12:08 - 2013-11-06 12:08 - 01089445 _____ (Farbar) C:\Users\Celeste\Desktop\FRST.exe
2013-11-06 11:45 - 2013-11-06 15:52 - 00000224 _____ C:\Windows\setupact.log
2013-11-06 11:45 - 2013-11-06 11:45 - 00000000 _____ C:\Windows\setuperr.log
2013-11-06 08:41 - 2013-11-06 08:41 - 00891167 _____ C:\Users\Celeste\Desktop\SecurityCheck.exe
2013-11-06 08:34 - 2013-11-06 08:34 - 02347384 _____ (ESET) C:\Users\Celeste\Desktop\esetsmartinstaller_enu.exe
2013-11-06 08:26 - 2013-11-06 08:26 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:25 - 2013-11-06 08:25 - 01034531 _____ (Thisisu) C:\Users\Celeste\Desktop\JRT.exe
2013-11-06 08:11 - 2013-11-06 15:51 - 00000000 ____D C:\AdwCleaner
2013-11-06 08:10 - 2013-11-06 08:10 - 01073262 _____ C:\Users\Celeste\Desktop\adwcleaner.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Celeste\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-06 07:39 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-06 07:21 - 2013-11-06 07:21 - 00000000 ____D C:\Users\Celeste\AppData\Local\AskPartnerNetwork
2013-11-06 07:16 - 2013-11-06 07:16 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Avira
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-06 07:11 - 2013-11-06 07:11 - 00000000 ____D C:\Program Files\Avira
2013-11-06 07:11 - 2013-10-10 19:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-06 07:08 - 2013-11-06 07:09 - 123853152 _____ C:\Users\Celeste\Downloads\avira_free_antivirus_de (2).exe
2013-11-05 14:46 - 2013-11-05 14:46 - 00004149 _____ C:\Users\Celeste\.recently-used.xbel
2013-11-05 13:11 - 2013-11-05 13:21 - 00000000 ____D C:\Users\Celeste\Desktop\New PDF
2013-11-05 08:43 - 2013-11-05 08:44 - 00000000 ____D C:\Users\Kinder
2013-11-05 08:43 - 2013-11-05 08:43 - 00001385 _____ C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 08:43 - 2013-11-05 08:43 - 00000020 ___SH C:\Users\Kinder\ntuser.ini
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Startmenü
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Netzwerkumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Druckumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Musik
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Bilder
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Local\Verlauf
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Adobe
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Local\VirtualStore
2013-11-05 08:43 - 2010-11-09 09:55 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Macromedia
2013-11-05 08:43 - 2010-06-08 22:54 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-05 08:43 - 2010-06-08 22:54 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-05 08:43 - 2010-02-26 23:09 - 00000000 ____D C:\Users\Kinder\AppData\Local\Microsoft Help
2013-11-05 07:42 - 2013-11-05 07:42 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (2).exe
2013-11-05 07:37 - 2013-11-05 07:37 - 02378752 _____ C:\Users\Celeste\Downloads\Adblock_Installer.msi
2013-11-05 07:37 - 2013-11-05 07:37 - 00000000 ____D C:\Program Files\af0.net
2013-11-04 23:52 - 2013-11-04 23:52 - 00000000 ____D C:\Users\Celeste\AppData\Local\PDF24
2013-11-04 23:51 - 2013-11-04 23:51 - 00000000 ____D C:\Program Files\PDF24
2013-11-04 23:50 - 2013-11-04 23:50 - 16198832 _____ (Geek Software GmbH                                          ) C:\Users\Celeste\Downloads\pdf24-creator-6.0.1.exe
2013-11-04 18:57 - 2013-11-06 10:32 - 00000000 ____D C:\Users\Celeste\Desktop\Meisterchorsingen Bopard
2013-11-04 18:57 - 2013-11-04 18:57 - 00001073 _____ C:\Users\Celeste\Desktop\Free M4a to MP3 Converter.lnk
2013-11-04 18:57 - 2013-11-04 18:57 - 00000000 ____D C:\Program Files\Free M4a to MP3 Converter
2013-11-04 18:56 - 2013-11-04 23:38 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:57 - 00000000 ____D C:\Users\Celeste\Documents\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00001150 _____ C:\Users\Celeste\Desktop\Free Audio Dub.lnk
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-11-04 18:53 - 2013-11-04 18:53 - 16877344 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Celeste\Downloads\FreeAudioDub1.7.9.908 (1).exe
2013-11-04 18:51 - 2013-11-04 18:51 - 05834488 _____ (ManiacTools.com                                             ) C:\Users\Celeste\Downloads\m4a-to80-mp3-converter.exe
2013-11-04 09:05 - 2013-11-04 09:05 - 00008158 _____ C:\Users\Celeste\Downloads\MC900334436.WMF
2013-11-04 09:04 - 2013-11-04 09:05 - 00000000 ___HD C:\Windows\AxInstSV
2013-11-01 11:41 - 2013-11-06 06:50 - 00000000 ____D C:\Users\Celeste\Sonets
2013-11-01 09:52 - 2013-11-01 09:52 - 00001084 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-11-01 09:51 - 2013-11-01 09:52 - 00000000 ____D C:\Program Files\TeamViewer
2013-10-27 10:34 - 2013-10-27 10:35 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-27 10:34 - 2013-10-27 10:35 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 10:34 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iPod
2013-10-22 17:11 - 2013-10-26 08:37 - 102329055 _____ C:\Windows\system32\엲啙ངd
2013-10-21 18:30 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-20 13:24 - 2013-10-20 13:24 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (1).exe
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-18 17:13 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-18 17:12 - 2013-10-08 06:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-18 17:12 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-18 17:12 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-18 17:11 - 2013-10-18 17:12 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-14 22:36 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-14 22:36 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-14 22:36 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-14 22:36 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-14 22:36 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-14 22:36 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-14 18:34 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-14 18:34 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-14 18:34 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-14 18:34 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-14 18:34 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-14 18:34 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-14 18:34 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-14 18:34 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-14 18:34 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-14 18:34 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-14 18:34 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-14 18:34 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-14 18:34 - 2013-07-12 11:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-14 18:34 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-14 18:34 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-14 18:34 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-14 18:34 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-14 18:34 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-14 18:34 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-14 18:34 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-14 18:34 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-14 18:34 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-14 18:34 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-14 18:34 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-14 18:34 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-14 18:34 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-14 18:33 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-14 18:14 - 2013-10-14 18:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job
2013-10-14 18:14 - 2013-10-14 18:14 - 00000000 ____D C:\Program Files\GUMFA36.tmp

