Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem

Rusty11 · 11.02.2014, 12:38

Ein Freund hat einen alten Rechner geschenkt bekommen und mich gebeten, den mal ein bisschen aufzuraeumen.
Betriebssystem Windows Vista 32 bit
Betriebssystem und alle Programme sind in Englisch.

Habe ca. 30 Programme deinstalliert inclusive 2! Antivirenprogramme (Norton Security Scan und Microsoft Security Essentials).
Habe stattdessen Avira installiert und einen Scan laufen lassen. Dabei Virus gefunden: EXP/ASF.GetCodec.Gen - jetzt in Quarantaene. Ausserdem 3 versteckte Dateien.
Anschliessend habe ich Malwarebytes installiert und laufen lassen. Auch hier 2 Funde - siehe Log.

Jetzt habe ich noch folgende Schritte untenommen:
Defogger ist gelaufen.
FRST ist gelaufen.
GMER ist gelaufen.
Alle Logs anbei.

Ich hoffe, ich habe alle Informationen vollstaendig und waere fuer eure Hilfe beim weiteren Vorgehen extrem dankbar!

Viele Gruesse

AVIRA

Code:

ATTFilter

Avira Free Antivirus
Report file date: 10 February 2014  16:54


The program is running as an unrestricted full version.
Online services are available.

Licensee        : Avira Antivirus Free
Serial number   : 0000149996-AVHOE-0000001
Platform        : Windows Vista (TM) Home Premium
Windows version : (Service Pack 2)  [6.0.6002]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : MY-COMPUTER

Version information:
BUILD.DAT       : 14.0.2.286     55547 Bytes  09/12/2013 11:37:00
AVSCAN.EXE      : 14.0.2.254   1032760 Bytes  09/12/2013 10:37:19
AVSCANRC.DLL    : 14.0.2.180     52280 Bytes  09/12/2013 10:37:19
LUKE.DLL        : 14.0.2.234     65592 Bytes  09/12/2013 10:37:20
AVSCPLR.DLL     : 14.0.2.254    124472 Bytes  09/12/2013 10:37:19
AVREG.DLL       : 14.0.2.212    250424 Bytes  09/12/2013 10:37:19
avlode.dll      : 14.0.2.254    540216 Bytes  09/12/2013 10:37:19
avlode.rdf      : 13.0.1.70      56974 Bytes  10/02/2014 15:36:42
VBASE000.VDF    : 7.11.70.0   66736640 Bytes  04/04/2013 10:37:22
VBASE001.VDF    : 7.11.74.226  2201600 Bytes  30/04/2013 10:37:22
VBASE002.VDF    : 7.11.80.60   2751488 Bytes  28/05/2013 10:37:22
VBASE003.VDF    : 7.11.85.214  2162688 Bytes  21/06/2013 10:37:22
VBASE004.VDF    : 7.11.91.176  3903488 Bytes  23/07/2013 10:37:22
VBASE005.VDF    : 7.11.98.186  6822912 Bytes  29/08/2013 10:37:22
VBASE006.VDF    : 7.11.103.230  2293248 Bytes  24/09/2013 10:37:22
VBASE007.VDF    : 7.11.116.38  5485568 Bytes  28/11/2013 10:37:22
VBASE008.VDF    : 7.11.126.50  3615744 Bytes  22/01/2014 15:36:36
VBASE009.VDF    : 7.11.128.174  2030080 Bytes  03/02/2014 15:36:37
VBASE010.VDF    : 7.11.128.175     2048 Bytes  03/02/2014 15:36:37
VBASE011.VDF    : 7.11.128.176     2048 Bytes  03/02/2014 15:36:37
VBASE012.VDF    : 7.11.128.177     2048 Bytes  03/02/2014 15:36:37
VBASE013.VDF    : 7.11.128.178     2048 Bytes  03/02/2014 15:36:37
VBASE014.VDF    : 7.11.129.9    211456 Bytes  04/02/2014 15:36:37
VBASE015.VDF    : 7.11.129.163   215040 Bytes  06/02/2014 15:36:38
VBASE016.VDF    : 7.11.130.21   220672 Bytes  08/02/2014 15:36:38
VBASE017.VDF    : 7.11.130.99   230400 Bytes  10/02/2014 15:36:38
VBASE018.VDF    : 7.11.130.100     2048 Bytes  10/02/2014 15:36:38
VBASE019.VDF    : 7.11.130.101     2048 Bytes  10/02/2014 15:36:38
VBASE020.VDF    : 7.11.130.102     2048 Bytes  10/02/2014 15:36:38
VBASE021.VDF    : 7.11.130.103     2048 Bytes  10/02/2014 15:36:38
VBASE022.VDF    : 7.11.130.104     2048 Bytes  10/02/2014 15:36:38
VBASE023.VDF    : 7.11.130.105     2048 Bytes  10/02/2014 15:36:38
VBASE024.VDF    : 7.11.130.106     2048 Bytes  10/02/2014 15:36:38
VBASE025.VDF    : 7.11.130.107     2048 Bytes  10/02/2014 15:36:38
VBASE026.VDF    : 7.11.130.108     2048 Bytes  10/02/2014 15:36:38
VBASE027.VDF    : 7.11.130.109     2048 Bytes  10/02/2014 15:36:38
VBASE028.VDF    : 7.11.130.110     2048 Bytes  10/02/2014 15:36:38
VBASE029.VDF    : 7.11.130.111     2048 Bytes  10/02/2014 15:36:38
VBASE030.VDF    : 7.11.130.112     2048 Bytes  10/02/2014 15:36:38
VBASE031.VDF    : 7.11.130.146   163840 Bytes  10/02/2014 15:36:39
Engine version  : 8.2.14.2  
AEVDF.DLL       : 8.1.3.4       102774 Bytes  09/12/2013 10:37:18
AESCRIPT.DLL    : 8.1.4.186     520574 Bytes  10/02/2014 15:36:41
AESCN.DLL       : 8.1.10.6      131447 Bytes  10/02/2014 15:36:41
AESBX.DLL       : 8.2.20.6     1331575 Bytes  10/02/2014 15:36:42
AERDL.DLL       : 8.2.0.138     704888 Bytes  09/12/2013 10:37:18
AEPACK.DLL      : 8.3.3.12      774521 Bytes  10/02/2014 15:36:41
AEOFFICE.DLL    : 8.1.2.76      205181 Bytes  09/12/2013 10:37:18
AEHEUR.DLL      : 8.1.4.904    6455674 Bytes  10/02/2014 15:36:41
AEHELP.DLL      : 8.1.27.10     266618 Bytes  09/12/2013 10:37:18
AEGEN.DLL       : 8.1.7.22      446839 Bytes  10/02/2014 15:36:39
AEEXP.DLL       : 8.4.1.202     434552 Bytes  10/02/2014 15:36:42
AEEMU.DLL       : 8.1.3.2       393587 Bytes  09/12/2013 10:37:18
AECORE.DLL      : 8.1.34.0      229753 Bytes  10/02/2014 15:36:39
AEBB.DLL        : 8.1.1.4        53619 Bytes  09/12/2013 10:37:18
AVWINLL.DLL     : 14.0.2.180     23608 Bytes  09/12/2013 10:37:19
AVPREF.DLL      : 14.0.2.180     48696 Bytes  09/12/2013 10:37:19
AVREP.DLL       : 14.0.2.180    175672 Bytes  09/12/2013 10:37:19
AVARKT.DLL      : 14.0.2.254    256056 Bytes  09/12/2013 10:37:18
AVEVTLOG.DLL    : 14.0.2.180    165944 Bytes  09/12/2013 10:37:18
SQLITE3.DLL     : 3.7.0.1       394808 Bytes  09/12/2013 10:37:21
AVSMTP.DLL      : 14.0.2.180     60472 Bytes  09/12/2013 10:37:19
NETNT.DLL       : 14.0.2.180     13368 Bytes  09/12/2013 10:37:20
RCIMAGE.DLL     : 14.0.2.180   4788792 Bytes  09/12/2013 10:37:21
RCTEXT.DLL      : 14.0.2.236     72760 Bytes  09/12/2013 10:37:21

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\program files\avira\antivir desktop\sysscan.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, 
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: extended

Start of the scan: 10 February 2014  16:54

Start scanning boot sectors:
Boot sector 'HDD0(C:, D:)'
    [INFO]      No virus was found!

Starting search for hidden objects.
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
  [NOTE]      The registry entry is invisible.
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0MRUListEx
  [NOTE]      The registry entry is invisible.
Hidden driver
  [NOTE]      A memory modification has been detected, which could potentially be used to hide file access attempts.

The scan of running processes will be started:
Scan process 'DllHost.exe' - '22' Module(s) have been scanned
Scan process 'SearchFilterHost.exe' - '33' Module(s) have been scanned
Scan process 'SearchProtocolHost.exe' - '62' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '62' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'vssvc.exe' - '49' Module(s) have been scanned
Scan process 'avscan.exe' - '106' Module(s) have been scanned
Scan process 'avscan.exe' - '47' Module(s) have been scanned
Scan process 'avcenter.exe' - '86' Module(s) have been scanned
Scan process 'armsvc.exe' - '24' Module(s) have been scanned
Scan process 'svchost.exe' - '21' Module(s) have been scanned
Scan process 'conime.exe' - '16' Module(s) have been scanned
Scan process 'Apntex.exe' - '21' Module(s) have been scanned
Scan process 'HidFind.exe' - '23' Module(s) have been scanned
Scan process 'ApMsgFwd.exe' - '16' Module(s) have been scanned
Scan process 'taskeng.exe' - '49' Module(s) have been scanned
Scan process 'avshadow.exe' - '33' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '34' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '25' Module(s) have been scanned
Scan process 'pwsafe.exe' - '45' Module(s) have been scanned
Scan process 'ONENOTEM.EXE' - '18' Module(s) have been scanned
Scan process 'quickset.exe' - '80' Module(s) have been scanned
Scan process 'DLG.exe' - '22' Module(s) have been scanned
Scan process 'BTTray.exe' - '54' Module(s) have been scanned
Scan process 'daemon.exe' - '47' Module(s) have been scanned
Scan process 'ehmsas.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '26' Module(s) have been scanned
Scan process 'xaudio.exe' - '14' Module(s) have been scanned
Scan process 'avgnt.exe' - '77' Module(s) have been scanned
Scan process 'svchost.exe' - '25' Module(s) have been scanned
Scan process 'svchost.exe' - '44' Module(s) have been scanned
Scan process 'STacSV.exe' - '35' Module(s) have been scanned
Scan process 'SeaPort.exe' - '56' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '42' Module(s) have been scanned
Scan process 'Iaantmon.exe' - '36' Module(s) have been scanned
Scan process 'sttray.exe' - '36' Module(s) have been scanned
Scan process 'hpwuschd2.exe' - '16' Module(s) have been scanned
Scan process 'PCMService.exe' - '55' Module(s) have been scanned
Scan process 'IAAnotif.exe' - '38' Module(s) have been scanned
Scan process 'igfxpers.exe' - '20' Module(s) have been scanned
Scan process 'hkcmd.exe' - '23' Module(s) have been scanned
Scan process 'OEM02Mon.exe' - '30' Module(s) have been scanned
Scan process 'Apoint.exe' - '33' Module(s) have been scanned
Scan process 'EvtEng.exe' - '88' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'avguard.exe' - '94' Module(s) have been scanned
Scan process 'aestsrv.exe' - '5' Module(s) have been scanned
Scan process 'svchost.exe' - '58' Module(s) have been scanned
Scan process 'sched.exe' - '59' Module(s) have been scanned
Scan process 'taskeng.exe' - '83' Module(s) have been scanned
Scan process 'spoolsv.exe' - '90' Module(s) have been scanned
Scan process 'WLANExt.exe' - '92' Module(s) have been scanned
Scan process 'Explorer.EXE' - '136' Module(s) have been scanned
Scan process 'svchost.exe' - '94' Module(s) have been scanned
Scan process 'Dwm.exe' - '31' Module(s) have been scanned
Scan process 'svchost.exe' - '80' Module(s) have been scanned
Scan process 'SLsvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '37' Module(s) have been scanned
Scan process 'svchost.exe' - '154' Module(s) have been scanned
Scan process 'svchost.exe' - '114' Module(s) have been scanned
Scan process 'svchost.exe' - '70' Module(s) have been scanned
Scan process 'svchost.exe' - '35' Module(s) have been scanned
Scan process 'svchost.exe' - '40' Module(s) have been scanned
Scan process 'winlogon.exe' - '30' Module(s) have been scanned
Scan process 'lsm.exe' - '22' Module(s) have been scanned
Scan process 'lsass.exe' - '60' Module(s) have been scanned
Scan process 'services.exe' - '33' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'wininit.exe' - '26' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting to scan executable files (registry):
The registry was scanned ( '1595' files ).