==================== One Month Modified Files and Folders =======

2013-11-06 15:57 - 2010-02-25 19:48 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-06 15:56 - 2010-02-25 19:41 - 01125483 _____ C:\Windows\WindowsUpdate.log
2013-11-06 15:55 - 2013-11-06 15:54 - 00001272 _____ C:\Users\Celeste\Desktop\AdwCleaner[S3].txt
2013-11-06 15:55 - 2013-02-14 15:45 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Dropbox
2013-11-06 15:53 - 2013-02-14 15:48 - 00000000 ___RD C:\Users\Celeste\Dropbox
2013-11-06 15:53 - 2013-01-19 11:49 - 00000386 ____H C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job
2013-11-06 15:52 - 2013-11-06 11:45 - 00000224 _____ C:\Windows\setupact.log
2013-11-06 15:52 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-06 15:51 - 2013-11-06 08:11 - 00000000 ____D C:\AdwCleaner
2013-11-06 15:48 - 2012-08-26 10:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-06 15:15 - 2012-08-26 10:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-06 15:15 - 2011-05-22 19:48 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA.job
2013-11-06 14:09 - 2013-11-06 13:42 - 00005425 _____ C:\Users\Celeste\Desktop\gmer.log
2013-11-06 14:09 - 2013-11-06 12:11 - 00000627 _____ C:\Users\Celeste\Desktop\JRT.txt
2013-11-06 14:06 - 2013-11-06 12:33 - 00000638 _____ C:\Users\Celeste\Desktop\defogger_disable.log
2013-11-06 12:59 - 2010-06-19 10:29 - 00000000 ____D C:\Users\Celeste\AppData\Local\CrashDumps
2013-11-06 12:42 - 2009-07-14 05:34 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-06 12:42 - 2009-07-14 05:34 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-06 12:33 - 2013-11-06 12:28 - 00000020 _____ C:\Users\Celeste\defogger_reenable
2013-11-06 12:32 - 2013-11-06 12:32 - 00050477 _____ C:\Users\Celeste\Desktop\Defogger.exe
2013-11-06 12:28 - 2010-02-25 19:46 - 00000000 ____D C:\Users\Celeste
2013-11-06 12:25 - 2013-11-06 12:25 - 00377856 _____ C:\Users\Celeste\Desktop\gmer_2.1.19163.exe
2013-11-06 12:13 - 2013-11-06 12:13 - 00000000 ____D C:\FRST
2013-11-06 12:08 - 2013-11-06 12:08 - 01089445 _____ (Farbar) C:\Users\Celeste\Desktop\FRST.exe
2013-11-06 11:45 - 2013-11-06 11:45 - 00000000 _____ C:\Windows\setuperr.log
2013-11-06 11:45 - 2010-02-25 20:04 - 00925588 _____ C:\Windows\PFRO.log
2013-11-06 11:36 - 2012-09-29 08:44 - 00000000 ____D C:\Windows\Minidump
2013-11-06 11:29 - 2013-02-08 15:15 - 00000000 ____D C:\Users\Celeste\AppData\Local\1F198B4F-E6AD-4E83-8101-788D3C314901.aplzod
2013-11-06 10:32 - 2013-11-04 18:57 - 00000000 ____D C:\Users\Celeste\Desktop\Meisterchorsingen Bopard
2013-11-06 08:41 - 2013-11-06 08:41 - 00891167 _____ C:\Users\Celeste\Desktop\SecurityCheck.exe
2013-11-06 08:34 - 2013-11-06 08:34 - 02347384 _____ (ESET) C:\Users\Celeste\Desktop\esetsmartinstaller_enu.exe
2013-11-06 08:26 - 2013-11-06 08:26 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:25 - 2013-11-06 08:25 - 01034531 _____ (Thisisu) C:\Users\Celeste\Desktop\JRT.exe
2013-11-06 08:17 - 2012-02-07 10:43 - 00000000 ____D C:\ProgramData\Uniblue
2013-11-06 08:17 - 2010-02-26 20:46 - 00000000 ____D C:\ProgramData\ICQ
2013-11-06 08:10 - 2013-11-06 08:10 - 01073262 _____ C:\Users\Celeste\Desktop\adwcleaner.exe
2013-11-06 08:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Vss
2013-11-06 07:39 - 2013-11-06 07:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Celeste\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-06 07:25 - 2010-02-25 20:29 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-06 07:21 - 2013-11-06 07:21 - 00000000 ____D C:\Users\Celeste\AppData\Local\AskPartnerNetwork
2013-11-06 07:16 - 2013-11-06 07:16 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Avira
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-06 07:11 - 2013-11-06 07:11 - 00000000 ____D C:\Program Files\Avira
2013-11-06 07:11 - 2011-11-07 18:16 - 00000000 ____D C:\ProgramData\Avira
2013-11-06 07:09 - 2013-11-06 07:08 - 123853152 _____ C:\Users\Celeste\Downloads\avira_free_antivirus_de (2).exe
2013-11-06 06:50 - 2013-11-01 11:41 - 00000000 ____D C:\Users\Celeste\Sonets
2013-11-05 18:59 - 2011-05-22 19:48 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core.job
2013-11-05 14:46 - 2013-11-05 14:46 - 00004149 _____ C:\Users\Celeste\.recently-used.xbel
2013-11-05 14:46 - 2011-02-20 22:50 - 00000000 ____D C:\Users\Celeste\.gimp-2.6
2013-11-05 13:21 - 2013-11-05 13:11 - 00000000 ____D C:\Users\Celeste\Desktop\New PDF
2013-11-05 08:50 - 2011-04-17 13:54 - 00000000 ____D C:\Windows\pss
2013-11-05 08:44 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder
2013-11-05 08:43 - 2013-11-05 08:43 - 00001385 _____ C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 08:43 - 2013-11-05 08:43 - 00000020 ___SH C:\Users\Kinder\ntuser.ini
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Startmenü
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Netzwerkumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Druckumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Musik
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Bilder
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Local\Verlauf
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Adobe
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Local\VirtualStore
2013-11-05 07:52 - 2009-07-14 05:33 - 00413704 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-05 07:50 - 2012-08-26 10:56 - 00000000 ____D C:\Program Files\Google
2013-11-05 07:42 - 2013-11-05 07:42 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (2).exe
2013-11-05 07:37 - 2013-11-05 07:37 - 02378752 _____ C:\Users\Celeste\Downloads\Adblock_Installer.msi
2013-11-05 07:37 - 2013-11-05 07:37 - 00000000 ____D C:\Program Files\af0.net
2013-11-05 07:24 - 2010-10-27 17:01 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-11-05 07:21 - 2011-01-30 00:13 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-05 07:21 - 2010-02-26 20:46 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Mozilla
2013-11-05 07:18 - 2013-01-19 10:13 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-05 07:14 - 2011-05-22 19:47 - 00000000 ____D C:\Users\Celeste\AppData\Local\Google
2013-11-04 23:52 - 2013-11-04 23:52 - 00000000 ____D C:\Users\Celeste\AppData\Local\PDF24
2013-11-04 23:51 - 2013-11-04 23:51 - 00000000 ____D C:\Program Files\PDF24
2013-11-04 23:50 - 2013-11-04 23:50 - 16198832 _____ (Geek Software GmbH                                          ) C:\Users\Celeste\Downloads\pdf24-creator-6.0.1.exe
2013-11-04 23:50 - 2013-08-13 11:18 - 17810632 _____ (pdfforge GmbH) C:\Users\Celeste\Downloads\PDFCreator-1_7_1_setup.exe
2013-11-04 23:38 - 2013-11-04 18:56 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\DVDVideoSoft
2013-11-04 18:57 - 2013-11-04 18:57 - 00001073 _____ C:\Users\Celeste\Desktop\Free M4a to MP3 Converter.lnk
2013-11-04 18:57 - 2013-11-04 18:57 - 00000000 ____D C:\Program Files\Free M4a to MP3 Converter
2013-11-04 18:57 - 2013-11-04 18:56 - 00000000 ____D C:\Users\Celeste\Documents\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00001150 _____ C:\Users\Celeste\Desktop\Free Audio Dub.lnk
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-11-04 18:53 - 2013-11-04 18:53 - 16877344 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Celeste\Downloads\FreeAudioDub1.7.9.908 (1).exe
2013-11-04 18:51 - 2013-11-04 18:51 - 05834488 _____ (ManiacTools.com                                             ) C:\Users\Celeste\Downloads\m4a-to80-mp3-converter.exe
2013-11-04 10:00 - 2013-02-14 15:46 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-04 09:05 - 2013-11-04 09:05 - 00008158 _____ C:\Users\Celeste\Downloads\MC900334436.WMF
2013-11-04 09:05 - 2013-11-04 09:04 - 00000000 ___HD C:\Windows\AxInstSV
2013-11-01 10:22 - 2010-02-28 21:18 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\TeamViewer
2013-11-01 10:22 - 2010-02-25 20:11 - 00109744 _____ C:\Users\Celeste\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-01 09:52 - 2013-11-01 09:52 - 00001084 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-11-01 09:52 - 2013-11-01 09:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-10-27 10:35 - 2013-10-27 10:34 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-27 10:35 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 10:34 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iPod
2013-10-27 10:34 - 2010-04-10 12:22 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-10-26 09:21 - 2010-04-10 12:22 - 00000000 ____D C:\Users\Celeste\AppData\Local\Apple
2013-10-26 08:37 - 2013-10-22 17:11 - 102329055 _____ C:\Windows\system32\엲啙ངd
2013-10-20 13:24 - 2013-10-20 13:24 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (1).exe
2013-10-18 18:16 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-18 17:12 - 2013-10-18 17:11 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-18 17:12 - 2010-06-20 20:42 - 00000000 ____D C:\Program Files\Java
2013-10-18 16:52 - 2013-08-31 10:05 - 00000000 ____D C:\ProgramData\T-Online
2013-10-15 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-15 17:35 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-15 17:33 - 2010-04-28 08:21 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-14 22:44 - 2010-02-25 20:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-14 22:42 - 2013-07-23 21:16 - 00000000 ____D C:\Windows\system32\MRT
2013-10-14 22:39 - 2010-02-26 20:47 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-14 19:15 - 2012-04-10 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-14 19:15 - 2011-06-11 09:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-14 18:14 - 2013-10-14 18:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job
2013-10-14 18:14 - 2013-10-14 18:14 - 00000000 ____D C:\Program Files\GUMFA36.tmp
2013-10-14 18:14 - 2009-07-14 05:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 19:14 - 2013-11-06 07:11 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-10-08 06:50 - 2013-10-18 17:12 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 06:46 - 2013-10-18 17:13 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 06:46 - 2013-10-18 17:12 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 06:46 - 2013-10-18 17:12 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe

Files to move or delete:
====================
C:\Users\Celeste\N360v3DE.exe
C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job


Some content of TEMP:
====================
C:\Users\Celeste\AppData\Local\Temp\avgnt.exe
C:\Users\Celeste\AppData\Local\Temp\Installer.exe
C:\Users\Celeste\AppData\Local\Temp\ose00000.exe
C:\Users\Celeste\AppData\Local\Temp\Quarantine.exe
C:\Users\Celeste\AppData\Local\Temp\Tsu7D4A1B33.dll
C:\Users\Celeste\AppData\Local\Temp\_is15B3.exe
C:\Users\Celeste\AppData\Local\Temp\_is314E.exe
C:\Users\Celeste\AppData\Local\Temp\_isFA64.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 12:31

==================== End Of Log ============================
         
--- --- ---

--- --- ---


Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Doro at 2013-11-06 15:59:43
Running from C:\Users\Doro\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 7.1.8)
4660_4680_Help (Version: 1.00.0000)
AAVUpdateManager (Version: 18.00.0000)
Acer Crystal Eye Webcam (Version: 5.2.7.1)
AdblockIE (Version: 1.2)
Adobe AIR (Version: 3.7.0.2090)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133)
Amazon MP3-Downloader 1.0.15 (Version: 1.0.15)
Apple Application Support (Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (Version: 2.1.3.127)
Avira Free Antivirus (Version: 14.0.0.411)
Avira SearchFree Toolbar (Version: 12.6.0.1898)
Bonjour (Version: 3.0.0.10)
bpd_scan (Version: 3.00.0000)
BPDSoftware (Version: 140.0.000.000)
BPDSoftware_Ini (Version: 1.00.0000)
BufferChm (Version: 140.0.213.000)
DataSync Outlook (Version: 7.00.2906)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 140.0.213.000)
DocMgr (Version: 140.0.65.000)
DocProc (Version: 140.0.100.000)
Dropbox (HKCU Version: 2.4.6)
DVD Suite (Version: 5.0.1319)
Fax (Version: 140.0.213.000)
Free Audio Dub version 1.7.9.908 (Version: 1.7.9.908)
Free M4a to MP3 Converter 8.0
Free Mp3 Wma Converter V 2.2 (Version: 2.2.0.0)
GIMP 2.6.11 (Version: 2.6.11)
Google Chrome (HKCU Version: 30.0.1599.101)
Google Update Helper (Version: 1.3.21.165)
GPBaseService2 (Version: 140.0.212.000)
Haufe iDesk-Browser (Version: 9.06.30.7144)
Haufe iDesk-Service (Version: 7.09.07.4355)
Haufe iDesk-Service (Version: 8.08.20.5622)
Haufe iDesk-Service (Version: 9.08.21.7460)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Document Manager 2.0 (Version: 2.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP OfficeJet J4600 All-In-One Series (Version: 14.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (Version: 5.002.006.003)
HPDiagnosticAlert (Version: 1.00.0000)
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000)
HPPhotosmartEssential (Version: 2.04.0000)
HPProductAssistant (Version: 140.0.213.000)
HPSSupply (Version: 140.0.212.000)
iCloud (Version: 3.0.2.163)
Internet-TV für Windows Media Center (Version: 4.2.2.0)
iTunes (Version: 11.1.2.32)
J4680 (Version: 140.0.000.000)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
JMicron Flash Media Controller Driver (Version: 1.00.29.02)
Launch Manager (Version: 3.0.03)
Lexware Info Service (Version: 2.61.00.0033)
LightScribe System Software  1.10.27.1 (Version: 1.10.27.1)
Lyrics Plugin for Windows Media Player (Version: 0.4)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
MarketResearch (Version: 140.0.214.000)
maxdome - Online Videothek Version 3.1.0
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mp3tag v2.54 (Version: v2.54)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
neroxml (Version: 1.0.0)
Network (Version: 140.0.215.000)
NVIDIA Display Control Panel (Version: 1.6)
NVIDIA Drivers (Version: 1.7)
NVIDIA PhysX (Version: 9.10.0129)
OCR Software by I.R.I.S. 14.0 (Version: 14.0)
PDF Split And Merge Basic (Version: 2.2.2)
PDF24 Creator 6.0.1
PDFCreator (Version: 1.7.1)
PowerDVD (Version: 7.0.3409.a)
ProductContext (Version: 140.0.000.000)
QuickTime (Version: 7.74.80.86)
RealPlayer
Realtek High Definition Audio Driver (Version: 6.0.1.5928)
RealUpgrade 1.0 (Version: 1.0.0)
RedMon - Redirection Port Monitor
Scan (Version: 140.0.167.000)
Servicepack Datumsaktualisierung (Version: 1.00.00.0005)
Shop for HP Supplies (Version: 14.0)
Skype™ 5.10 (Version: 5.10.116)
SmartWebPrinting (Version: 140.0.213.000)
SolutionCenter (Version: 140.0.214.000)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Status (Version: 140.0.256.000)
Steuer 2006 (Version: 13.00)
Steuer 2007 (Version: 14.00)
Steuer 2008 (Version: 15.00.00.0033)
Steuer 2009 (Version: 16.12.00.0001)
Steuer Hilfesammlung (Version: 13.0.0.0)
Steuer Hilfesammlung (Version: 14.0.0.0)
Steuer Hilfesammlung (Version: 15.0.0.0)
Steuer Update 13.03 (Version: 13.03)
Steuer Update 14.01 (Version: 14.01)
Steuer Update 15.09 (Version: 15.09)
Steuer-Hilfesammlung 2009 (Version: 16.0.1.0)
Steuer-Spar-Erklärung 2009 (Version: 14.08.0000)
Steuer-Spar-Erklärung 2010 (Version: 15.15)
Steuer-Spar-Erklärung 2011 (Version: 16.16)
Steuer-Spar-Erklärung 2012 (Version: 17.11)
Steuer-Spar-Erklärung 2013 (Version: 18.08)
swMSM (Version: 12.0.0.1)
System Requirements Lab
TeamViewer 8 (Version: 8.0.22298)
Toolbox (Version: 140.0.428.000)
TrayApp (Version: 140.0.213.000)
TuneWiki (Version: 1.0.0.209)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
WebReg (Version: 140.0.213.017)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Media Center Add-in for Silverlight (Version: 4.7.3.0)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Mobile Device Center Driver Update (Version: 6.1.6965.0)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
Yahoo! Detect

==================== Restore Points  =========================

18-10-2013 15:19:36 Windows Update
18-10-2013 15:52:10 Entfernt Telekom Kinderschutz Software
18-10-2013 16:11:06 Installed Java 7 Update 45
22-10-2013 16:10:33 Windows Update
26-10-2013 07:48:48 Windows Update
30-10-2013 16:56:05 Windows Update
05-11-2013 06:02:53 Windows Update
05-11-2013 06:22:36 Removed Media Go
05-11-2013 06:23:30 Removed Media Go Video Playback Engine 1.84.106.07010
05-11-2013 06:37:37 Installed AdblockIE
06-11-2013 06:24:19 Configured GoGear Mix Device Manager
06-11-2013 06:24:57 Removed GoGear Mix Device Manager
06-11-2013 06:26:10 Removed HP Product Detection

==================== Hosts content: ==========================

2009-07-14 03:04 - 2011-03-13 13:44 - 00001023 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 im.adtech.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adtech.de
127.0.0.1 atwola.com
127.0.0.1 adserver.71i.de
127.0.0.1 adicqserver.71i.de
127.0.0.1 71i.de
127.0.0.1 ar.atwola.com


==================== Scheduled Tasks (whitelisted) =============

Task: {135995B5-D214-452F-BAB4-7109FBAFADDB} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2208508394-1456433274-1180839891-1000 => C:\Program Files\Real\RealUpgrade\realupgrade.exe [2010-02-09] (RealNetworks, Inc.)
Task: {4423113D-0813-4F84-8EEC-3856573D9678} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2208508394-1456433274-1180839891-1000 => C:\Program Files\Real\RealUpgrade\realupgrade.exe [2010-02-09] (RealNetworks, Inc.)
Task: {664C2989-6545-44B0-ADD4-52B5534A9270} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {690AB68C-ED8F-44B1-8CCD-4655349F5904} - System32\Tasks\{39AB1BD2-1FDD-43A3-8E25-FB84B3190D26} => C:\Program Files\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {77B29C52-0E3A-4C34-8C2D-B1A7BF32C6B5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-14] (Adobe Systems Incorporated)
Task: {7F2979F5-5E94-4906-AB73-5897663EB552} - System32\Tasks\{E3EB61C6-9451-4DB5-AC9A-3FA523A98F81} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {9D9E813C-5103-4D9B-9C94-DBB888C35C99} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-22] (Google Inc.)
Task: {B289AF8F-8F60-4C0B-8925-730C1E3616DB} - System32\Tasks\{83A2A084-2023-4E63-BCAD-52982AF358B7} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {B5E84638-8098-4D7D-B178-5AD76695226E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {BE4E90BD-B82D-473F-A68E-923A3D01BED9} - System32\Tasks\{69DA8336-931F-49CA-A96A-7906419B4B6B} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {BF0B8A3F-526E-4D13-9680-7517B9D696F9} - System32\Tasks\{D0FD00A5-B532-4ABA-B654-20044CE6C04A} => C:\Users\Celeste\AppData\Local\Temp\7zS38EF\OJJ4600_Scrubber_13\scrub2k.exe
Task: {CDC10BA1-E233-4134-893D-6E5C086CAD76} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-22] (Google Inc.)
Task: {DFF713E0-01C5-43F2-8498-14440360A55B} - System32\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe
Task: {E57B80B3-0C0B-4504-93EC-58337A372002} - System32\Tasks\{4B34404D-A4EB-40E1-B6B8-94BE589DF63E} => C:\Users\Celeste\AppData\Local\Temp\7zS38EF\OJJ4600_Scrubber_13\scrub2k.exe
Task: {F7B23BA0-A528-410E-A0B2-108961FFEB03} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core.job => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA.job => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe

==================== Loaded Modules (whitelisted) =============

2013-08-23 20:01 - 2013-08-23 20:01 - 25100288 _____ () C:\Users\Celeste\AppData\Roaming\Dropbox\bin\libcef.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/06/2013 03:57:26 PM) (Source: Application Hang) (User: )
Description: Programm FRST.exe, Version 3.3.8.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: dd4

Startzeit: 01cedb006aff4bbc

Endzeit: 0

Anwendungspfad: C:\Users\Celeste\Desktop\FRST.exe

Berichts-ID:

Error: (11/06/2013 00:53:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0
Name des fehlerhaften Moduls: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00012288
ID des fehlerhaften Prozesses: 0x1594
Startzeit der fehlerhaften Anwendung: 0xgmer_2.1.19163.exe0
Pfad der fehlerhaften Anwendung: gmer_2.1.19163.exe1
Pfad des fehlerhaften Moduls: gmer_2.1.19163.exe2
Berichtskennung: gmer_2.1.19163.exe3


System errors:
=============
Error: (11/06/2013 03:53:52 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/06/2013 03:52:50 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Eumex 5000PC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058

Error: (11/06/2013 00:35:41 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/06/2013 00:34:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Eumex 5000PC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058


Microsoft Office Sessions:
=========================
Error: (07/02/2013 10:06:40 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 929 seconds with 840 seconds of active time.  This session ended with a crash.

Error: (07/02/2013 09:49:32 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3907 seconds with 3420 seconds of active time.  This session ended with a crash.

Error: (05/21/2013 05:14:17 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9603 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:58:25 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 274 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:53:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 150 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:51:05 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16447 seconds with 1080 seconds of active time.  This session ended with a crash.

Error: (02/14/2013 01:50:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3911 seconds with 480 seconds of active time.  This session ended with a crash.

Error: (01/05/2013 09:25:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 462158 seconds with 540 seconds of active time.  This session ended with a crash.