Starting the file scan:

Begin scan in 'C:\' <OS>
C:\Users\Leah\Videos\12 Years a Slave (2013) BRRip XviD-SV\12 Years a Slave (2013) BRRip XviD-SV.avi
  [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
Begin scan in 'D:\' <RECOVERY>

Beginning disinfection:
C:\Users\Leah\Videos\12 Years a Slave (2013) BRRip XviD-SV\12 Years a Slave (2013) BRRip XviD-SV.avi
  [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
  [NOTE]      The file was moved to the quarantine directory under the name '5c3baf53.qua'!


End of the scan: 10 February 2014  18:41
Used time:  1:41:36 Hour(s)

The scan has been done completely.

  30791 Scanned directories
 370259 Files were scanned
      1 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 Files were deleted
      0 Viruses and unwanted programs were repaired
      1 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
 370258 Files not concerned
   3986 Archives were scanned
      0 Warnings
      4 Notes
 659128 Objects were scanned with rootkit scan
      3 Hidden objects were found

MALWAREBYTES

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.10.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Leah :: MY-COMPUTER [administrator]

10/02/2014 18:48:07
14-02-10_Malwarebytes.txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 393156
Time elapsed: 1 hour(s), 50 minute(s), 53 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\dark (Trojan.Banker) -> No action taken.

Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows Explorer (Backdoor.Bot) -> Data: c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\\explorer.exe -> No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

FRST

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-02-2014 01
Ran by Leah (administrator) on MY-COMPUTER on 11-02-2014 09:29:09
Running from C:\Users\Leah\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(SourceForge.net) C:\Program Files\Password Safe\pwsafe.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Don HO don.h@free.fr) C:\Program Files\Notepad++\notepad++.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [ECenter] - C:\Dell\E-Center\EULALauncher.exe [17920 2007-05-25] ( )
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [189736 2007-11-01] (CyberLink Corp.)
HKLM\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [Windows Explorer] - c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\\explorer.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [Google Update] - C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [133104 2009-04-22] (Google Inc.)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: G - G:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: H - H:\LaunchU3.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {0e7e00eb-7e3f-11dd-9c33-001e4ce0d111} - H:\LaunchU3.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {9354534d-866d-11dd-a618-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {93545352-866d-11dd-a618-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {b9c2bde6-08e9-11e3-bebe-001d093e98c4} - F:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {ba24b8ea-82b5-11e2-aa43-001d093e98c4} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {bf0648d4-7749-11dd-9c5a-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {bfd30cf4-7aae-11dd-a31d-806e6f6e6963} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {c5a5d575-e94d-11dc-afe6-001e4ce0d111} - F:\LaunchU3.exe -a
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)

==================== Internet (Whitelisted) ====================

ProxyServer: proxy.dcu.ie:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=BT5&o=15443&src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=GX&apn_dtid=YYYYYYB3IE&apn_uid=7B29C92D-8B36-4E4E-BBF9-03BF71713D7E&apn_sauid=83B80E4B-912D-4A0A-86A0-579A31F81DC8
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default
FF DefaultSearchEngine: Bing 
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: https://www.google.de/?gws_rd=cr&ei=Vd34UrDfMIOktAbEhoD4Cg
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF NetworkProxy: "ftp", "proxy.dcu.ie"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "gopher", "proxy.dcu.ie"
FF NetworkProxy: "gopher_port", 8080
FF NetworkProxy: "http", "proxy.dcu.ie"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localho,t,127.0.0.1,*.local"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "proxy.dcu.ie"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "proxy.dcu.ie"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazon-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\chambers-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-en-GB.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-10]
FF Extension: Adblock Plus - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome: 
=======
CHR HomePage: hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=en-IE&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll No File
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\Leah\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Facebook Plugin) - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-02-06]
CHR Extension: (Poppit) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-02-06]
CHR Extension: (Google Wallet) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR StartMenuInternet: Google Chrome - C:\Users\Leah\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [67584 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-06-25] (Huawei Technologies Co., Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2012-01-09] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PcdrNdisuio; system32\DRIVERS\pcdrndisuio.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-11 09:29 - 2014-02-11 09:29 - 00019649 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:28 - 2014-02-11 09:29 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-11 09:28 - 01139712 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:33 - 2014-02-10 17:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:33 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-10 17:30 - 2014-02-10 17:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:23 - 2014-02-10 17:24 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:34 - 2013-12-09 11:37 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk

==================== One Month Modified Files and Folders =======

2014-02-11 09:29 - 2014-02-11 09:29 - 00019649 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:29 - 2014-02-11 09:28 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-11 09:28 - 01139712 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:27 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-11 09:27 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-11 09:26 - 2006-11-02 11:33 - 00703516 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-11 09:24 - 2008-02-24 10:32 - 01851787 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 09:21 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\AppData\Local\PasswordSafe
2014-02-11 09:20 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:19 - 2012-08-14 20:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-11 09:19 - 2008-03-03 01:26 - 00000000 ____D () C:\Users\Leah
2014-02-11 09:19 - 2008-02-24 10:33 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-11 09:19 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 20:44 - 2009-07-01 19:24 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:31 - 2014-02-10 17:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:24 - 2014-02-10 17:23 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:50 - 2013-12-30 13:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-02-10 16:48 - 2008-07-10 15:51 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Skype
2014-02-10 16:45 - 2008-02-24 10:55 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-10 16:44 - 2008-02-24 11:04 - 00218752 _____ () C:\Windows\PFRO.log
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Norton
2014-02-10 16:29 - 2011-03-19 11:51 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-10 16:22 - 2008-03-03 19:51 - 00154112 _____ () C:\Users\Leah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-10 16:02 - 2008-03-21 15:13 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Adobe
2014-02-10 16:01 - 2008-08-16 11:41 - 00000000 ____D () C:\Users\Leah\Documents\My Received Files
2014-02-10 15:58 - 2008-08-16 11:30 - 00000000 ____D () C:\Program Files\Windows Live
2014-02-10 15:57 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-10 15:56 - 2008-08-16 11:41 - 00049152 _____ () C:\Windows\DPINST.LOG
2014-02-10 15:43 - 2008-03-03 01:27 - 00060248 _____ () C:\Users\Leah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-10 15:42 - 2008-02-24 10:55 - 00000000 ____D () C:\Program Files\Google
2014-02-10 15:42 - 2006-11-02 13:47 - 00270608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-10 15:37 - 2009-11-18 15:04 - 00000000 ____D () C:\ProgramData\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Program Files\Real
2014-02-10 15:36 - 2013-08-08 19:39 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Leah\Desktop\Notepad++.lnk
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Guest\Desktop\Notepad++.lnk
2014-02-10 15:26 - 2008-02-24 10:41 - 00000000 ____D () C:\Program Files\Java
2014-02-10 15:22 - 2013-01-19 13:52 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-10 15:22 - 2008-06-12 23:00 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-10 15:16 - 2013-08-18 10:49 - 00000000 ____D () C:\Program Files\HP
2014-02-10 15:15 - 2012-06-07 16:01 - 00000000 ____D () C:\Program Files\Citrix
2014-02-10 15:15 - 2009-04-22 11:03 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Mozilla
2014-02-10 15:15 - 2008-03-03 01:27 - 00000000 ____D () C:\Users\Leah\AppData\Local\Google
2014-02-10 15:14 - 2009-05-26 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-10 15:09 - 2006-11-02 11:23 - 00000144 _____ () C:\Windows\win.ini
2014-02-10 15:06 - 2008-02-24 10:43 - 00000000 ____D () C:\Program Files\Dell
2014-02-10 14:54 - 2009-07-01 19:24 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
2014-02-07 14:20 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\Documents\My Safes
2014-02-07 12:41 - 2012-08-14 20:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-07 12:41 - 2012-08-14 20:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 17:10 - 2010-12-14 00:50 - 00002082 _____ () C:\Users\Leah\Desktop\Google Chrome.lnk
2014-02-05 16:19 - 2012-05-22 11:44 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-05 15:58 - 2008-09-09 08:18 - 00005648 _____ () C:\Users\Leah\AppData\Local\d3d9caps.dat
2014-02-03 21:34 - 2010-12-13 23:13 - 00000000 ____D () C:\ProgramData\PCDr
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
2014-02-03 20:44 - 2006-11-02 13:52 - 00235301 _____ () C:\Windows\setupact.log
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ___RD () C:\Program Files\Skype
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ____D () C:\ProgramData\Skype
2014-01-19 08:32 - 2010-02-01 11:08 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-17 18:59 - 2008-02-24 10:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-17 18:58 - 2013-08-15 11:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-17 18:55 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\Guest\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Leah\AppData\Local\Temp\.gbas.dll
C:\Users\Leah\AppData\Local\Temp\AdobeUpdater12345.exe
C:\Users\Leah\AppData\Local\Temp\AskInstallChecker.exe
C:\Users\Leah\AppData\Local\Temp\avgnt.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u19-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\lowproc.exe
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{5D15CCF0-4C97-4a47-BCF5-08A11A9CD40D}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{9BFE0D57-FD50-4a53-A826-91EA55449E63}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{A4CDF389-D003-47d1-AC47-2DBFBF94C119}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{A7808FEE-F897-49f6-BB6C-FE4BD5DAA9BD}.dll
C:\Users\Leah\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Leah\AppData\Local\Temp\MSN623D.exe
C:\Users\Leah\AppData\Local\Temp\NEventMessages.dll
C:\Users\Leah\AppData\Local\Temp\npp.6.5.2.Installer.exe
C:\Users\Leah\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Leah\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Leah\AppData\Local\Temp\stubhelper.dll
C:\Users\Leah\AppData\Local\Temp\swt-awt-win32-3346.dll
C:\Users\Leah\AppData\Local\Temp\swt-win32-3346.dll
C:\Users\Leah\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\Leah\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-11 09:26

==================== End Of Log ============================

FRST_Addition

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 10-02-2014 01
Ran by Leah at 2014-02-11 09:29:38
Running from C:\Users\Leah\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) (Version: 10.1.9 - Adobe Systems Incorporated)
Advanced Audio FX Engine (Version:  - )
Advanced Video FX Engine (Version:  - )
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Conexant HDA D330 MDC V.92 Modem (Version:  - )
Dell Getting Started Guide (Version: 1.00.0000 - Dell Inc.)
Dell Touchpad (Version: 7.1.103.4 - Alps Electric)
Dell Webcam Center (Version:  - )
Dell Webcam Manager (Version:  - )
Digital Line Detect (Version: 1.21 - BVRP Software, Inc)
Google Chrome (HKCU Version: 32.0.1700.107 - Google Inc.)
Highlight Viewer (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
HP Update (Version: 5.003.003.001 - Hewlett-Packard)
Intel(R) Matrix Storage Manager (Version:  - )
Intel(R) PROSet/Wireless Software (Version: 11.01.0000 - Intel Corporation)
Iomega Product Registration (Version: 7.24.0000 - Iomega Corporation)
Laptop Integrated Webcam Driver (1.04.01.1011)   (Version:  - )
Live! Cam Avatar Creator (Version: 4.6.0817.1 - Creative Technology Ltd.)
Live! Cam Avatar v1.0 (Version: 1.0 - Creative Technology Ltd.)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
mCore (Version: 9.24.0000 - Intel Corporation) Hidden
MediaDirect (Version: 3.5 - Dell)
mHelp (Version: 9.24.0000 - Intel) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Search Enhancement Pack (Version: 3.0.133.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
mMHouse (Version: 9.24.0000 - Intel Corporation) Hidden
Modem Diagnostic Tool (Version: 1.0.20.0 - Dell)
Mozilla Firefox 26.0 (x86 en-GB) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
mPfMgr (Version: 9.24.0000 - Intel Corporation) Hidden
MSVC80_x86 (Version: 1.0.1.0 - Nokia) Hidden
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
mWMI (Version: 9.24.0000 - Intel Corporation) Hidden
My Dell (Version: 3.4.6422.14 - PC-Doctor, Inc.)
NetWaiting (Version: 2.5.44 - BVRP Software, Inc)
Notepad++ (Version: 6.5.2 - Notepad++ Team)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OutlookAddinSetup (Version: 1.0.0 - CyberLink)
Password Safe (Version:  - )
PC Connectivity Solution (Version: 10.18.0.0 - Nokia)
QuickSet (Version: 8.2.17 - Dell Inc.)
Roxio Creator Audio (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Copy (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Data (Version: 3.7.0 - Roxio) Hidden
Roxio Creator DE (Version: 10.1 - )
Roxio Creator DE (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Tools (Version: 3.7.0 - Roxio) Hidden
Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden
Roxio Update Manager (Version: 6.0.0 - Roxio) Hidden
Skype Toolbars (Version: 5.0.4137 - Skype Technologies S.A.)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Smart Menus (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
User's Guides (Version:  - )
WIDCOMM Bluetooth Software 6.0.1.3100 (Version: 6.0.1.3100 - Dell)
Windows Live Toolbar Extension (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)