Error: (01/08/2012 04:09:32 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 94663 seconds with 16380 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-10-15 22:46:05.259
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-10-01 22:39:22.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-16 22:33:11.237
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-16 21:41:51.056
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-11 07:29:25.960
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-11 07:15:03.923
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-10 07:31:59.583
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-10 07:10:40.360
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-09 17:19:31.102
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-09 16:43:29.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 34%
Total physical RAM: 3066.87 MB
Available physical RAM: 2017.85 MB
Total Pagefile: 6132.02 MB
Available Pagefile: 4886.81 MB
Total Virtual: 2047.88 MB
Available Virtual: 1924.61 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:93.24 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 66F2CA13)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Der Zustand ist leider immer noch unverändert
__________________

Alt 07.11.2013, 09:15   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Den entsprehcenden Browser deinstallierne, keine Daten behalten, neu installieren.



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 08.11.2013, 07:43   #5
Celeste
 
Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Hallo,

die Suche via Certifed-Toolbar Search hat nun ein Ende.

Aber wenn ich nun meine Suche direkt in der Adresszeile des Internet Explorer Browsers beginne erscheint "bing" anstelle von Google.

Wie kann ich es auf Google ändern?

Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f1bc158bd3a4f84ca91845caf75c66fa
# engine=15799
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-11-07 10:37:46
# local_time=2013-11-07 11:37:46 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 95 16334 2435024 12722 0
# compatibility_mode=5893 16776574 100 94 225423 135495057 0 0
# scanned=234837
# found=2
# cleaned=0
# scan_time=7941
sh=A3534356BA388AEC0F9C15EC0236D36E950833EF ft=1 fh=621402ad54c98504 vn="multiple threats" ac=I fn="C:\Users\Celeste\AppData\Local\Temp\{4EFBF353-F49E-4E73-B602-3FED79A818E9}\setup.exe"
sh=CC18B9ACEEBDAA6B9C420BAD230C418075160976 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Celeste\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\28\3f2d705c-5c31f561"
         
Code:
ATTFilter
 Results of screen317's Security Check version 0.99.74  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 Java 7 Update 45  
 Java version out of Date! 
 Adobe Flash Player 	11.9.900.117  
 Adobe Reader XI  
 Google Chrome 29.0.1547.76  
 Google Chrome 30.0.1599.101  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-10-2013
Ran by Celeste (administrator) on Celeste-PC on 08-11-2013 07:29:54
Running from C:\Users\Celeste\Desktop
Microsoft Windows 7 Professional  Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
() C:\Program Files\CyberLink\Shared Files\RichVideo.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_9_900_117_ActiveX.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7731744 2009-08-31] (Realtek Semiconductor)
HKLM\...\Run: [PLFSetI] - C:\Windows\PLFSetI.exe [200704 2008-07-29] ()
HKLM\...\Run: [NvCplDaemon] - RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [LManager] - C:\Program Files\Launch Manager\LManager.exe [1190920 2010-02-25] (Dritek System Inc.)
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [] - [x]
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-10] (Avira Operations GmbH & Co. KG)
MountPoints2: {18b0acbe-e47c-11e0-bf76-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236ee4-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236ef8-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236f21-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {90236f33-d30c-11e0-ba79-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {b64978db-e1fb-11e0-bec1-00238b494f5d} - F:\AutoRun.exe
MountPoints2: {ccab6764-f22a-11e0-b2aa-00238b494f5d} - F:\AutoRun.exe
Startup: C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Celeste\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
Startup: C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC4D31C4F4BB6CA01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:newtab
SearchScopes: HKLM - DefaultScope value is missing.
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: af0.Adblock.BHO - {90EFF544-3981-4d46-85C9-C0361D0931D6} - C:\Windows\System32\mscoree.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU - No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: haufereader - No CLSID Value - 
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1

Chrome: 
=======
CHR HomePage: hxxp://feed.snapdo.com/?publisher=Somoto&dpid=Somoto&co=DE&userid=db2b82a3-a4e1-0ccc-7634-87e14194ce13&searchtype=hp&installDate=04/11/2013
CHR RestoreOnStartup:         "urls_to_restore_on_startup": [
CHR DefaultSearchURL: (Web) - hxxp://feed.snapdo.com/?publisher=Somoto&dpid=Somoto&co=DE&userid=db2b82a3-a4e1-0ccc-7634-87e14194ce13&searchtype=ds&q={searchTerms}&installDate=04/11/2013
CHR DefaultSuggestURL: (Web) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\Celeste\AppData\Local\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File
CHR Extension: (Google Wallet) - C:\Users\Celeste\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0

========================== Services (Whitelisted) =================

S4 AAV UpdateService; C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [1164360 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files\AskPartnerNetwork\Toolbar\apnmcp.exe [166352 2013-10-23] (APN LLC.)
R2 RichVideo; C:\Program Files\CyberLink\Shared Files\RichVideo.exe [272024 2007-05-14] ()
S3 SXDS10; C:\Program Files\Common Files\soft Xpansion\sxds10.exe [234096 2013-07-16] (soft Xpansion)
S3 NMIndexingService; "C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe" [x]

==================== Drivers (Whitelisted) ====================

S2 agfucapi; C:\Windows\System32\DRIVERS\AGFUCAPI.SYS [202336 2000-08-09] (AGFEO GmbH & Co. KG)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-10] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [67680 2013-10-10] (Avira Operations GmbH & Co. KG)
S3 s0017bus; C:\Windows\System32\DRIVERS\s0017bus.sys [86824 2008-10-21] (MCCI Corporation)
S3 s0017mdfl; C:\Windows\System32\DRIVERS\s0017mdfl.sys [15016 2008-10-21] (MCCI Corporation)
S3 s0017mdm; C:\Windows\System32\DRIVERS\s0017mdm.sys [114600 2008-10-21] (MCCI Corporation)
S3 s0017mgmt; C:\Windows\System32\DRIVERS\s0017mgmt.sys [108328 2008-10-21] (MCCI Corporation)
S3 s0017nd5; C:\Windows\System32\DRIVERS\s0017nd5.sys [26024 2008-10-21] (MCCI Corporation)
S3 s0017obex; C:\Windows\System32\DRIVERS\s0017obex.sys [104616 2008-10-21] (MCCI Corporation)
S3 s0017unic; C:\Windows\System32\DRIVERS\s0017unic.sys [109736 2008-10-21] (MCCI Corporation)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2010-10-02] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-10-10] (Avira GmbH)
R1 StarPortLite; C:\Windows\System32\DRIVERS\StarPortLite.sys [95592 2009-03-02] (Rocket Division Software)
R1 SymIM; C:\Windows\System32\DRIVERS\SymIMv.sys [35960 2011-03-31] (Symantec Corporation)
S3 USB28xxBGA; C:\Windows\System32\DRIVERS\emBDA.sys [217088 2006-02-06] (eMPIA Technology, Inc.)
S3 USB28xxOEM; C:\Windows\System32\DRIVERS\emOEM.sys [17792 2006-02-06] (eMPIA Technology, Inc.)
R3 winbondcir; C:\Windows\System32\DRIVERS\winbondcir.sys [43008 2007-03-28] (Winbond Electronics Corporation)
S1 DritekPortIO; \??\C:\Program Files\Launch Manager\DPortIO.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [x]
S3 huawei_cdcacm; system32\DRIVERS\ew_jucdcacm.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 huawei_ext_ctrl; system32\DRIVERS\ew_juextctrl.sys [x]
S3 huawei_wwanecm; system32\DRIVERS\ew_juwwanecm.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-11-08 07:28 - 2013-11-08 07:28 - 00000903 _____ C:\Users\Celeste\Desktop\checkup.txt
2013-11-07 21:20 - 2013-11-07 21:20 - 02347384 _____ (ESET) C:\Users\Celeste\Downloads\esetsmartinstaller_enu.exe
2013-11-07 20:18 - 2011-04-08 21:49 - 00001413 _____ C:\Users\Celeste\Desktop\Internet Explorer.lnk
2013-11-06 20:56 - 2013-11-06 20:56 - 00000000 ____D C:\Users\Celeste\Microsoft Office Setup_Dan Choate
2013-11-06 12:32 - 2013-11-06 12:32 - 00050477 _____ C:\Users\Celeste\Desktop\Defogger.exe
2013-11-06 12:28 - 2013-11-06 12:33 - 00000020 _____ C:\Users\Celeste\defogger_reenable
2013-11-06 12:25 - 2013-11-06 12:25 - 00377856 _____ C:\Users\Celeste\Desktop\gmer_2.1.19163.exe
2013-11-06 12:13 - 2013-11-06 12:13 - 00000000 ____D C:\FRST
2013-11-06 12:08 - 2013-11-06 12:08 - 01089445 _____ (Farbar) C:\Users\Celeste\Desktop\FRST.exe
2013-11-06 11:45 - 2013-11-06 21:02 - 00000280 _____ C:\Windows\setupact.log
2013-11-06 11:45 - 2013-11-06 11:45 - 00000000 _____ C:\Windows\setuperr.log
2013-11-06 08:41 - 2013-11-06 08:41 - 00891167 _____ C:\Users\Celeste\Desktop\SecurityCheck.exe
2013-11-06 08:34 - 2013-11-06 08:34 - 02347384 _____ (ESET) C:\Users\Celeste\Desktop\esetsmartinstaller_enu.exe
2013-11-06 08:26 - 2013-11-06 08:26 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:25 - 2013-11-06 08:25 - 01034531 _____ (Thisisu) C:\Users\Celeste\Desktop\JRT.exe
2013-11-06 08:11 - 2013-11-06 15:51 - 00000000 ____D C:\AdwCleaner
2013-11-06 08:10 - 2013-11-06 08:10 - 01073262 _____ C:\Users\Celeste\Desktop\adwcleaner.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Celeste\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-06 07:39 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-06 07:21 - 2013-11-06 07:21 - 00000000 ____D C:\Users\Celeste\AppData\Local\AskPartnerNetwork
2013-11-06 07:16 - 2013-11-06 07:16 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Avira
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-06 07:11 - 2013-11-06 07:11 - 00000000 ____D C:\Program Files\Avira
2013-11-06 07:11 - 2013-10-10 19:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-11-06 07:11 - 2013-10-10 19:14 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2013-11-06 07:08 - 2013-11-06 07:09 - 123853152 _____ C:\Users\Celeste\Downloads\avira_free_antivirus_de (2).exe
2013-11-05 14:46 - 2013-11-05 14:46 - 00004149 _____ C:\Users\Celeste\.recently-used.xbel
2013-11-05 13:11 - 2013-11-06 20:06 - 00000000 ____D C:\Users\Celeste\Desktop\New PDF
2013-11-05 08:43 - 2013-11-05 08:44 - 00000000 ____D C:\Users\Kinder
2013-11-05 08:43 - 2013-11-05 08:43 - 00001385 _____ C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 08:43 - 2013-11-05 08:43 - 00000020 ___SH C:\Users\Kinder\ntuser.ini
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Startmenü
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Netzwerkumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Druckumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Musik
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Bilder
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Local\Verlauf
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Adobe
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Local\VirtualStore
2013-11-05 08:43 - 2010-11-09 09:55 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Macromedia
2013-11-05 08:43 - 2010-06-08 22:54 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-11-05 08:43 - 2010-06-08 22:54 - 00000000 ___RD C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-11-05 08:43 - 2010-02-26 23:09 - 00000000 ____D C:\Users\Kinder\AppData\Local\Microsoft Help
2013-11-05 07:42 - 2013-11-05 07:42 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (2).exe
2013-11-05 07:37 - 2013-11-05 07:37 - 02378752 _____ C:\Users\Celeste\Downloads\Adblock_Installer.msi
2013-11-05 07:37 - 2013-11-05 07:37 - 00000000 ____D C:\Program Files\af0.net
2013-11-04 23:52 - 2013-11-04 23:52 - 00000000 ____D C:\Users\Celeste\AppData\Local\PDF24
2013-11-04 23:51 - 2013-11-04 23:51 - 00000000 ____D C:\Program Files\PDF24
2013-11-04 23:50 - 2013-11-04 23:50 - 16198832 _____ (Geek Software GmbH                                          ) C:\Users\Celeste\Downloads\pdf24-creator-6.0.1.exe
2013-11-04 18:57 - 2013-11-06 10:32 - 00000000 ____D C:\Users\Celeste\Desktop\Meisterchorsingen Bopard
2013-11-04 18:57 - 2013-11-04 18:57 - 00001073 _____ C:\Users\Celeste\Desktop\Free M4a to MP3 Converter.lnk
2013-11-04 18:57 - 2013-11-04 18:57 - 00000000 ____D C:\Program Files\Free M4a to MP3 Converter
2013-11-04 18:56 - 2013-11-04 23:38 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:57 - 00000000 ____D C:\Users\Celeste\Documents\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00001150 _____ C:\Users\Celeste\Desktop\Free Audio Dub.lnk
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-11-04 18:53 - 2013-11-04 18:53 - 16877344 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Celeste\Downloads\FreeAudioDub1.7.9.908 (1).exe
2013-11-04 18:51 - 2013-11-04 18:51 - 05834488 _____ (ManiacTools.com                                             ) C:\Users\Celeste\Downloads\m4a-to80-mp3-converter.exe
2013-11-04 09:05 - 2013-11-04 09:05 - 00008158 _____ C:\Users\Celeste\Downloads\MC900334436.WMF
2013-11-04 09:04 - 2013-11-04 09:05 - 00000000 ___HD C:\Windows\AxInstSV
2013-11-01 11:41 - 2013-11-06 06:50 - 00000000 ____D C:\Users\Celeste\Sonets
2013-11-01 09:52 - 2013-11-01 09:52 - 00001084 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-11-01 09:51 - 2013-11-01 09:52 - 00000000 ____D C:\Program Files\TeamViewer
2013-10-27 10:34 - 2013-10-27 10:35 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-27 10:34 - 2013-10-27 10:35 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 10:34 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iPod
2013-10-22 17:11 - 2013-10-26 08:37 - 102329055 _____ C:\Windows\system32\엲啙ངd
2013-10-21 18:30 - 2013-09-04 02:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-21 18:30 - 2013-09-04 02:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-20 13:24 - 2013-10-20 13:24 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (1).exe
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-18 17:13 - 2013-10-08 06:46 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-18 17:12 - 2013-10-08 06:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-18 17:12 - 2013-10-08 06:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-18 17:12 - 2013-10-08 06:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-18 17:11 - 2013-10-18 17:12 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-14 22:36 - 2013-09-23 00:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-14 22:36 - 2013-09-23 00:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-14 22:36 - 2013-09-23 00:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-14 22:36 - 2013-09-23 00:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-14 22:36 - 2013-09-23 00:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-14 22:36 - 2013-09-21 04:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-14 22:36 - 2013-09-21 03:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-14 18:34 - 2013-09-14 01:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-14 18:34 - 2013-09-08 03:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-14 18:34 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-14 18:34 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-14 18:34 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-14 18:34 - 2013-08-29 02:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-14 18:34 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-14 18:34 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-14 18:34 - 2013-08-28 02:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-14 18:34 - 2013-08-28 01:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-14 18:34 - 2013-08-01 12:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-14 18:34 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-14 18:34 - 2013-07-12 11:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-14 18:34 - 2013-07-12 11:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-14 18:34 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-14 18:34 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-14 18:34 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-14 18:34 - 2013-07-04 10:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-14 18:34 - 2013-07-03 05:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-14 18:34 - 2013-07-03 04:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-14 18:34 - 2013-07-03 04:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-14 18:34 - 2013-06-06 05:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-14 18:34 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-14 18:34 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-14 18:34 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-14 18:34 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-14 18:33 - 2013-06-25 23:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-14 18:14 - 2013-10-14 18:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job
2013-10-14 18:14 - 2013-10-14 18:14 - 00000000 ____D C:\Program Files\GUMFA36.tmp