==================== Restore Points  =========================

05-01-2014 14:54:02 Windows Update
08-01-2014 11:36:51 Scheduled Checkpoint
17-01-2014 12:23:01 Windows Update
17-01-2014 17:54:44 Windows Update
19-01-2014 15:42:00 Removed HP Deskjet 1000 J110 series Basic Device Software
26-01-2014 17:15:22 Windows Update
27-01-2014 19:34:24 Scheduled Checkpoint
31-01-2014 13:01:03 Windows Update
01-02-2014 18:05:14 Scheduled Checkpoint
03-02-2014 17:31:29 Windows Update
05-02-2014 15:28:25 Scheduled Checkpoint
07-02-2014 11:53:32 Windows Update
10-02-2014 13:53:20 Removed Apple Application Support
10-02-2014 13:55:23 Removed Apple Mobile Device Support
10-02-2014 13:56:46 Removed Apple Software Update
10-02-2014 13:58:39 Removed Bonjour
10-02-2014 14:01:19 Windows Update
10-02-2014 14:06:09 Removed Browser Address Error Redirector.
10-02-2014 14:06:24 Removed Bonjour
10-02-2014 14:12:27 Removed Feedback Tool
10-02-2014 14:15:01 Removed Google Talk Plugin
10-02-2014 14:15:49 Removed HP Deskjet 1000 J110 series Basic Device Software
10-02-2014 14:17:13 Removed HP Deskjet 1000 J110 series Help
10-02-2014 14:18:30 Removed iTunes
10-02-2014 14:22:22 Removed Java 7 Update 45
10-02-2014 14:23:47 Removed Java(TM) 6 Update 35
10-02-2014 14:25:04 Removed Java(TM) SE Runtime Environment 6
10-02-2014 14:26:46 Removido Miniaurélio
10-02-2014 14:34:13 Removed QuickTime
10-02-2014 14:38:10 Removed Retrospect 7.5
10-02-2014 14:40:09 Removed Skype Toolbars
10-02-2014 14:47:17 Removed Feedback Tool
10-02-2014 14:48:33 Removed Skype Toolbars
10-02-2014 14:53:22 Removed Spelling Dictionaries Support For Adobe Reader 8
10-02-2014 14:56:51 Windows Live Essentials
10-02-2014 14:58:28 Removed Windows Live Favorites for Windows Live Toolbar

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {06DBA3A5-144B-4A03-9521-7CC720DE6165} - System32\Tasks\{E72283E4-1774-42B8-B8FF-304A4E5DA9B8} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0C003265-4905-48AB-BEDC-510CC00AF517} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {0EE9C2FC-7C71-4D55-8B83-429FBF2A5AE3} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-12-07] (PC-Doctor, Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E80B85F-473D-4157-BDD5-21ED0AD186A7} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {2D63378D-EE90-4DE4-BE6C-52705345E0AC} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {2FF92470-CDA0-4AE6-9506-AA6CE98C6EFD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {44F1C48E-75D3-409A-B6DC-78643828A7C4} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {5FD0005F-67BE-4377-993A-3164E355E880} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Leah => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {62ED58DC-65F8-4EB2-AB4B-8D55875A1A93} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {77F6DEAA-077F-4A8E-A989-710146F9603F} - System32\Tasks\{86F4E43F-1BBB-4F2B-A302-E694F21AC20E} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {B43B4946-2DF2-424B-978F-09723934A10A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C0E06D20-DE13-4D4E-A4C8-B5AE08EA3332} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {D5B7A726-E835-4C53-8922-443BBADAF95B} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {D68D82DB-ED91-44FE-8A48-7B95C5CB7BCA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-06] (PC-Doctor, Inc.)
Task: {DF32DA4A-B92B-4F92-9A9A-FC9D603347B9} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-06-18 16:24 - 2012-06-18 16:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll
2006-11-03 18:46 - 2006-11-03 18:46 - 00126976 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2008-02-24 18:26 - 2007-12-15 04:54 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2006-11-03 18:25 - 2006-11-03 18:25 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2013-12-30 13:46 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2011-07-18 22:07 - 2011-07-18 22:07 - 00014336 _____ () C:\Program Files\Notepad++\plugins\NppExport.dll
2011-09-21 21:46 - 2011-09-21 21:46 - 01673728 _____ () C:\Program Files\Notepad++\plugins\NppFTP.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/10/2014 04:27:36 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS\FAVORITES> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 04:27:36 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS\FAVORITES> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 04:27:35 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 04:27:35 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 03:56:50 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dd9e3a75-a637-4f9d-b74c-502f538b2fed}

Error: (02/10/2014 03:49:29 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Skype Toolbars -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. The arguments are: , ,

Error: (02/10/2014 03:40:22 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Skype Toolbars -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. The arguments are: , ,

Error: (02/10/2014 03:39:40 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Roxio Update Manager -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: DWUS_Unregister.C3A146F5_4B48_11D5_A819_00B0D0428C0C, location: C:\Program Files\Common Files\InstallShield\UpdateService\, command: C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe /u{30465B6C-B53F-49A1-9EBA-A3F187AD502E}

Error: (02/10/2014 03:39:23 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Roxio Update Manager -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: DWUS_Unregister.C3A146F5_4B48_11D5_A819_00B0D0428C0C, location: C:\Program Files\Common Files\InstallShield\UpdateService\, command: C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe /u{30465B6C-B53F-49A1-9EBA-A3F187AD502E}

Error: (02/10/2014 03:37:58 PM) (Source: Microsoft-Windows-RestartManager) (User: My-Computer)
Description: 0rndlresolversvc.exeRealNetworks Downloader Resolver Service03026217828200


System errors:
=============
Error: (02/11/2014 09:21:49 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/11/2014 09:21:49 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/11/2014 08:50:33 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/11/2014 08:50:33 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/10/2014 04:50:10 PM) (Source: Service Control Manager) (User: )
Description: Windows Search%%1053

Error: (02/10/2014 04:50:10 PM) (Source: Service Control Manager) (User: )
Description: 30000Windows Search

Error: (02/10/2014 04:50:10 PM) (Source: DCOM) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (02/10/2014 04:45:35 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/10/2014 04:45:35 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/10/2014 03:57:04 PM) (Source: Service Control Manager) (User: )
Description: Windows Search%%1053


Microsoft Office Sessions:
=========================
Error: (12/05/2009 04:42:08 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/10/2009 07:20:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7308 seconds with 4920 seconds of active time.  This session ended with a crash.

Error: (07/25/2009 05:46:00 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15612 seconds with 7080 seconds of active time.  This session ended with a crash.

Error: (07/09/2009 09:45:54 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4397 seconds with 1500 seconds of active time.  This session ended with a crash.

Error: (06/22/2009 00:51:51 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31569 seconds with 3540 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-02-10 20:38:33.825
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:33.544
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:33.248
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.967
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.671
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.374
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:32.585
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:32.304
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:31.992
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:31.711
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 3061.31 MB
Available physical RAM: 1698.58 MB
Total Pagefile: 6326.89 MB
Available Pagefile: 4830.39 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.41 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:220.29 GB) (Free:110.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 88000000)
Partition 1: (Not Active) - (Size=94 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=220 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=OF Extended)

==================== End Of Log ============================

GMER
Das Log ist so umfangreich, dass ich es hier nicht gepostet kriege. Soll ich es als File anhaengen?

schrauber · 11.02.2014, 13:06

Hi,

einfach aufteilen und mehrere Posts nutzen.

Rusty11 · 11.02.2014, 16:21

Das Log hat ca. 61.400 Zeilen! Ich schaetze ich muesste es in mehr als 50 Parts posten. Gibt es eine andere Moeglichkeit - als Anhang?

schrauber · 12.02.2014, 17:38

Ok dann zippe es und hänge es an.

Rusty11 · 12.02.2014, 19:36

Hier der Anhang.
Viele Gruesse!

schrauber · 13.02.2014, 21:35

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Rusty11 · 14.02.2014, 00:56

Hi,
erledigt. Log folgt.
Hoffe der Aussendienst ist okay und es gibt guten Kaffee!!!!
Wuerde gerne mehr ueber das Lesen von Logfiles lernen und haette Interesse euch nicht nur finanziell zu unterstuetzen - kann ich was tun?

Combofix:

Code:

ATTFilter

ComboFix 14-02-12.01 - Leah 14/02/2014   0:14.1.2 - x86
Running from: c:\users\Leah\Downloads\ComboFix.exe
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\PCDr\6422\AddOnDownloaded\1b8965d5-1ace-460f-9f9d-51d4c6c7c534.dll
c:\programdata\PCDr\6422\AddOnDownloaded\236515c7-c29a-41e6-873d-b9e2673e11c3.dll
c:\programdata\PCDr\6422\AddOnDownloaded\25859408-d118-4a4d-a622-6f6b98c8b7a4.dll
c:\programdata\PCDr\6422\AddOnDownloaded\2b605d7d-d0d9-4054-adbf-4b49c7319932.dll
c:\programdata\PCDr\6422\AddOnDownloaded\2ff77179-a156-48e2-9210-92584330fa1e.dll
c:\programdata\PCDr\6422\AddOnDownloaded\433f450c-7cfc-4bb7-9084-d52289cd0b0f.dll
c:\programdata\PCDr\6422\AddOnDownloaded\46396106-fa11-4329-87bf-ed5a85069e89.dll
c:\programdata\PCDr\6422\AddOnDownloaded\46f8f9b8-a6d9-4ac9-a82f-2c79e2a75546.dll
c:\programdata\PCDr\6422\AddOnDownloaded\4f436db1-def5-4137-a084-15125ef65010.dll
c:\programdata\PCDr\6422\AddOnDownloaded\538ed073-443d-4773-bf99-d9acbd2ae75f.dll
c:\programdata\PCDr\6422\AddOnDownloaded\58073f58-c256-45c9-a26d-2c9c44ad6b03.dll
c:\programdata\PCDr\6422\AddOnDownloaded\712ff270-978b-4b35-9eb6-621f6ff35d6e.dll
c:\programdata\PCDr\6422\AddOnDownloaded\7bc69e73-3dda-484f-af68-bb19598a4b32.dll
c:\programdata\PCDr\6422\AddOnDownloaded\9c91892f-68c1-49f2-9c84-27a2e4701c64.dll
c:\programdata\PCDr\6422\AddOnDownloaded\a4f460a6-e6cd-457f-931d-cb0fc7d56d03.dll
c:\programdata\PCDr\6422\AddOnDownloaded\a5fe6876-4636-4d79-8440-3ce56e4f4416.dll
c:\programdata\PCDr\6422\AddOnDownloaded\a9d9bdb2-283c-48d2-b6ea-df9f6bc83b04.dll
c:\programdata\PCDr\6422\AddOnDownloaded\b1cd2350-1a70-4fd2-9b75-98208aace99a.dll
c:\programdata\PCDr\6422\AddOnDownloaded\ca984d5b-37f4-4f56-8ca3-2a0d6cdba833.dll
c:\programdata\PCDr\6422\AddOnDownloaded\cce4ac4d-7353-4099-b347-95166f07f05e.dll
c:\programdata\PCDr\6422\AddOnDownloaded\cdf86821-bbfe-4586-8cae-bf998bb8d498.dll
c:\programdata\PCDr\6422\AddOnDownloaded\ceb70e67-87f1-40c5-86a3-c576ea0c4e8f.dll
c:\programdata\PCDr\6422\AddOnDownloaded\fdae1379-f1f4-49e3-a1cc-0a3d1c8ae2a5.dll
c:\programdata\PCDr\6422\AddOnDownloaded\ffa288d5-37d2-4036-812e-1b7722ec86ed.dll
C:\System
c:\system\S-3-7-89-2225458569-9856321456-454423558-8896\Desktop.ini
c:\users\Leah\g2mdlhlpx.exe
.
.
(((((((((((((((((((((((((   Files Created from 2014-01-13 to 2014-02-13  )))))))))))))))))))))))))))))))
.
.
2014-02-13 23:21 . 2014-02-13 23:21	--------	d-----w-	c:\users\Guest\AppData\Local\temp
2014-02-13 23:21 . 2014-02-13 23:21	--------	d-----w-	c:\users\Default\AppData\Local\temp
2014-02-13 23:19 . 2014-02-13 23:19	62576	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F3867B53-5ACB-4279-B45D-1F42DDA91A2E}\offreg.dll
2014-02-12 18:18 . 2014-02-12 18:18	--------	d-----w-	c:\program files\7-Zip
2014-02-11 10:19 . 2013-12-16 00:54	7760024	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{F3867B53-5ACB-4279-B45D-1F42DDA91A2E}\mpengine.dll
2014-02-11 08:28 . 2014-02-11 08:33	--------	d-----w-	C:\FRST
2014-02-10 16:34 . 2014-02-10 16:34	--------	d-----w-	c:\users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 16:34 . 2014-02-10 16:34	--------	d-----w-	c:\programdata\Malwarebytes
2014-02-10 16:33 . 2013-04-04 13:50	22856	----a-w-	c:\windows\system32\drivers\mbam.sys
2014-02-10 16:33 . 2014-02-10 16:34	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2014-02-10 15:37 . 2014-02-10 15:37	--------	d-----w-	c:\users\Leah\AppData\Roaming\Avira
2014-02-10 15:34 . 2013-12-09 10:37	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-02-10 15:34 . 2013-12-09 10:37	90400	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-02-10 15:34 . 2013-12-09 10:37	135648	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-02-10 15:30 . 2014-02-10 15:37	--------	d-----w-	c:\programdata\Avira
2014-02-10 15:30 . 2014-02-10 15:37	--------	d-----w-	c:\program files\Avira
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-07 11:41 . 2012-08-14 19:57	71048	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2014-02-07 11:41 . 2012-08-14 19:57	692616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2013-12-18 05:13 . 2010-02-01 10:08	231584	------w-	c:\windows\system32\MpSigStub.exe
2013-12-16 17:41 . 2008-02-24 09:43	499712	----a-w-	c:\windows\system32\msvcp71.dll
2013-12-16 17:41 . 2008-02-24 09:43	348160	----a-w-	c:\windows\system32\msvcr71.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-05-25 17920]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-10-25 167936]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2007-08-28 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-12-15 137752]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-12-15 154136]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-12-15 133656]
"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-11-01 189736]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-11-12 405504]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-12-09 684600]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
.
S2 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-11-12 73728]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-13 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-14 11:41]
.
2014-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
- c:\users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22 10:02]
.
2014-02-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
- c:\users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22 10:02]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = proxy.dcu.ie:8080
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\
FF - prefs.js: browser.search.selectedEngine - Bing 
FF - prefs.js: browser.startup.homepage - hxxps://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF - prefs.js: network.proxy.ftp - proxy.dcu.ie
FF - prefs.js: network.proxy.ftp_port - 8080
FF - prefs.js: network.proxy.gopher - proxy.dcu.ie
FF - prefs.js: network.proxy.gopher_port - 8080
FF - prefs.js: network.proxy.http - proxy.dcu.ie
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.socks - proxy.dcu.ie
FF - prefs.js: network.proxy.socks_port - 8080
FF - prefs.js: network.proxy.ssl - proxy.dcu.ie
FF - prefs.js: network.proxy.ssl_port - 8080
FF - prefs.js: network.proxy.type - 4
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
HKLM-Run-DellSupportCenter - c:\program files\Dell Support Center\bin\sprtcmd.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2014-02-14 00:22
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...  
.
scanning hidden autostart entries ... 
.
scanning hidden files ...  
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{022105BD-948A-40C9-AB42-A3300DDF097F}]
@DACL=(02 0000)
@="Update3COMClass"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{035FBE31-3755-450A-A775-5E6BBD43D344}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{039B2CA5-3B41-4D93-AD77-47D3293FC5CB}]
@DACL=(02 0000)
@="ContentHost Control"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{08FB66B9-2D2D-4B35-A747-D5D9E9F472E2}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{095A2EEC-F7FE-42E8-96FB-C20E53081908}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{0E55CBE1-B06A-49B6-AD8D-9EFAA0160C6F}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{15099B20-F703-4241-8692-472DF1DDE74E}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{1793FE32-120E-4D33-8BE9-19EF4AD165F6}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{1F7B5093-119B-4c50-B705-658A231CEC4B}]
@DACL=(02 0000)
"5918569797E09F35"="1B"
"440D54AA8AF58E3D"="19"
"580950B697F5823D87"="194D31F4CEB0D97DD083"
"481244AA97E58A29"="1B"
"5E0E54A082F8883F97D844"="1B"
"651845B38CF3800687C45987DD"="1B"
"580852A786F2983996D35D"="19"
"580950B697F5823D87E94384D6"="194D31F4CEB0D97DD083"
"481244AA97E58A29BDC55593"="1B"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{218D2740-5A50-42A8-AB9F-62FF1B168782}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{220DFF67-87CE-4D26-8020-27E0B554A880}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{22181302-A8A6-4F84-A541-E5CBFC70CC43}]
@DACL=(02 0000)
@="GoogleUpdate Update3Web"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{29A96789-9595-4947-BEDB-0FCC776F7DB8}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{2F0E2680-9FF5-43C0-B76E-114A56E93598}]
@DACL=(02 0000)
@="Google Update Legacy On Demand"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{3063357E-821C-4A7D-B49A-F61EA772BF9B}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{320F0FDB-BE0A-4648-9D18-4A2C3448C007}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{3A6EE5C3-7A28-452B-832D-08FE74C7EEAD}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{42481700-CF3C-4D05-8EC6-F9A1C57E8DC0}]
@DACL=(02 0000)
@="WindowGroup Class"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{4A26DF46-A5AF-4D46-A60D-14AD89E57A63}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{515C93ED-88BD-4CCB-AE7F-9F2A1E9695A3}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{51F9E8EF-59D7-475B-A106-C7EA6F30C119}]
@DACL=(02 0000)
@="Google.OneClickProcessLauncher"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{546958A5-5C48-48BE-9396-599811623E60}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{5C65F4B0-3651-4514-B207-D10CB699B14B}]
@DACL=(02 0000)
@="CommandExecuteImpl Class"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{62A0D750-DED9-448C-B693-406B34BB0892}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{634059C0-D264-4B2C-AE80-F73E48D33E5B}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{6D7374DE-63AA-473C-8C02-60D9CDCD84C5}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{A1436E43-F58F-4D3B-B908-B6DA44563B00}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{A45426FB-E444-42B2-AA56-419F8FBEEC61}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{A480C024-04D0-4F28-8CF0-ADACE2BD839C}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{A54D478D-4F70-4F72-9A74-17C9986E35AB}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{B41AD4BE-25BA-4A51-A0BB-FC1584E316F1}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{C3101A8B-0EE1-4612-BFE9-41FFC1A3C19D}]
@DACL=(02 0000)
@="Google Update Plugin"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{C442AC41-9200-4770-8CC0-7CDB4F245C55}]
@DACL=(02 0000)
@="Google Update Plugin"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{C5A2122B-A05B-4FD8-AE49-91990AE10998}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{CD221623-4F9A-4FA5-A9EE-A77EC8F0E7BD}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{D0D38C6E-BF64-4C42-840D-3E0019D9F7A6}]
@DACL=(02 0000)
@="DRMClient Helper version 2"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{D98E820F-6ACD-4dc0-921E-9841E3D8B4A7}]
@DACL=(02 0000)
@="Player Class"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{DB25D157-76D4-41C1-97B5-359E4A4CECEB}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{E67BE843-BBBE-4484-95FB-05271AE86750}]
@DACL=(02 0000)
@="GoogleUpdate CredentialDialog"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}]
@DACL=(02 0000)
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{F4C6D6E0-A8FB-4281-BE24-1662D646FE2B}]
@DACL=(02 0000)
@="Playlist Class"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{FB994D36-B312-46CE-A40B-CF63980641F9}]
@Class="REG_SZ"
@DACL=(02 0000)
@="PSFactoryBuffer"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{FBE840E5-13A5-4cff-B2A9-4D1E64A17FF2}]
@DACL=(02 0000)
@="MediaInfo Class"
.
[HKEY_USERS\S-1-5-21-1871219732-4251423289-448879728-1000_Classes\CLSID\{FD10EA6A-0D14-4AA2-A376-0C8D51CA8779}]
@DACL=(02 0000)
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2014-02-14  00:23:55
ComboFix-quarantined-files.txt  2014-02-13 23:23
.
Pre-Run: 121,144,557,568 bytes free
Post-Run: 123,432,632,320 bytes free
.
- - End Of File - - DADAC41EBE8666515A61C4221A0E30AB
5C616939100B85E558DA92B899A0FC36

schrauber · 14.02.2014, 17:40

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Rusty11 · 14.02.2014, 18:55

Alle Schritte erledigt - Logs folgen.

AdwCleaner hab ich zwei mal laufen lassen, hat auch beim zweiten mal noch mal was gefunden. Beide Logs folgen.

JRT hat nicht funktioniert. Bin genau nach Anleitung vorgegangen, aber wenn ich die .exe mit Doppelklick gestartet habe kam nur noch die Windowsabfrage, ob ich sicher bin etc., nach Bestaetigung ist dann aber nichts mehr passiert!? Sehr merkwuerdig ....

Naja, nun hier die Logs:

Malwarebytes:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.14.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Leah :: MY-COMPUTER [administrator]

14/02/2014 17:57:25
mbam-log-2014-02-14 (17-57-25).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 231467
Time elapsed: 10 minute(s), 17 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

AdwCleaner die erste:

Code:

ATTFilter

# AdwCleaner v3.018 - Report created 14/02/2014 at 18:15:24
# Updated 28/01/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Leah - MY-COMPUTER
# Running from : C:\Users\Leah\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

File Deleted : C:\Program Files\Mozilla Firefox\.autoreg

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E}
Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16533


-\\ Mozilla Firefox v26.0 (en-GB)

[ File : C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1953 octets] - [14/02/2014 18:12:03]
AdwCleaner[S0].txt - [1896 octets] - [14/02/2014 18:15:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1956 octets] ##########

und die zweite:

Code:

ATTFilter

# AdwCleaner v3.018 - Report created 14/02/2014 at 18:23:41
# Updated 28/01/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Leah - MY-COMPUTER
# Running from : C:\Users\Leah\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****


***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16533


-\\ Mozilla Firefox v26.0 (en-GB)

[ File : C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1953 octets] - [14/02/2014 18:12:03]
AdwCleaner[R1].txt - [1012 octets] - [14/02/2014 18:21:35]
AdwCleaner[S0].txt - [2036 octets] - [14/02/2014 18:15:24]
AdwCleaner[S1].txt - [935 octets] - [14/02/2014 18:23:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [994 octets] ##########

und FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by Leah (administrator) on MY-COMPUTER on 14-02-2014 18:38:48
Running from C:\Users\Leah\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(SourceForge.net) C:\Program Files\Password Safe\pwsafe.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Avira Operations GmbH & Co. KG) C:\program files\avira\antivir desktop\avcenter.exe
(Microsoft Corporation) C:\Windows\system32\WerCon.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ECenter] - C:\Dell\E-Center\EULALauncher.exe [17920 2007-05-25] ( )
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [189736 2007-11-01] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)