==================== One Month Modified Files and Folders =======

2013-11-08 07:28 - 2013-11-08 07:28 - 00000903 _____ C:\Users\Celeste\Desktop\checkup.txt
2013-11-08 07:15 - 2012-08-26 10:56 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-08 07:15 - 2011-05-22 19:48 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA.job
2013-11-08 06:48 - 2012-08-26 10:56 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-08 04:13 - 2010-02-25 19:41 - 01150917 _____ C:\Windows\WindowsUpdate.log
2013-11-07 21:29 - 2013-02-14 15:48 - 00000000 ___RD C:\Users\Celeste\Dropbox
2013-11-07 21:21 - 2013-02-14 15:45 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Dropbox
2013-11-07 21:20 - 2013-11-07 21:20 - 02347384 _____ (ESET) C:\Users\Celeste\Downloads\esetsmartinstaller_enu.exe
2013-11-07 20:11 - 2013-02-08 15:15 - 00000000 ____D C:\Users\Celeste\AppData\Local\1F198B4F-E6AD-4E83-8101-788D3C314901.aplzod
2013-11-07 19:12 - 2011-05-22 19:48 - 00001064 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core.job
2013-11-07 07:19 - 2009-07-14 05:34 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-07 07:19 - 2009-07-14 05:34 - 00013248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-07 07:13 - 2010-02-25 19:46 - 00000000 ____D C:\Users\Celeste
2013-11-06 21:06 - 2010-02-25 19:48 - 01507342 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-06 21:02 - 2013-11-06 11:45 - 00000280 _____ C:\Windows\setupact.log
2013-11-06 21:02 - 2013-01-19 11:49 - 00000386 ____H C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job
2013-11-06 21:02 - 2009-07-14 05:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-06 20:56 - 2013-11-06 20:56 - 00000000 ____D C:\Users\Celeste\Microsoft Office Setup_Dan Choate
2013-11-06 20:06 - 2013-11-05 13:11 - 00000000 ____D C:\Users\Celeste\Desktop\New PDF
2013-11-06 19:01 - 2010-02-28 21:18 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\TeamViewer
2013-11-06 15:51 - 2013-11-06 08:11 - 00000000 ____D C:\AdwCleaner
2013-11-06 12:59 - 2010-06-19 10:29 - 00000000 ____D C:\Users\Celeste\AppData\Local\CrashDumps
2013-11-06 12:33 - 2013-11-06 12:28 - 00000020 _____ C:\Users\Celeste\defogger_reenable
2013-11-06 12:32 - 2013-11-06 12:32 - 00050477 _____ C:\Users\Celeste\Desktop\Defogger.exe
2013-11-06 12:25 - 2013-11-06 12:25 - 00377856 _____ C:\Users\Celeste\Desktop\gmer_2.1.19163.exe
2013-11-06 12:13 - 2013-11-06 12:13 - 00000000 ____D C:\FRST
2013-11-06 12:08 - 2013-11-06 12:08 - 01089445 _____ (Farbar) C:\Users\Celeste\Desktop\FRST.exe
2013-11-06 11:45 - 2013-11-06 11:45 - 00000000 _____ C:\Windows\setuperr.log
2013-11-06 11:45 - 2010-02-25 20:04 - 00925588 _____ C:\Windows\PFRO.log
2013-11-06 11:36 - 2012-09-29 08:44 - 00000000 ____D C:\Windows\Minidump
2013-11-06 10:32 - 2013-11-04 18:57 - 00000000 ____D C:\Users\Celeste\Desktop\Meisterchorsingen Bopard
2013-11-06 08:41 - 2013-11-06 08:41 - 00891167 _____ C:\Users\Celeste\Desktop\SecurityCheck.exe
2013-11-06 08:34 - 2013-11-06 08:34 - 02347384 _____ (ESET) C:\Users\Celeste\Desktop\esetsmartinstaller_enu.exe
2013-11-06 08:26 - 2013-11-06 08:26 - 00000000 ____D C:\Windows\ERUNT
2013-11-06 08:25 - 2013-11-06 08:25 - 01034531 _____ (Thisisu) C:\Users\Celeste\Desktop\JRT.exe
2013-11-06 08:17 - 2012-02-07 10:43 - 00000000 ____D C:\ProgramData\Uniblue
2013-11-06 08:17 - 2010-02-26 20:46 - 00000000 ____D C:\ProgramData\ICQ
2013-11-06 08:10 - 2013-11-06 08:10 - 01073262 _____ C:\Users\Celeste\Desktop\adwcleaner.exe
2013-11-06 08:06 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Vss
2013-11-06 07:39 - 2013-11-06 07:39 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Celeste\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-06 07:39 - 2013-11-06 07:39 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-11-06 07:25 - 2010-02-25 20:29 - 00000000 ___HD C:\Program Files\InstallShield Installation Information
2013-11-06 07:21 - 2013-11-06 07:21 - 00000000 ____D C:\Users\Celeste\AppData\Local\AskPartnerNetwork
2013-11-06 07:16 - 2013-11-06 07:16 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Avira
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\ProgramData\AskPartnerNetwork
2013-11-06 07:15 - 2013-11-06 07:15 - 00000000 ____D C:\Program Files\AskPartnerNetwork
2013-11-06 07:11 - 2013-11-06 07:11 - 00000000 ____D C:\Program Files\Avira
2013-11-06 07:11 - 2011-11-07 18:16 - 00000000 ____D C:\ProgramData\Avira
2013-11-06 07:09 - 2013-11-06 07:08 - 123853152 _____ C:\Users\Celeste\Downloads\avira_free_antivirus_de (2).exe
2013-11-06 06:50 - 2013-11-01 11:41 - 00000000 ____D C:\Users\Celeste\Sonets
2013-11-05 14:46 - 2013-11-05 14:46 - 00004149 _____ C:\Users\Celeste\.recently-used.xbel
2013-11-05 14:46 - 2011-02-20 22:50 - 00000000 ____D C:\Users\Celeste\.gimp-2.6
2013-11-05 08:50 - 2011-04-17 13:54 - 00000000 ____D C:\Windows\pss
2013-11-05 08:44 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder
2013-11-05 08:43 - 2013-11-05 08:43 - 00001385 _____ C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-11-05 08:43 - 2013-11-05 08:43 - 00000020 ___SH C:\Users\Kinder\ntuser.ini
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Startmenü
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Netzwerkumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Druckumgebung
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Musik
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\Documents\Eigene Bilder
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 _SHDL C:\Users\Kinder\AppData\Local\Verlauf
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Roaming\Adobe
2013-11-05 08:43 - 2013-11-05 08:43 - 00000000 ____D C:\Users\Kinder\AppData\Local\VirtualStore
2013-11-05 07:52 - 2009-07-14 05:33 - 00413704 _____ C:\Windows\system32\FNTCACHE.DAT
2013-11-05 07:50 - 2012-08-26 10:56 - 00000000 ____D C:\Program Files\Google
2013-11-05 07:42 - 2013-11-05 07:42 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (2).exe
2013-11-05 07:37 - 2013-11-05 07:37 - 02378752 _____ C:\Users\Celeste\Downloads\Adblock_Installer.msi
2013-11-05 07:37 - 2013-11-05 07:37 - 00000000 ____D C:\Program Files\af0.net
2013-11-05 07:24 - 2010-10-27 17:01 - 00000000 ____D C:\Program Files\Common Files\Sony Shared
2013-11-05 07:21 - 2011-01-30 00:13 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-11-05 07:21 - 2010-02-26 20:46 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Mozilla
2013-11-05 07:18 - 2013-01-19 10:13 - 00000000 ____D C:\ProgramData\InstallMate
2013-11-05 07:14 - 2011-05-22 19:47 - 00000000 ____D C:\Users\Celeste\AppData\Local\Google
2013-11-04 23:52 - 2013-11-04 23:52 - 00000000 ____D C:\Users\Celeste\AppData\Local\PDF24
2013-11-04 23:51 - 2013-11-04 23:51 - 00000000 ____D C:\Program Files\PDF24
2013-11-04 23:50 - 2013-11-04 23:50 - 16198832 _____ (Geek Software GmbH                                          ) C:\Users\Celeste\Downloads\pdf24-creator-6.0.1.exe
2013-11-04 23:50 - 2013-08-13 11:18 - 17810632 _____ (pdfforge GmbH) C:\Users\Celeste\Downloads\PDFCreator-1_7_1_setup.exe
2013-11-04 23:38 - 2013-11-04 18:56 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\DVDVideoSoft
2013-11-04 18:57 - 2013-11-04 18:57 - 00001073 _____ C:\Users\Celeste\Desktop\Free M4a to MP3 Converter.lnk
2013-11-04 18:57 - 2013-11-04 18:57 - 00000000 ____D C:\Program Files\Free M4a to MP3 Converter
2013-11-04 18:57 - 2013-11-04 18:56 - 00000000 ____D C:\Users\Celeste\Documents\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00001150 _____ C:\Users\Celeste\Desktop\Free Audio Dub.lnk
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\DVDVideoSoft
2013-11-04 18:56 - 2013-11-04 18:56 - 00000000 ____D C:\Program Files\Common Files\DVDVideoSoft
2013-11-04 18:53 - 2013-11-04 18:53 - 16877344 _____ (DVDVideoSoft Ltd.                                           ) C:\Users\Celeste\Downloads\FreeAudioDub1.7.9.908 (1).exe
2013-11-04 18:51 - 2013-11-04 18:51 - 05834488 _____ (ManiacTools.com                                             ) C:\Users\Celeste\Downloads\m4a-to80-mp3-converter.exe
2013-11-04 10:00 - 2013-02-14 15:46 - 00000000 ____D C:\Users\Celeste\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2013-11-04 09:05 - 2013-11-04 09:05 - 00008158 _____ C:\Users\Celeste\Downloads\MC900334436.WMF
2013-11-04 09:05 - 2013-11-04 09:04 - 00000000 ___HD C:\Windows\AxInstSV
2013-11-01 10:22 - 2010-02-25 20:11 - 00109744 _____ C:\Users\Celeste\AppData\Local\GDIPFONTCACHEV1.DAT
2013-11-01 09:52 - 2013-11-01 09:52 - 00001084 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-11-01 09:52 - 2013-11-01 09:51 - 00000000 ____D C:\Program Files\TeamViewer
2013-10-27 10:35 - 2013-10-27 10:34 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-10-27 10:35 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iTunes
2013-10-27 10:34 - 2013-10-27 10:34 - 00000000 ____D C:\Program Files\iPod
2013-10-27 10:34 - 2010-04-10 12:22 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-10-26 09:21 - 2010-04-10 12:22 - 00000000 ____D C:\Users\Celeste\AppData\Local\Apple
2013-10-26 08:37 - 2013-10-22 17:11 - 102329055 _____ C:\Windows\system32\엲啙ངd
2013-10-20 13:24 - 2013-10-20 13:24 - 00237568 _____ (www.CompulsiveCode.com) C:\Users\Celeste\Downloads\JPEGtoPDF37 (1).exe
2013-10-18 18:16 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\ProgramData\Oracle
2013-10-18 17:13 - 2013-10-18 17:13 - 00000000 ____D C:\Program Files\Common Files\Java
2013-10-18 17:12 - 2013-10-18 17:11 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-18 17:12 - 2010-06-20 20:42 - 00000000 ____D C:\Program Files\Java
2013-10-18 16:52 - 2013-08-31 10:05 - 00000000 ____D C:\ProgramData\T-Online
2013-10-15 17:46 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-15 17:35 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-15 17:33 - 2010-04-28 08:21 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-10-14 22:44 - 2010-02-25 20:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-14 22:42 - 2013-07-23 21:16 - 00000000 ____D C:\Windows\system32\MRT
2013-10-14 22:39 - 2010-02-26 20:47 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-14 19:15 - 2012-04-10 21:30 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-10-14 19:15 - 2011-06-11 09:52 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-10-14 18:14 - 2013-10-14 18:14 - 00001094 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job
2013-10-14 18:14 - 2013-10-14 18:14 - 00000000 ____D C:\Program Files\GUMFA36.tmp
2013-10-14 18:14 - 2009-07-14 05:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-10-10 19:14 - 2013-11-06 07:11 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-10 19:14 - 2013-11-06 07:11 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys

Files to move or delete:
====================
C:\Users\Celeste\N360v3DE.exe
C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job


Some content of TEMP:
====================
C:\Users\Celeste\AppData\Local\Temp\avgnt.exe
C:\Users\Celeste\AppData\Local\Temp\Installer.exe
C:\Users\Celeste\AppData\Local\Temp\ose00000.exe
C:\Users\Celeste\AppData\Local\Temp\Quarantine.exe
C:\Users\Celeste\AppData\Local\Temp\Tsu7D4A1B33.dll
C:\Users\Celeste\AppData\Local\Temp\_is15B3.exe
C:\Users\Celeste\AppData\Local\Temp\_is314E.exe
C:\Users\Celeste\AppData\Local\Temp\_isFA64.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-11-01 12:31