==================== Internet (Whitelisted) ====================

ProxyServer: proxy.dcu.ie:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default
FF DefaultSearchEngine: Bing 
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF NetworkProxy: "ftp", "proxy.dcu.ie"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "gopher", "proxy.dcu.ie"
FF NetworkProxy: "gopher_port", 8080
FF NetworkProxy: "http", "proxy.dcu.ie"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localho,t,127.0.0.1,*.local"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "proxy.dcu.ie"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "proxy.dcu.ie"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazon-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\chambers-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-en-GB.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-10]
FF Extension: Adblock Plus - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome: 
=======
CHR HomePage: hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=en-IE&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll No File
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\Leah\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Facebook Plugin) - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-02-06]
CHR Extension: (Poppit) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-02-06]
CHR Extension: (Google Wallet) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR StartMenuInternet: Google Chrome - C:\Users\Leah\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [67584 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-06-25] (Huawei Technologies Co., Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2012-01-09] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Leah\AppData\Local\Temp\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PcdrNdisuio; system32\DRIVERS\pcdrndisuio.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-14 18:38 - 2014-02-14 18:38 - 00000000 ____D () C:\Users\Leah\Downloads\FRST-OlderVersion
2014-02-14 18:37 - 2014-02-14 18:37 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT(1).exe
2014-02-14 18:33 - 2014-02-14 18:33 - 00000000 ____H () C:\Users\Leah\Documents\Default.rdp
2014-02-14 18:30 - 2014-02-14 18:30 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT.exe
2014-02-14 18:09 - 2014-02-14 18:23 - 00000000 ____D () C:\AdwCleaner
2014-02-14 18:09 - 2014-02-14 18:09 - 01166132 _____ () C:\Users\Leah\Downloads\adwcleaner.exe
2014-02-14 00:28 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 00:28 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 00:28 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 00:28 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 00:28 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 00:28 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 00:28 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 00:28 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 00:28 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 00:28 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 00:28 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-14 00:28 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 00:23 - 2014-02-14 00:23 - 00017931 _____ () C:\ComboFix.txt
2014-02-14 00:12 - 2014-02-14 00:24 - 00000000 ____D () C:\ComboFix
2014-02-14 00:12 - 2014-02-14 00:23 - 00000000 ____D () C:\Qoobox
2014-02-14 00:12 - 2014-02-14 00:22 - 00000000 ____D () C:\Windows\erdnt
2014-02-14 00:12 - 2014-02-14 00:12 - 00000000 ____D () C:\Users\Leah\Desktop\Leah
2014-02-14 00:12 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-14 00:12 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-14 00:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-14 00:10 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-14 00:06 - 2014-02-14 00:07 - 05180679 ____R (Swearware) C:\Users\Leah\Downloads\ComboFix.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 01110476 _____ () C:\Users\Leah\Downloads\7z920.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 00000000 ____D () C:\Program Files\7-Zip
2014-02-11 09:37 - 2014-02-11 09:37 - 00380416 _____ () C:\Users\Leah\Downloads\1oduesp3.exe
2014-02-11 09:29 - 2014-02-14 18:38 - 00017287 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:29 - 2014-02-11 09:33 - 00026158 _____ () C:\Users\Leah\Downloads\Addition.txt
2014-02-11 09:28 - 2014-02-14 18:38 - 01141248 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:28 - 2014-02-14 18:38 - 00000000 ____D () C:\FRST
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:33 - 2014-02-10 17:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:33 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-10 17:30 - 2014-02-10 17:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:23 - 2014-02-10 17:24 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:34 - 2013-12-09 11:37 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk

==================== One Month Modified Files and Folders =======

2014-02-14 18:39 - 2014-02-11 09:29 - 00017287 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-14 18:38 - 2014-02-14 18:38 - 00000000 ____D () C:\Users\Leah\Downloads\FRST-OlderVersion
2014-02-14 18:38 - 2014-02-11 09:28 - 01141248 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-14 18:38 - 2014-02-11 09:28 - 00000000 ____D () C:\FRST
2014-02-14 18:37 - 2014-02-14 18:37 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT(1).exe
2014-02-14 18:33 - 2014-02-14 18:33 - 00000000 ____H () C:\Users\Leah\Documents\Default.rdp
2014-02-14 18:32 - 2006-11-02 11:33 - 00703516 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-14 18:30 - 2014-02-14 18:30 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT.exe
2014-02-14 18:29 - 2008-02-24 10:32 - 01152949 _____ () C:\Windows\WindowsUpdate.log
2014-02-14 18:26 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\AppData\Local\PasswordSafe
2014-02-14 18:25 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-14 18:25 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-14 18:25 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-14 18:24 - 2008-02-24 10:33 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-14 18:24 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-14 18:23 - 2014-02-14 18:09 - 00000000 ____D () C:\AdwCleaner
2014-02-14 18:19 - 2012-08-14 20:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-14 18:15 - 2009-05-26 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-14 18:09 - 2014-02-14 18:09 - 01166132 _____ () C:\Users\Leah\Downloads\adwcleaner.exe
2014-02-14 18:07 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-14 00:44 - 2009-07-01 19:24 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
2014-02-14 00:42 - 2008-02-24 11:04 - 00219298 _____ () C:\Windows\PFRO.log
2014-02-14 00:36 - 2013-08-15 11:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 00:34 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-14 00:24 - 2014-02-14 00:12 - 00000000 ____D () C:\ComboFix
2014-02-14 00:23 - 2014-02-14 00:23 - 00017931 _____ () C:\ComboFix.txt
2014-02-14 00:23 - 2014-02-14 00:12 - 00000000 ____D () C:\Qoobox
2014-02-14 00:23 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-02-14 00:23 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-02-14 00:22 - 2014-02-14 00:12 - 00000000 ____D () C:\Windows\erdnt
2014-02-14 00:22 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-14 00:21 - 2008-03-03 01:26 - 00000000 ____D () C:\Users\Leah
2014-02-14 00:12 - 2014-02-14 00:12 - 00000000 ____D () C:\Users\Leah\Desktop\Leah
2014-02-14 00:10 - 2009-07-01 19:24 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
2014-02-14 00:07 - 2014-02-14 00:06 - 05180679 ____R (Swearware) C:\Users\Leah\Downloads\ComboFix.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 01110476 _____ () C:\Users\Leah\Downloads\7z920.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 00000000 ____D () C:\Program Files\7-Zip
2014-02-11 11:57 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Leah\Desktop\Notepad++.lnk
2014-02-11 09:37 - 2014-02-11 09:37 - 00380416 _____ () C:\Users\Leah\Downloads\1oduesp3.exe
2014-02-11 09:33 - 2014-02-11 09:29 - 00026158 _____ () C:\Users\Leah\Downloads\Addition.txt
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:31 - 2014-02-10 17:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:24 - 2014-02-10 17:23 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:50 - 2013-12-30 13:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-02-10 16:48 - 2008-07-10 15:51 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Skype
2014-02-10 16:45 - 2008-02-24 10:55 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Norton
2014-02-10 16:29 - 2011-03-19 11:51 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-10 16:22 - 2008-03-03 19:51 - 00154112 _____ () C:\Users\Leah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-10 16:02 - 2008-03-21 15:13 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Adobe
2014-02-10 16:01 - 2008-08-16 11:41 - 00000000 ____D () C:\Users\Leah\Documents\My Received Files
2014-02-10 15:58 - 2008-08-16 11:30 - 00000000 ____D () C:\Program Files\Windows Live
2014-02-10 15:57 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-10 15:56 - 2008-08-16 11:41 - 00049152 _____ () C:\Windows\DPINST.LOG
2014-02-10 15:43 - 2008-03-03 01:27 - 00060248 _____ () C:\Users\Leah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-10 15:42 - 2008-02-24 10:55 - 00000000 ____D () C:\Program Files\Google
2014-02-10 15:42 - 2006-11-02 13:47 - 00270608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-10 15:37 - 2009-11-18 15:04 - 00000000 ____D () C:\ProgramData\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Program Files\Real
2014-02-10 15:36 - 2013-08-08 19:39 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Guest\Desktop\Notepad++.lnk
2014-02-10 15:26 - 2008-02-24 10:41 - 00000000 ____D () C:\Program Files\Java
2014-02-10 15:22 - 2013-01-19 13:52 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-10 15:22 - 2008-06-12 23:00 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-10 15:16 - 2013-08-18 10:49 - 00000000 ____D () C:\Program Files\HP
2014-02-10 15:15 - 2012-06-07 16:01 - 00000000 ____D () C:\Program Files\Citrix
2014-02-10 15:15 - 2009-04-22 11:03 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Mozilla
2014-02-10 15:15 - 2008-03-03 01:27 - 00000000 ____D () C:\Users\Leah\AppData\Local\Google
2014-02-10 15:09 - 2006-11-02 11:23 - 00000144 _____ () C:\Windows\win.ini
2014-02-10 15:06 - 2008-02-24 10:43 - 00000000 ____D () C:\Program Files\Dell
2014-02-07 14:20 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\Documents\My Safes
2014-02-07 12:41 - 2012-08-14 20:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-07 12:41 - 2012-08-14 20:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 17:10 - 2010-12-14 00:50 - 00002082 _____ () C:\Users\Leah\Desktop\Google Chrome.lnk
2014-02-05 16:19 - 2012-05-22 11:44 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-05 15:58 - 2008-09-09 08:18 - 00005648 _____ () C:\Users\Leah\AppData\Local\d3d9caps.dat
2014-02-05 09:58 - 2014-02-14 00:28 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-14 00:28 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-14 00:28 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-14 00:28 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-14 00:28 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-14 00:28 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-14 00:28 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-14 00:28 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-14 00:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-14 00:28 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-14 00:28 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-14 00:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-03 21:34 - 2010-12-13 23:13 - 00000000 ____D () C:\ProgramData\PCDr
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
2014-02-03 20:44 - 2006-11-02 13:52 - 00235301 _____ () C:\Windows\setupact.log
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ___RD () C:\Program Files\Skype
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ____D () C:\ProgramData\Skype
2014-01-17 18:59 - 2008-02-24 10:52 - 00000000 ____D () C:\ProgramData\Microsoft Help

Some content of TEMP:
====================
C:\Users\Leah\AppData\Local\Temp\avgnt.exe
C:\Users\Leah\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-14 18:32

==================== End Of Log ============================

--- --- ---

Viele Gruesse und Dank wie immer!

schrauber · 15.02.2014, 17:55

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Rusty11 · 15.02.2014, 20:34

Hi,
bin durch. Jetzt lief auch der JRT - war wohl gestern muede ....
Alle Logs folgen.
Viele Gruesse! Und hoffentlich noch ein netter Samstag Abend!

JRT:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.1 (02.04.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Leah on 15/02/2014 at 18:17:31.57
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Leah\AppData\Roaming\mozilla\firefox\profiles\iteqiltt.default\minidumps [7 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 15/02/2014 at 18:20:13.90
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

ESET mit einem Fund:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f01716f013d91a48bf108745a9a56967
# engine=17087
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-02-15 06:43:31
# local_time=2014-02-15 07:43:31 (+0100, W. Europe Standard Time)
# country="Ireland"
# lang=1033
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode=1799 16775165 100 95 9152 5907973 1904 0
# compatibility_mode=5892 16776574 100 100 5027 230022539 0 0
# scanned=175696
# found=1
# cleaned=0
# scan_time=4298
sh=B13687C772CD76876EE1A62F57F94D56B71FB714 ft=1 fh=79dee609110b3c5c vn="Win32/Adware.WhenUSave application" ac=I fn="C:\Program Files\DAEMON Tools Lite\uninst.exe"

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.79  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Firewall Enabled!  
 WMI entry may not exist for antivirus; attempting automatic update. 
 Avira successfully updated! 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Adobe Flash Player 	12.0.0.44  
 Adobe Reader 10.1.9 Adobe Reader out of Date!  
 Mozilla Firefox (26.0) 
 Google Chrome 32.0.1700.102  
 Google Chrome 32.0.1700.107  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 system32 FirewallControlPanel.exe   
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C: 1 % 
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by Leah (administrator) on MY-COMPUTER on 15-02-2014 20:18:18
Running from C:\Users\Leah\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(SourceForge.net) C:\Program Files\Password Safe\pwsafe.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\FirewallControlPanel.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ECenter] - C:\Dell\E-Center\EULALauncher.exe [17920 2007-05-25] ( )
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [189736 2007-11-01] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)

==================== Internet (Whitelisted) ====================

ProxyServer: proxy.dcu.ie:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default
FF DefaultSearchEngine: Bing 
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF NetworkProxy: "ftp", "proxy.dcu.ie"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "gopher", "proxy.dcu.ie"
FF NetworkProxy: "gopher_port", 8080
FF NetworkProxy: "http", "proxy.dcu.ie"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localho,t,127.0.0.1,*.local"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "proxy.dcu.ie"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "proxy.dcu.ie"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazon-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\chambers-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-en-GB.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-10]
FF Extension: Adblock Plus - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome: 
=======
CHR HomePage: hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=en-IE&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll No File
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\Leah\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Facebook Plugin) - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-02-06]
CHR Extension: (Poppit) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-02-06]
CHR Extension: (Google Wallet) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR StartMenuInternet: Google Chrome - C:\Users\Leah\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [67584 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-06-25] (Huawei Technologies Co., Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2012-01-09] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Leah\AppData\Local\Temp\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PcdrNdisuio; system32\DRIVERS\pcdrndisuio.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-15 20:10 - 2014-02-15 20:10 - 00987425 _____ () C:\Users\Leah\Downloads\SecurityCheck.exe
2014-02-15 18:27 - 2014-02-15 18:27 - 02347384 _____ (ESET) C:\Users\Leah\Downloads\esetsmartinstaller_enu.exe
2014-02-15 18:20 - 2014-02-15 18:20 - 00000763 _____ () C:\Users\Leah\Desktop\JRT.txt
2014-02-15 18:17 - 2014-02-15 18:17 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 18:38 - 2014-02-14 18:38 - 00000000 ____D () C:\Users\Leah\Downloads\FRST-OlderVersion
2014-02-14 18:37 - 2014-02-14 18:37 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT(1).exe
2014-02-14 18:33 - 2014-02-14 18:33 - 00000000 ____H () C:\Users\Leah\Documents\Default.rdp
2014-02-14 18:30 - 2014-02-14 18:30 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT.exe
2014-02-14 18:09 - 2014-02-14 18:23 - 00000000 ____D () C:\AdwCleaner
2014-02-14 18:09 - 2014-02-14 18:09 - 01166132 _____ () C:\Users\Leah\Downloads\adwcleaner.exe
2014-02-14 00:28 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 00:28 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 00:28 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 00:28 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 00:28 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 00:28 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 00:28 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 00:28 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 00:28 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 00:28 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 00:28 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-14 00:28 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 00:23 - 2014-02-14 00:23 - 00017931 _____ () C:\ComboFix.txt
2014-02-14 00:12 - 2014-02-14 00:24 - 00000000 ____D () C:\ComboFix
2014-02-14 00:12 - 2014-02-14 00:23 - 00000000 ____D () C:\Qoobox
2014-02-14 00:12 - 2014-02-14 00:22 - 00000000 ____D () C:\Windows\erdnt
2014-02-14 00:12 - 2014-02-14 00:12 - 00000000 ____D () C:\Users\Leah\Desktop\Leah
2014-02-14 00:12 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-02-14 00:12 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-02-14 00:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2014-02-14 00:12 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2014-02-14 00:10 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-14 00:06 - 2014-02-14 00:07 - 05180679 ____R (Swearware) C:\Users\Leah\Downloads\ComboFix.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 01110476 _____ () C:\Users\Leah\Downloads\7z920.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 00000000 ____D () C:\Program Files\7-Zip
2014-02-11 09:37 - 2014-02-11 09:37 - 00380416 _____ () C:\Users\Leah\Downloads\1oduesp3.exe
2014-02-11 09:29 - 2014-02-15 20:18 - 00017199 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:29 - 2014-02-11 09:33 - 00026158 _____ () C:\Users\Leah\Downloads\Addition.txt
2014-02-11 09:28 - 2014-02-15 20:18 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-14 18:38 - 01141248 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:33 - 2014-02-10 17:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:33 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-10 17:30 - 2014-02-10 17:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:23 - 2014-02-10 17:24 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:34 - 2013-12-09 11:37 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk

==================== One Month Modified Files and Folders =======

2014-02-15 20:19 - 2014-02-11 09:29 - 00017199 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-15 20:19 - 2012-08-14 20:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-15 20:18 - 2014-02-11 09:28 - 00000000 ____D () C:\FRST
2014-02-15 20:10 - 2014-02-15 20:10 - 00987425 _____ () C:\Users\Leah\Downloads\SecurityCheck.exe
2014-02-15 20:10 - 2008-02-24 10:32 - 01209431 _____ () C:\Windows\WindowsUpdate.log
2014-02-15 19:44 - 2009-07-01 19:24 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
2014-02-15 19:06 - 2013-12-30 13:46 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-15 19:06 - 2009-05-26 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-15 18:43 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-15 18:30 - 2006-11-02 11:33 - 00703516 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-15 18:27 - 2014-02-15 18:27 - 02347384 _____ (ESET) C:\Users\Leah\Downloads\esetsmartinstaller_enu.exe
2014-02-15 18:23 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\AppData\Local\PasswordSafe
2014-02-15 18:23 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-15 18:23 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-15 18:23 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-15 18:22 - 2008-02-24 10:33 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-15 18:22 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-15 18:21 - 2009-07-01 19:24 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
2014-02-15 18:20 - 2014-02-15 18:20 - 00000763 _____ () C:\Users\Leah\Desktop\JRT.txt
2014-02-15 18:17 - 2014-02-15 18:17 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 18:38 - 2014-02-14 18:38 - 00000000 ____D () C:\Users\Leah\Downloads\FRST-OlderVersion
2014-02-14 18:38 - 2014-02-11 09:28 - 01141248 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-14 18:37 - 2014-02-14 18:37 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT(1).exe
2014-02-14 18:33 - 2014-02-14 18:33 - 00000000 ____H () C:\Users\Leah\Documents\Default.rdp
2014-02-14 18:30 - 2014-02-14 18:30 - 01037530 _____ (Thisisu) C:\Users\Leah\Downloads\JRT.exe
2014-02-14 18:23 - 2014-02-14 18:09 - 00000000 ____D () C:\AdwCleaner
2014-02-14 18:09 - 2014-02-14 18:09 - 01166132 _____ () C:\Users\Leah\Downloads\adwcleaner.exe
2014-02-14 00:42 - 2008-02-24 11:04 - 00219298 _____ () C:\Windows\PFRO.log
2014-02-14 00:36 - 2013-08-15 11:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 00:34 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-14 00:24 - 2014-02-14 00:12 - 00000000 ____D () C:\ComboFix
2014-02-14 00:23 - 2014-02-14 00:23 - 00017931 _____ () C:\ComboFix.txt
2014-02-14 00:23 - 2014-02-14 00:12 - 00000000 ____D () C:\Qoobox
2014-02-14 00:23 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-02-14 00:23 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-02-14 00:22 - 2014-02-14 00:12 - 00000000 ____D () C:\Windows\erdnt
2014-02-14 00:22 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-14 00:21 - 2008-03-03 01:26 - 00000000 ____D () C:\Users\Leah
2014-02-14 00:12 - 2014-02-14 00:12 - 00000000 ____D () C:\Users\Leah\Desktop\Leah
2014-02-14 00:07 - 2014-02-14 00:06 - 05180679 ____R (Swearware) C:\Users\Leah\Downloads\ComboFix.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 01110476 _____ () C:\Users\Leah\Downloads\7z920.exe
2014-02-12 19:18 - 2014-02-12 19:18 - 00000000 ____D () C:\Program Files\7-Zip
2014-02-11 11:57 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Leah\Desktop\Notepad++.lnk
2014-02-11 09:37 - 2014-02-11 09:37 - 00380416 _____ () C:\Users\Leah\Downloads\1oduesp3.exe
2014-02-11 09:33 - 2014-02-11 09:29 - 00026158 _____ () C:\Users\Leah\Downloads\Addition.txt
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:31 - 2014-02-10 17:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:24 - 2014-02-10 17:23 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:50 - 2013-12-30 13:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-02-10 16:48 - 2008-07-10 15:51 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Skype
2014-02-10 16:45 - 2008-02-24 10:55 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Norton
2014-02-10 16:29 - 2011-03-19 11:51 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-10 16:22 - 2008-03-03 19:51 - 00154112 _____ () C:\Users\Leah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-10 16:02 - 2008-03-21 15:13 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Adobe
2014-02-10 16:01 - 2008-08-16 11:41 - 00000000 ____D () C:\Users\Leah\Documents\My Received Files
2014-02-10 15:58 - 2008-08-16 11:30 - 00000000 ____D () C:\Program Files\Windows Live
2014-02-10 15:57 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-10 15:56 - 2008-08-16 11:41 - 00049152 _____ () C:\Windows\DPINST.LOG
2014-02-10 15:43 - 2008-03-03 01:27 - 00060248 _____ () C:\Users\Leah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-10 15:42 - 2008-02-24 10:55 - 00000000 ____D () C:\Program Files\Google
2014-02-10 15:42 - 2006-11-02 13:47 - 00270608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-10 15:37 - 2009-11-18 15:04 - 00000000 ____D () C:\ProgramData\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Program Files\Real
2014-02-10 15:36 - 2013-08-08 19:39 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Guest\Desktop\Notepad++.lnk
2014-02-10 15:26 - 2008-02-24 10:41 - 00000000 ____D () C:\Program Files\Java
2014-02-10 15:22 - 2013-01-19 13:52 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-10 15:22 - 2008-06-12 23:00 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-10 15:16 - 2013-08-18 10:49 - 00000000 ____D () C:\Program Files\HP
2014-02-10 15:15 - 2012-06-07 16:01 - 00000000 ____D () C:\Program Files\Citrix
2014-02-10 15:15 - 2009-04-22 11:03 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Mozilla
2014-02-10 15:15 - 2008-03-03 01:27 - 00000000 ____D () C:\Users\Leah\AppData\Local\Google
2014-02-10 15:09 - 2006-11-02 11:23 - 00000144 _____ () C:\Windows\win.ini
2014-02-10 15:06 - 2008-02-24 10:43 - 00000000 ____D () C:\Program Files\Dell
2014-02-07 14:20 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\Documents\My Safes
2014-02-07 12:41 - 2012-08-14 20:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-07 12:41 - 2012-08-14 20:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 17:10 - 2010-12-14 00:50 - 00002082 _____ () C:\Users\Leah\Desktop\Google Chrome.lnk
2014-02-05 16:19 - 2012-05-22 11:44 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-05 15:58 - 2008-09-09 08:18 - 00005648 _____ () C:\Users\Leah\AppData\Local\d3d9caps.dat
2014-02-05 09:58 - 2014-02-14 00:28 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-14 00:28 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-14 00:28 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-14 00:28 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-14 00:28 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-14 00:28 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-14 00:28 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-14 00:28 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-14 00:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-14 00:28 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-14 00:28 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-14 00:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-03 21:34 - 2010-12-13 23:13 - 00000000 ____D () C:\ProgramData\PCDr
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
2014-02-03 20:44 - 2006-11-02 13:52 - 00235301 _____ () C:\Windows\setupact.log
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ___RD () C:\Program Files\Skype
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ____D () C:\ProgramData\Skype
2014-01-17 18:59 - 2008-02-24 10:52 - 00000000 ____D () C:\ProgramData\Microsoft Help

Some content of TEMP:
====================
C:\Users\Leah\AppData\Local\Temp\avgnt.exe
C:\Users\Leah\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-15 18:29

==================== End Of Log ============================

--- --- ---

schrauber · 16.02.2014, 08:11

Adobe updaten.

Zitat:

Und hoffentlich noch ein netter Samstag Abend!

Naja, Samstag nachmittag nach 2h Auto vom Aussendienst zurück gekommen, schnell paar Themen beantworten, frische Sachen eintüten, meine 3 Laptops, und heute um 16 UHr wieder Abfahrt auf Aussendienst für ne woche

Fertig

Die Reihenfolge ist hier entscheidend.

Falls Defogger benutzt wurde: Defogger nochmal starten und auf re-enable klicken.
Falls Combofix benutzt wurde: (Alternativ in uninstall.exe umbenennen und starten)
- Windowstaste + R > Combofix /Uninstall (eingeben) > OK
- Alternative: Combofix.exe in uninstall.exe umbenennen und starten
- Combofix wird jetzt starten, sich evtl updaten und dann alle Reste von sich selbst entfernen.
Downloade Dir bitte auf jeden Fall DelFix auf deinen Desktop:
- Schließe alle offenen Programme.
- Starte die delfix.exe mit einem Doppelklick.
- Setze vor jede Funktion ein Häkchen.
- Klicke auf Start.
- Hinweis: DelFix entfernt u. a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
- Starte deinen Rechner abschließend neu.
Sollten jetzt noch Programme aus unserer Bereinigung übrig sein kannst du sie bedenkenlos löschen.

Falls Du Lob oder Kritik abgeben möchtest kannst Du das hier tun

Hier noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.

Bitte überprüfe ob dein System Windows Updates automatisch herunter lädt
Windows Updates
- Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
- Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
Gehe sicher das die automatischen Updates aktiviert sind.
Software Updates
Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
Um deine Installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.

Anti- Viren Software

Gehe sicher immer eine Anti Viren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date sind.

Zusätzlicher Schutz

MalwareBytes Anti Malware
Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demond Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
Ein Tutorial zur Verwendung findest Du hier.
WinPatrol
Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.

Sicheres Browsen

SpywareBlaster
Eine kurze Einführung findest du Hier
MVPs hosts file
Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
WOT (Web of trust)
Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.

Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.