==================== End Of Log ============================
         
--- --- ---

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-10-2013
Ran by Celeste at 2013-11-08 07:31:11
Running from C:\Users\Celeste\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 7.1.8)
4660_4680_Help (Version: 1.00.0000)
AAVUpdateManager (Version: 18.00.0000)
Acer Crystal Eye Webcam (Version: 5.2.7.1)
AdblockIE (Version: 1.2)
Adobe AIR (Version: 3.7.0.2090)
Adobe Flash Player 11 ActiveX (Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (Version: 11.9.900.117)
Adobe Reader XI (11.0.05) - Deutsch (Version: 11.0.05)
Adobe Shockwave Player 12.0 (Version: 12.0.3.133)
Amazon MP3-Downloader 1.0.15 (Version: 1.0.15)
Apple Application Support (Version: 2.3.6)
Apple Mobile Device Support (Version: 7.0.0.117)
Apple Software Update (Version: 2.1.3.127)
Avira Free Antivirus (Version: 14.0.0.411)
Avira SearchFree Toolbar (Version: 12.6.0.1898)
Bonjour (Version: 3.0.0.10)
bpd_scan (Version: 3.00.0000)
BPDSoftware (Version: 140.0.000.000)
BPDSoftware_Ini (Version: 1.00.0000)
BufferChm (Version: 140.0.213.000)
DataSync Outlook (Version: 7.00.2906)
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 140.0.213.000)
DocMgr (Version: 140.0.65.000)
DocProc (Version: 140.0.100.000)
Dropbox (HKCU Version: 2.4.6)
DVD Suite (Version: 5.0.1319)
Fax (Version: 140.0.213.000)
Free Audio Dub version 1.7.9.908 (Version: 1.7.9.908)
Free M4a to MP3 Converter 8.0
Free Mp3 Wma Converter V 2.2 (Version: 2.2.0.0)
GIMP 2.6.11 (Version: 2.6.11)
Google Chrome (HKCU Version: 30.0.1599.101)
Google Update Helper (Version: 1.3.21.165)
GPBaseService2 (Version: 140.0.212.000)
Haufe iDesk-Browser (Version: 9.06.30.7144)
Haufe iDesk-Service (Version: 7.09.07.4355)
Haufe iDesk-Service (Version: 8.08.20.5622)
Haufe iDesk-Service (Version: 9.08.21.7460)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Document Manager 2.0 (Version: 2.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP OfficeJet J4600 All-In-One Series (Version: 14.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Solution Center 14.0 (Version: 14.0)
HP Update (Version: 5.002.006.003)
HPDiagnosticAlert (Version: 1.00.0000)
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000)
HPPhotosmartEssential (Version: 2.04.0000)
HPProductAssistant (Version: 140.0.213.000)
HPSSupply (Version: 140.0.212.000)
iCloud (Version: 3.0.2.163)
Internet-TV für Windows Media Center (Version: 4.2.2.0)
iTunes (Version: 11.1.2.32)
J4680 (Version: 140.0.000.000)
Java 7 Update 45 (Version: 7.0.450)
Java Auto Updater (Version: 2.1.9.8)
JMicron Flash Media Controller Driver (Version: 1.00.29.02)
Launch Manager (Version: 3.0.03)
Lexware Info Service (Version: 2.61.00.0033)
LightScribe System Software  1.10.27.1 (Version: 1.10.27.1)
Lyrics Plugin for Windows Media Player (Version: 0.4)
Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300)
MarketResearch (Version: 140.0.214.000)
maxdome - Online Videothek Version 3.1.0
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mp3tag v2.54 (Version: v2.54)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
neroxml (Version: 1.0.0)
Network (Version: 140.0.215.000)
NVIDIA Display Control Panel (Version: 1.6)
NVIDIA Drivers (Version: 1.7)
NVIDIA PhysX (Version: 9.10.0129)
OCR Software by I.R.I.S. 14.0 (Version: 14.0)
PDF Split And Merge Basic (Version: 2.2.2)
PDF24 Creator 6.0.1
PDFCreator (Version: 1.7.1)
PowerDVD (Version: 7.0.3409.a)
ProductContext (Version: 140.0.000.000)
QuickTime (Version: 7.74.80.86)
RealPlayer
Realtek High Definition Audio Driver (Version: 6.0.1.5928)
RealUpgrade 1.0 (Version: 1.0.0)
RedMon - Redirection Port Monitor
Scan (Version: 140.0.167.000)
Servicepack Datumsaktualisierung (Version: 1.00.00.0005)
Shop for HP Supplies (Version: 14.0)
Skype™ 5.10 (Version: 5.10.116)
SmartWebPrinting (Version: 140.0.213.000)
SolutionCenter (Version: 140.0.214.000)
Spotify (HKCU Version: 0.9.1.57.ge7405149)
Status (Version: 140.0.256.000)
Steuer 2006 (Version: 13.00)
Steuer 2007 (Version: 14.00)
Steuer 2008 (Version: 15.00.00.0033)
Steuer 2009 (Version: 16.12.00.0001)
Steuer Hilfesammlung (Version: 13.0.0.0)
Steuer Hilfesammlung (Version: 14.0.0.0)
Steuer Hilfesammlung (Version: 15.0.0.0)
Steuer Update 13.03 (Version: 13.03)
Steuer Update 14.01 (Version: 14.01)
Steuer Update 15.09 (Version: 15.09)
Steuer-Hilfesammlung 2009 (Version: 16.0.1.0)
Steuer-Spar-Erklärung 2009 (Version: 14.08.0000)
Steuer-Spar-Erklärung 2010 (Version: 15.15)
Steuer-Spar-Erklärung 2011 (Version: 16.16)
Steuer-Spar-Erklärung 2012 (Version: 17.11)
Steuer-Spar-Erklärung 2013 (Version: 18.08)
swMSM (Version: 12.0.0.1)
System Requirements Lab
TeamViewer 8 (Version: 8.0.22298)
Toolbox (Version: 140.0.428.000)
TrayApp (Version: 140.0.213.000)
TuneWiki (Version: 1.0.0.209)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
WebReg (Version: 140.0.213.017)
Windows Live ID Sign-in Assistant (Version: 6.500.3165.0)
Windows Media Center Add-in for Silverlight (Version: 4.7.3.0)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows Mobile Device Center Driver Update (Version: 6.1.6965.0)
Windows Mobile-Gerätecenter (Version: 6.1.6965.0)
Yahoo! Detect

==================== Restore Points  =========================

05-11-2013 06:22:36 Removed Media Go
05-11-2013 06:23:30 Removed Media Go Video Playback Engine 1.84.106.07010
05-11-2013 06:37:37 Installed AdblockIE
06-11-2013 06:24:19 Configured GoGear Mix Device Manager
06-11-2013 06:24:57 Removed GoGear Mix Device Manager
06-11-2013 06:26:10 Removed HP Product Detection
07-11-2013 19:12:51 Windows Modules Installer
07-11-2013 19:14:41 Windows Modules Installer

==================== Hosts content: ==========================

2009-07-14 03:04 - 2011-03-13 13:44 - 00001023 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 im.adtech.de
127.0.0.1 adserver.adtech.de
127.0.0.1 adtech.de
127.0.0.1 atwola.com
127.0.0.1 adserver.71i.de
127.0.0.1 adicqserver.71i.de
127.0.0.1 71i.de
127.0.0.1 ar.atwola.com


==================== Scheduled Tasks (whitelisted) =============

Task: {135995B5-D214-452F-BAB4-7109FBAFADDB} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-2208508394-1456433274-1180839891-1000 => C:\Program Files\Real\RealUpgrade\realupgrade.exe [2010-02-09] (RealNetworks, Inc.)
Task: {4423113D-0813-4F84-8EEC-3856573D9678} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-2208508394-1456433274-1180839891-1000 => C:\Program Files\Real\RealUpgrade\realupgrade.exe [2010-02-09] (RealNetworks, Inc.)
Task: {664C2989-6545-44B0-ADD4-52B5534A9270} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation)
Task: {690AB68C-ED8F-44B1-8CCD-4655349F5904} - System32\Tasks\{39AB1BD2-1FDD-43A3-8E25-FB84B3190D26} => C:\Program Files\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {77B29C52-0E3A-4C34-8C2D-B1A7BF32C6B5} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-14] (Adobe Systems Incorporated)
Task: {7F2979F5-5E94-4906-AB73-5897663EB552} - System32\Tasks\{E3EB61C6-9451-4DB5-AC9A-3FA523A98F81} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {9D9E813C-5103-4D9B-9C94-DBB888C35C99} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-22] (Google Inc.)
Task: {B289AF8F-8F60-4C0B-8925-730C1E3616DB} - System32\Tasks\{83A2A084-2023-4E63-BCAD-52982AF358B7} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {B5E84638-8098-4D7D-B178-5AD76695226E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: {BE4E90BD-B82D-473F-A68E-923A3D01BED9} - System32\Tasks\{69DA8336-931F-49CA-A96A-7906419B4B6B} => C:\Windows\Acer Crystal Eye webcam.EXE [2009-07-24] (SuYin)
Task: {BF0B8A3F-526E-4D13-9680-7517B9D696F9} - System32\Tasks\{D0FD00A5-B532-4ABA-B654-20044CE6C04A} => C:\Users\Celeste\AppData\Local\Temp\7zS38EF\OJJ4600_Scrubber_13\scrub2k.exe
Task: {CDC10BA1-E233-4134-893D-6E5C086CAD76} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe [2011-05-22] (Google Inc.)
Task: {DFF713E0-01C5-43F2-8498-14440360A55B} - System32\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9} => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe
Task: {E57B80B3-0C0B-4504-93EC-58337A372002} - System32\Tasks\{4B34404D-A4EB-40E1-B6B8-94BE589DF63E} => C:\Users\Celeste\AppData\Local\Temp\7zS38EF\OJJ4600_Scrubber_13\scrub2k.exe
Task: {F7B23BA0-A528-410E-A0B2-108961FFEB03} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-08-26] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1cec900e77b8553.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000Core.job => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2208508394-1456433274-1180839891-1000UA.job => C:\Users\Celeste\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\{B335A95D-D06E-478D-9BC4-2B67016208C9}.job => C:\ProgramData\BetterSoft\SaveByClick\SaveByClick.exe