Opera
Mozilla Firefox.
- Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
- NoScript
  Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
- AdblockPlus
  Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
  Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )

Don'ts

Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe

Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Rusty11 · 16.02.2014, 17:48

Verdammter Mist - jetzt hab ich mich gefreut, weil ich dachte wir sind durch. War noch bei den letzten Aufraeumarbeiten, delfix war schon gelaufen und ich habe dann noch Secunia PSI installiert.
Der Scan mit Secunia hat ergeben, dass eine Software namens Daemon Tools Lite 4.x ein Update braucht. Also bin ich dem Link ueber Secunia gefolgt. Nach dem Download der .exe und Start derselben gab es die Option, das Programm auf neue Version zu bringen oder zu deinstallieren. Hier hab ich mich fuer deinstallieren entschieden und sofort von Avira mehrere Meldungen bekommen:

Code:

ATTFilter

Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nsz6F76.tmp\UninstHlp.dll.
Action performed: Deny access

Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nsz6F76.tmp\UninstHlp.dll.
Action performed: Transfer to Scanner

Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nsz6F76.tmp\UninstHlp.dll.
Action performed: Deny access

Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nsjBFC6.tmp\UninstHlp.dll.
Action performed: Deny access

Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nsjBFC6.tmp\UninstHlp.dll.
Action performed: Deny access

Scan completed [The scan has been done completely.].
 Number of files:		637
 Number of directories:	0
 Number of malware:	0
 Number of warnings:	0
 
Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nse225F.tmp\UninstHlp.dll.
Action performed: Deny access

Virus or unwanted program 'ADWARE/Adware.Gen [adware]'
detected in file 'C:\Users\Leah\AppData\Local\Temp\nse225F.tmp\UninstHlp.dll.
Action performed: Deny access

Scan completed [The scan has been done completely.].
 Number of files:		655
 Number of directories:	0
 Number of malware:	0
 Number of warnings:	0

Das Programm, um das es hier geht, kann ich in den Programmen in der Systemsteuerung nicht finden. Es erscheint ausschliesslich in der Startliste und es gibt einen entsprechenden Ordner in den Programmen. Der Programmordner zu dieser Software ist von 2012 - liegt da also schon ewig rum.
Mir ist dann jetzt auch noch ein weiteres Programm namens HandBrake aufgefallen - auch hier kein Eintrag in der Systemsteuerung, UND ich kann auch keinen Ordner in den Programmen finden.

Habe jetzt Avira nochmal einen kompletten Scan durchfuehren lassen. Hier das Log:

Code:

ATTFilter

Avira Free Antivirus
Report file date: 16 February 2014  15:29


The program is running as an unrestricted full version.
Online services are available.

Licensee        : Avira Antivirus Free
Serial number   : 0000149996-AVHOE-0000001
Platform        : Windows Vista (TM) Home Premium
Windows version : (Service Pack 2)  [6.0.6002]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : MY-COMPUTER

Version information:
BUILD.DAT       : 14.0.2.286     55547 Bytes  09/12/2013 11:37:00
AVSCAN.EXE      : 14.0.2.254   1032760 Bytes  09/12/2013 10:37:19
AVSCANRC.DLL    : 14.0.2.180     52280 Bytes  09/12/2013 10:37:19
LUKE.DLL        : 14.0.2.234     65592 Bytes  09/12/2013 10:37:20
AVSCPLR.DLL     : 14.0.2.254    124472 Bytes  09/12/2013 10:37:19
AVREG.DLL       : 14.0.2.212    250424 Bytes  09/12/2013 10:37:19
avlode.dll      : 14.0.2.254    540216 Bytes  09/12/2013 10:37:19
avlode.rdf      : 14.0.3.26      58589 Bytes  11/02/2014 15:10:33
VBASE000.VDF    : 7.11.70.0   66736640 Bytes  04/04/2013 10:37:22
VBASE001.VDF    : 7.11.74.226  2201600 Bytes  30/04/2013 10:37:22
VBASE002.VDF    : 7.11.80.60   2751488 Bytes  28/05/2013 10:37:22
VBASE003.VDF    : 7.11.85.214  2162688 Bytes  21/06/2013 10:37:22
VBASE004.VDF    : 7.11.91.176  3903488 Bytes  23/07/2013 10:37:22
VBASE005.VDF    : 7.11.98.186  6822912 Bytes  29/08/2013 10:37:22
VBASE006.VDF    : 7.11.103.230  2293248 Bytes  24/09/2013 10:37:22
VBASE007.VDF    : 7.11.116.38  5485568 Bytes  28/11/2013 10:37:22
VBASE008.VDF    : 7.11.126.50  3615744 Bytes  22/01/2014 15:36:36
VBASE009.VDF    : 7.11.128.174  2030080 Bytes  03/02/2014 15:36:37
VBASE010.VDF    : 7.11.128.175     2048 Bytes  03/02/2014 15:36:37
VBASE011.VDF    : 7.11.128.176     2048 Bytes  03/02/2014 15:36:37
VBASE012.VDF    : 7.11.128.177     2048 Bytes  03/02/2014 15:36:37
VBASE013.VDF    : 7.11.128.178     2048 Bytes  03/02/2014 15:36:37
VBASE014.VDF    : 7.11.129.9    211456 Bytes  04/02/2014 15:36:37
VBASE015.VDF    : 7.11.129.163   215040 Bytes  06/02/2014 15:36:38
VBASE016.VDF    : 7.11.130.21   220672 Bytes  08/02/2014 15:36:38
VBASE017.VDF    : 7.11.130.99   230400 Bytes  10/02/2014 15:36:38
VBASE018.VDF    : 7.11.130.193   195072 Bytes  11/02/2014 15:10:30
VBASE019.VDF    : 7.11.131.53   285184 Bytes  13/02/2014 23:03:01
VBASE020.VDF    : 7.11.131.125   154624 Bytes  14/02/2014 16:55:25
VBASE021.VDF    : 7.11.131.201   194560 Bytes  15/02/2014 17:10:58
VBASE022.VDF    : 7.11.131.202     2048 Bytes  15/02/2014 17:10:58
VBASE023.VDF    : 7.11.131.203     2048 Bytes  15/02/2014 17:10:58
VBASE024.VDF    : 7.11.131.204     2048 Bytes  15/02/2014 17:10:58
VBASE025.VDF    : 7.11.131.205     2048 Bytes  15/02/2014 17:10:59
VBASE026.VDF    : 7.11.131.206     2048 Bytes  15/02/2014 17:10:59
VBASE027.VDF    : 7.11.131.207     2048 Bytes  15/02/2014 17:10:59
VBASE028.VDF    : 7.11.131.208     2048 Bytes  15/02/2014 17:10:59
VBASE029.VDF    : 7.11.131.209     2048 Bytes  15/02/2014 17:10:59
VBASE030.VDF    : 7.11.131.210     2048 Bytes  15/02/2014 17:10:59
VBASE031.VDF    : 7.11.131.246   180736 Bytes  16/02/2014 13:30:13
Engine version  : 8.2.14.10 
AEVDF.DLL       : 8.1.3.4       102774 Bytes  09/12/2013 10:37:18
AESCRIPT.DLL    : 8.1.4.190     516478 Bytes  13/02/2014 23:03:04
AESCN.DLL       : 8.1.10.6      131447 Bytes  10/02/2014 15:36:41
AESBX.DLL       : 8.2.20.6     1331575 Bytes  10/02/2014 15:36:42
AERDL.DLL       : 8.2.0.138     704888 Bytes  09/12/2013 10:37:18
AEPACK.DLL      : 8.4.0.0       774520 Bytes  11/02/2014 15:10:33
AEOFFICE.DLL    : 8.1.2.80      205181 Bytes  11/02/2014 15:10:33
AEHEUR.DLL      : 8.1.4.918    6484346 Bytes  13/02/2014 23:03:04
AEHELP.DLL      : 8.1.27.10     266618 Bytes  09/12/2013 10:37:18
AEGEN.DLL       : 8.1.7.22      446839 Bytes  10/02/2014 15:36:39
AEEXP.DLL       : 8.4.1.204     434552 Bytes  11/02/2014 15:10:33
AEEMU.DLL       : 8.1.3.2       393587 Bytes  09/12/2013 10:37:18
AECORE.DLL      : 8.1.35.0      229753 Bytes  11/02/2014 15:10:31
AEBB.DLL        : 8.1.1.4        53619 Bytes  09/12/2013 10:37:18
AVWINLL.DLL     : 14.0.2.180     23608 Bytes  09/12/2013 10:37:19
AVPREF.DLL      : 14.0.2.180     48696 Bytes  09/12/2013 10:37:19
AVREP.DLL       : 14.0.2.180    175672 Bytes  09/12/2013 10:37:19
AVARKT.DLL      : 14.0.2.254    256056 Bytes  09/12/2013 10:37:18
AVEVTLOG.DLL    : 14.0.2.180    165944 Bytes  09/12/2013 10:37:18
SQLITE3.DLL     : 3.7.0.1       394808 Bytes  09/12/2013 10:37:21
AVSMTP.DLL      : 14.0.2.180     60472 Bytes  09/12/2013 10:37:19
NETNT.DLL       : 14.0.2.180     13368 Bytes  09/12/2013 10:37:20
RCIMAGE.DLL     : 14.0.2.180   4788792 Bytes  09/12/2013 10:37:21
RCTEXT.DLL      : 14.0.2.236     72760 Bytes  09/12/2013 10:37:21

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\program files\avira\antivir desktop\sysscan.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, 
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: extended

Start of the scan: 16 February 2014  15:29

Start scanning boot sectors:
Boot sector 'HDD0(C:, D:)'
    [INFO]      No virus was found!

Starting search for hidden objects.
Hidden driver
  [NOTE]      A memory modification has been detected, which could potentially be used to hide file access attempts.

The scan of running processes will be started:
Scan process 'PresentationFontCache.exe' - '30' Module(s) have been scanned
Scan process 'pcdrcui.exe' - '264' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'vssvc.exe' - '49' Module(s) have been scanned
Scan process 'avscan.exe' - '106' Module(s) have been scanned
Scan process 'avscan.exe' - '47' Module(s) have been scanned
Scan process 'notepad++.exe' - '63' Module(s) have been scanned
Scan process 'avcenter.exe' - '115' Module(s) have been scanned
Scan process 'taskeng.exe' - '55' Module(s) have been scanned
Scan process 'sua.exe' - '21' Module(s) have been scanned
Scan process 'PSI_TRAY.exe' - '32' Module(s) have been scanned
Scan process 'PSIA.exe' - '77' Module(s) have been scanned
Scan process 'conime.exe' - '16' Module(s) have been scanned
Scan process 'firefox.exe' - '120' Module(s) have been scanned
Scan process 'svchost.exe' - '21' Module(s) have been scanned
Scan process 'taskeng.exe' - '49' Module(s) have been scanned
Scan process 'Apntex.exe' - '20' Module(s) have been scanned
Scan process 'HidFind.exe' - '23' Module(s) have been scanned
Scan process 'ApMsgFwd.exe' - '16' Module(s) have been scanned
Scan process 'avshadow.exe' - '33' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '34' Module(s) have been scanned
Scan process 'xaudio.exe' - '14' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '63' Module(s) have been scanned
Scan process 'svchost.exe' - '7' Module(s) have been scanned
Scan process 'svchost.exe' - '44' Module(s) have been scanned
Scan process 'STacSV.exe' - '35' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '25' Module(s) have been scanned
Scan process 'SeaPort.exe' - '57' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '42' Module(s) have been scanned
Scan process 'Iaantmon.exe' - '36' Module(s) have been scanned
Scan process 'EvtEng.exe' - '88' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'avguard.exe' - '97' Module(s) have been scanned
Scan process 'aestsrv.exe' - '5' Module(s) have been scanned
Scan process 'armsvc.exe' - '24' Module(s) have been scanned
Scan process 'pwsafe.exe' - '43' Module(s) have been scanned
Scan process 'ONENOTEM.EXE' - '18' Module(s) have been scanned
Scan process 'quickset.exe' - '80' Module(s) have been scanned
Scan process 'DLG.exe' - '22' Module(s) have been scanned
Scan process 'BTTray.exe' - '54' Module(s) have been scanned
Scan process 'daemon.exe' - '47' Module(s) have been scanned
Scan process 'ehtray.exe' - '25' Module(s) have been scanned
Scan process 'avgnt.exe' - '81' Module(s) have been scanned
Scan process 'sttray.exe' - '36' Module(s) have been scanned
Scan process 'hpwuschd2.exe' - '16' Module(s) have been scanned
Scan process 'PCMService.exe' - '54' Module(s) have been scanned
Scan process 'IAAnotif.exe' - '38' Module(s) have been scanned
Scan process 'igfxpers.exe' - '20' Module(s) have been scanned
Scan process 'hkcmd.exe' - '23' Module(s) have been scanned
Scan process 'OEM02Mon.exe' - '30' Module(s) have been scanned
Scan process 'Apoint.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '58' Module(s) have been scanned
Scan process 'sched.exe' - '59' Module(s) have been scanned
Scan process 'taskeng.exe' - '83' Module(s) have been scanned
Scan process 'spoolsv.exe' - '90' Module(s) have been scanned
Scan process 'WLANExt.exe' - '92' Module(s) have been scanned
Scan process 'Explorer.EXE' - '157' Module(s) have been scanned
Scan process 'Dwm.exe' - '31' Module(s) have been scanned
Scan process 'svchost.exe' - '94' Module(s) have been scanned
Scan process 'svchost.exe' - '80' Module(s) have been scanned
Scan process 'SLsvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '37' Module(s) have been scanned
Scan process 'svchost.exe' - '157' Module(s) have been scanned
Scan process 'svchost.exe' - '111' Module(s) have been scanned
Scan process 'svchost.exe' - '64' Module(s) have been scanned
Scan process 'svchost.exe' - '33' Module(s) have been scanned
Scan process 'svchost.exe' - '40' Module(s) have been scanned
Scan process 'winlogon.exe' - '30' Module(s) have been scanned
Scan process 'lsm.exe' - '22' Module(s) have been scanned
Scan process 'lsass.exe' - '60' Module(s) have been scanned
Scan process 'services.exe' - '33' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'wininit.exe' - '26' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting to scan executable files (registry):
The registry was scanned ( '1818' files ).