==================== Loaded Modules (whitelisted) =============


==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/06/2013 06:45:31 PM) (Source: Application Hang) (User: )
Description: Programm iexplore.exe, Version 10.0.9200.16720 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 8c0

Startzeit: 01cedb16c93d869a

Endzeit: 265

Anwendungspfad: C:\Program Files\Internet Explorer\iexplore.exe

Berichts-ID:

Error: (11/06/2013 03:57:26 PM) (Source: Application Hang) (User: )
Description: Programm FRST.exe, Version 3.3.8.1 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: dd4

Startzeit: 01cedb006aff4bbc

Endzeit: 0

Anwendungspfad: C:\Users\Celeste\Desktop\FRST.exe

Berichts-ID:

Error: (11/06/2013 00:53:20 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0
Name des fehlerhaften Moduls: gmer_2.1.19163.exe, Version: 2.1.19163.0, Zeitstempel: 0x515d31f0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00012288
ID des fehlerhaften Prozesses: 0x1594
Startzeit der fehlerhaften Anwendung: 0xgmer_2.1.19163.exe0
Pfad der fehlerhaften Anwendung: gmer_2.1.19163.exe1
Pfad des fehlerhaften Moduls: gmer_2.1.19163.exe2
Berichtskennung: gmer_2.1.19163.exe3


System errors:
=============
Error: (11/08/2013 04:12:44 AM) (Source: Tcpip) (User: )
Description: Das System hat einen Adressenkonflikt der IP-Adresse 192.168.1.2 mit dem Computer mit der
Netzwerkhardwareadresse 7C-FA-DF-B8-02-BF ermittelt. Netzwerkvorgänge könnten daher auf diesem
System unterbrochen werden.

Error: (11/06/2013 09:03:08 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/06/2013 09:02:04 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Eumex 5000PC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058

Error: (11/06/2013 03:53:52 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/06/2013 03:52:50 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Eumex 5000PC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058

Error: (11/06/2013 00:35:41 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (11/06/2013 00:34:39 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Eumex 5000PC" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1058


Microsoft Office Sessions:
=========================
Error: (07/02/2013 10:06:40 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 929 seconds with 840 seconds of active time.  This session ended with a crash.

Error: (07/02/2013 09:49:32 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3907 seconds with 3420 seconds of active time.  This session ended with a crash.

Error: (05/21/2013 05:14:17 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 9603 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:58:25 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 274 seconds with 180 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:53:44 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 150 seconds with 120 seconds of active time.  This session ended with a crash.

Error: (02/24/2013 10:51:05 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 16447 seconds with 1080 seconds of active time.  This session ended with a crash.

Error: (02/14/2013 01:50:26 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3911 seconds with 480 seconds of active time.  This session ended with a crash.

Error: (01/05/2013 09:25:42 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 462158 seconds with 540 seconds of active time.  This session ended with a crash.

Error: (01/08/2012 04:09:32 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 94663 seconds with 16380 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-10-15 22:46:05.259
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-10-01 22:39:22.232
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-16 22:33:11.237
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-16 21:41:51.056
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-11 07:29:25.960
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-11 07:15:03.923
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-10 07:31:59.583
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-10 07:10:40.360
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-09 17:19:31.102
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-09-09 16:43:29.059
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\Telekom\Kinderschutz-Software_2\KS.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 36%
Total physical RAM: 3066.87 MB
Available physical RAM: 1942.78 MB
Total Pagefile: 6132.02 MB
Available Pagefile: 4597.22 MB
Total Virtual: 2047.88 MB
Available Virtual: 1917.7 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:232.79 GB) (Free:92.67 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 66F2CA13)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
Vielen Dank für die Hilfe bis hierhin


Alt 08.11.2013, 12:38   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Zitat:
Aber wenn ich nun meine Suche direkt in der Adresszeile des Internet Explorer Browsers beginne erscheint "bing" anstelle von Google.

Wie kann ich es auf Google ändern?
Bing ist voreingestellt, einfach in den Einstellungen ändern.

Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop.
Schließe nun alle offenen Programme und trenne Dich von dem Internet.
Doppelklick auf die TFC.exe und drücke auf Start.
Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen.

Sonst noch Probleme?
__________________
--> Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste

Alt 08.11.2013, 19:39   #7
Celeste
 
Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Hallo Schrauber,

vielen Dank für Deine Hilfe. Mein Problem ist nun gelöst




Leider fehlt bei den Foren oft zum Schluss nochmal die endgültige Lösung:

Um die Bing Voreinstellung in den Einstellungen zu Ändern, habe ich in der Adressleiste "www.google.de" eingegeben, dann öffnet sich eine Dropdownliste der Adressleiste. Wenn ich ganz unten rechts nun auf hinzufügen klicke, öffnet sich eine neue Registerkarte mit:

hxxp://www.iegallery.com/de-de/addons?callback=true&featuretype=2

Hier kann ich nun den gewünschten Suchanbieter auswählen/anklicken und zum Internet Explorer hinzufügen.

Fertig.

Alt 09.11.2013, 17:54   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Standard

Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste



Fertig

Die Reihenfolge ist hier entscheidend.
  1. Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
  2. Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
    • Windowstaste + R > Combofix /Uninstall (eingeben) > OK
    • Alternative: Combofix.exe in uninstall.exe umbenennen und starten
    • Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
  3. Downloade Dir bitte auf jeden Fall DelFix Download DelFix auf deinen Desktop:
    • Schließe alle offenen Programme.
    • Starte die delfix.exe mit einem Doppelklick.
    • Setze vor jede Funktion ein Häkchen.
    • Klicke auf Start.
    • Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
    • Starte deinen Rechner abschließend neu.
  4. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.


Hier noch ein paar Tipps zur Absicherung deines Systems.


Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Anti- Viren Software
  • Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.


Zusätzlicher Schutz
  • MalwareBytes Anti Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste
32 bit, 4d36e972-e325-11ce-bfc1-08002be10318, appdatalow, certifed-toolbar search, certifed-toolbar search entfernen, certified toolbar search, dvdvideosoft ltd., entfernen certified-toolbar search, farbar, farbar recovery scan tool, launch, officejet, preferences, registrierungsdatenbank, required, somoto



Ähnliche Themen: Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste


  1. Windows Vista incredibar-search ASK-Toolbar vermutlich Malware, Rechner sehr langsam
    Log-Analyse und Auswertung - 28.04.2015 (11)
  2. vi view anstatt google als startseite+ umleitung bei hyperlinks
    Log-Analyse und Auswertung - 02.02.2015 (4)
  3. Windows 7 Startet nicht/ hängt an der Pw Eingabe/ Bildschirm bleibt schwarz nach Windows Logo
    Plagegeister aller Art und deren Bekämpfung - 27.09.2014 (7)
  4. Anstatt Google wird die Adresse http://search.fbdownloader.com/?channel=de_nt geöffnet
    Plagegeister aller Art und deren Bekämpfung - 26.07.2014 (5)
  5. Sound Probleme bei Tastatur eingabe und die eingabe selbst hackt auch! Verschwunden nach Neustart, kehrt aber wieder wen ich Online gehe
    Log-Analyse und Auswertung - 30.01.2014 (5)
  6. Windows 7 dauerhafte CPU Auslastung um die 25% anstatt 0-1%
    Log-Analyse und Auswertung - 18.11.2013 (3)
  7. Windows XP Nach Installation von HP Player immer zwei Startseiten beim Öffnen von Google chrome "start.iminent.com" und "Search gol"
    Log-Analyse und Auswertung - 08.10.2013 (5)
  8. Windows 7, search.certified-toolbar.com
    Log-Analyse und Auswertung - 14.09.2013 (21)
  9. Windows 7: Hijackerbefall search.certified-toolbar.com
    Log-Analyse und Auswertung - 11.09.2013 (9)
  10. Startpins Suchmaschine anstatt Google
    Plagegeister aller Art und deren Bekämpfung - 24.02.2013 (17)
  11. Google: ungewöhnlichen Datenverkehr eingabe von CAPTCHAs
    Log-Analyse und Auswertung - 20.01.2013 (15)
  12. Google-Meldung Datenverkehr, zum fortfahren Captcha-Eingabe nötig
    Plagegeister aller Art und deren Bekämpfung - 15.12.2012 (31)
  13. Google fordert Captcha-Eingabe von Suchmaschinennutzern
    Nachrichten - 26.07.2012 (0)
  14. Permanenter seitenaufruf bei eingabe in die Adressleiste von http://woobiu.com
    Log-Analyse und Auswertung - 14.06.2012 (3)
  15. Nach Facebook-Link Umleitung von Google-Ergebnissen + Mozilla Toolbar mit Sexanzeigen...
    Log-Analyse und Auswertung - 09.01.2012 (7)
  16. Google Suche schaltet nach Eingabe des ersten Buchstaben um und ist extrem langsam
    Plagegeister aller Art und deren Bekämpfung - 21.12.2011 (7)
  17. Adressleiste weg + search bar
    Plagegeister aller Art und deren Bekämpfung - 22.12.2004 (4)

Zum Thema Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste - Hallo, folgendes Problem unter Betriebssystem (32 bit) Windows 7 Professional: Meine Standard Suchmaschine ist Google. Gerne möchte ich sofort meine Suche direkt in der Adresszeile des Internet Explorer Browsers beginnen. - Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste...
Archiv
Du betrachtest: Windows 7: Certifed-Toolbar Search anstatt Google nach Eingabe in Adressleiste auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.