Starting the file scan:

Begin scan in 'C:\' <OS>
Begin scan in 'D:\' <RECOVERY>


End of the scan: 16 February 2014  17:08
Used time:  1:38:31 Hour(s)

The scan has been done completely.

  27636 Scanned directories
 323454 Files were scanned
      0 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 Files were deleted
      0 Viruses and unwanted programs were repaired
      0 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
 323454 Files not concerned
   2939 Archives were scanned
      0 Warnings
      1 Notes
 644728 Objects were scanned with rootkit scan
      1 Hidden objects were found

Was nun? Alles noch mal von vorne?

Hier auf jeden Fall noch mal aktuelles FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 12-02-2014 01
Ran by Leah (administrator) on MY-COMPUTER on 16-02-2014 17:51:03
Running from C:\Users\Leah\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(DT Soft Ltd) C:\Program Files\DAEMON Tools Lite\daemon.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(SourceForge.net) C:\Program Files\Password Safe\pwsafe.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Secunia) C:\Program Files\Secunia\PSI\PSIA.exe
(Secunia) C:\Program Files\Secunia\PSI\PSI_TRAY.exe
(Secunia) C:\Program Files\Secunia\PSI\sua.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ECenter] - C:\Dell\E-Center\EULALauncher.exe [17920 2007-05-25] ( )
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [189736 2007-11-01] (CyberLink Corp.)
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files\DAEMON Tools Lite\daemon.exe [486856 2008-07-08] (DT Soft Ltd)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)

==================== Internet (Whitelisted) ====================

ProxyServer: proxy.dcu.ie:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default
FF DefaultSearchEngine: Bing 
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: https://accounts.google.com/ServiceLogin?service=mail&continue=https://mail.google.com/mail/
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF NetworkProxy: "ftp", "proxy.dcu.ie"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "gopher", "proxy.dcu.ie"
FF NetworkProxy: "gopher_port", 8080
FF NetworkProxy: "http", "proxy.dcu.ie"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localho,t,127.0.0.1,*.local"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "proxy.dcu.ie"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "proxy.dcu.ie"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazon-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\chambers-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-en-GB.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-10]
FF Extension: Adblock Plus - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome: 
=======
CHR HomePage: hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=en-IE&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll No File
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\Leah\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Facebook Plugin) - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-02-06]
CHR Extension: (Poppit) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-02-06]
CHR Extension: (Google Wallet) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR StartMenuInternet: Google Chrome - C:\Users\Leah\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 Secunia PSI Agent; C:\Program Files\Secunia\PSI\PSIA.exe [1229528 2013-12-06] (Secunia)
R2 Secunia Update Agent; C:\Program Files\Secunia\PSI\sua.exe [662232 2013-12-06] (Secunia)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [67584 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-06-25] (Huawei Technologies Co., Ltd.)
R3 PSI; C:\Windows\System32\DRIVERS\psi_mf_x86.sys [16024 2013-12-06] (Secunia)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2012-01-09] ()
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
U3 ar2h66sn; C:\Windows\system32\Drivers\ar2h66sn.sys [0 ] (Microsoft Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 catchme; \??\C:\Users\Leah\AppData\Local\Temp\catchme.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PcdrNdisuio; system32\DRIVERS\pcdrndisuio.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-16 17:51 - 2014-02-16 17:51 - 00017929 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-16 17:50 - 2014-02-16 17:51 - 00000000 ____D () C:\FRST
2014-02-16 17:50 - 2014-02-16 17:50 - 01141248 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-16 15:15 - 2014-02-16 15:15 - 13485616 _____ (Disc Soft Ltd) C:\Users\Leah\Downloads\DTLite4481-0347.exe
2014-02-16 15:15 - 2014-02-16 15:15 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-02-16 15:01 - 2014-02-16 15:01 - 00000000 ____D () C:\Users\Leah\AppData\Local\Secunia PSI
2014-02-16 15:01 - 2014-02-16 15:01 - 00000000 ____D () C:\Program Files\Secunia
2014-02-16 15:00 - 2014-02-16 15:00 - 05329480 _____ (Secunia) C:\Users\Leah\Downloads\PSISetup(1).exe
2014-02-16 15:00 - 2014-02-16 15:00 - 02581656 _____ (Secunia) C:\Users\Leah\Downloads\PSISetup.exe
2014-02-16 14:45 - 2014-02-16 14:50 - 00003426 _____ () C:\DelFix.txt
2014-02-16 14:41 - 2014-02-16 14:43 - 00000000 ___SD () C:\32788R22FWJFW
2014-02-15 19:06 - 2014-02-15 19:06 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-15 18:17 - 2014-02-16 14:45 - 00000000 ____D () C:\Windows\ERUNT
2014-02-14 18:33 - 2014-02-14 18:33 - 00000000 ____H () C:\Users\Leah\Documents\Default.rdp
2014-02-14 00:28 - 2014-02-05 09:58 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-14 00:28 - 2014-02-05 09:56 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-14 00:28 - 2014-02-05 09:53 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-14 00:28 - 2014-02-05 09:51 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-14 00:28 - 2014-02-05 09:50 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-14 00:28 - 2014-02-05 09:49 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-14 00:28 - 2014-02-05 09:49 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-14 00:28 - 2014-02-05 09:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-14 00:28 - 2014-02-05 09:48 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-14 00:28 - 2014-02-05 09:47 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-14 00:28 - 2014-02-05 09:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-14 00:28 - 2014-02-05 09:47 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-14 00:28 - 2014-02-05 09:46 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-14 00:12 - 2014-02-16 14:43 - 00000000 ____D () C:\Windows\erdnt
2014-02-14 00:12 - 2014-02-14 00:12 - 00000000 ____D () C:\Users\Leah\Desktop\Leah
2014-02-14 00:10 - 2013-12-05 03:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-12 19:18 - 2014-02-12 19:18 - 00000000 ____D () C:\Program Files\7-Zip
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:33 - 2014-02-10 17:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:33 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-10 17:23 - 2014-02-10 17:24 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:34 - 2013-12-09 11:37 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk

==================== One Month Modified Files and Folders =======

2014-02-16 17:51 - 2014-02-16 17:51 - 00017929 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-16 17:51 - 2014-02-16 17:50 - 00000000 ____D () C:\FRST
2014-02-16 17:50 - 2014-02-16 17:50 - 01141248 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-16 17:44 - 2009-07-01 19:24 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
2014-02-16 17:33 - 2008-02-24 10:32 - 01259295 _____ () C:\Windows\WindowsUpdate.log
2014-02-16 17:19 - 2012-08-14 20:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-16 16:51 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-16 16:51 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-16 15:15 - 2014-02-16 15:15 - 13485616 _____ (Disc Soft Ltd) C:\Users\Leah\Downloads\DTLite4481-0347.exe
2014-02-16 15:15 - 2014-02-16 15:15 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite
2014-02-16 15:01 - 2014-02-16 15:01 - 00000000 ____D () C:\Users\Leah\AppData\Local\Secunia PSI
2014-02-16 15:01 - 2014-02-16 15:01 - 00000000 ____D () C:\Program Files\Secunia
2014-02-16 15:00 - 2014-02-16 15:00 - 05329480 _____ (Secunia) C:\Users\Leah\Downloads\PSISetup(1).exe
2014-02-16 15:00 - 2014-02-16 15:00 - 02581656 _____ (Secunia) C:\Users\Leah\Downloads\PSISetup.exe
2014-02-16 14:57 - 2006-11-02 11:33 - 00703516 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-16 14:51 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\AppData\Local\PasswordSafe
2014-02-16 14:51 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-16 14:50 - 2014-02-16 14:45 - 00003426 _____ () C:\DelFix.txt
2014-02-16 14:50 - 2008-02-24 10:33 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-16 14:50 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-16 14:45 - 2014-02-15 18:17 - 00000000 ____D () C:\Windows\ERUNT
2014-02-16 14:43 - 2014-02-16 14:41 - 00000000 ___SD () C:\32788R22FWJFW
2014-02-16 14:43 - 2014-02-14 00:12 - 00000000 ____D () C:\Windows\erdnt
2014-02-16 14:37 - 2013-12-30 13:46 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-02-16 14:36 - 2008-03-03 01:26 - 00000000 ____D () C:\Users\Leah
2014-02-16 14:27 - 2008-02-24 11:04 - 00220096 _____ () C:\Windows\PFRO.log
2014-02-15 19:06 - 2014-02-15 19:06 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-15 18:43 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-02-15 18:21 - 2009-07-01 19:24 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
2014-02-14 18:33 - 2014-02-14 18:33 - 00000000 ____H () C:\Users\Leah\Documents\Default.rdp
2014-02-14 00:36 - 2013-08-15 11:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-14 00:34 - 2006-11-02 11:24 - 85946576 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-02-14 00:23 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2014-02-14 00:23 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2014-02-14 00:22 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2014-02-14 00:12 - 2014-02-14 00:12 - 00000000 ____D () C:\Users\Leah\Desktop\Leah
2014-02-12 19:18 - 2014-02-12 19:18 - 00000000 ____D () C:\Program Files\7-Zip
2014-02-11 11:57 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Leah\Desktop\Notepad++.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:24 - 2014-02-10 17:23 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:50 - 2013-12-30 13:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-02-10 16:48 - 2008-07-10 15:51 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Skype
2014-02-10 16:45 - 2008-02-24 10:55 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Norton
2014-02-10 16:29 - 2011-03-19 11:51 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-10 16:22 - 2008-03-03 19:51 - 00154112 _____ () C:\Users\Leah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-10 16:02 - 2008-03-21 15:13 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Adobe
2014-02-10 16:01 - 2008-08-16 11:41 - 00000000 ____D () C:\Users\Leah\Documents\My Received Files
2014-02-10 15:58 - 2008-08-16 11:30 - 00000000 ____D () C:\Program Files\Windows Live
2014-02-10 15:57 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-10 15:56 - 2008-08-16 11:41 - 00049152 _____ () C:\Windows\DPINST.LOG
2014-02-10 15:43 - 2008-03-03 01:27 - 00060248 _____ () C:\Users\Leah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-10 15:42 - 2008-02-24 10:55 - 00000000 ____D () C:\Program Files\Google
2014-02-10 15:42 - 2006-11-02 13:47 - 00270608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-10 15:37 - 2009-11-18 15:04 - 00000000 ____D () C:\ProgramData\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Program Files\Real
2014-02-10 15:36 - 2013-08-08 19:39 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Guest\Desktop\Notepad++.lnk
2014-02-10 15:26 - 2008-02-24 10:41 - 00000000 ____D () C:\Program Files\Java
2014-02-10 15:22 - 2013-01-19 13:52 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-10 15:22 - 2008-06-12 23:00 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-10 15:16 - 2013-08-18 10:49 - 00000000 ____D () C:\Program Files\HP
2014-02-10 15:15 - 2012-06-07 16:01 - 00000000 ____D () C:\Program Files\Citrix
2014-02-10 15:15 - 2009-04-22 11:03 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Mozilla
2014-02-10 15:15 - 2008-03-03 01:27 - 00000000 ____D () C:\Users\Leah\AppData\Local\Google
2014-02-10 15:09 - 2006-11-02 11:23 - 00000144 _____ () C:\Windows\win.ini
2014-02-10 15:06 - 2008-02-24 10:43 - 00000000 ____D () C:\Program Files\Dell
2014-02-07 14:20 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\Documents\My Safes
2014-02-07 12:41 - 2012-08-14 20:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-07 12:41 - 2012-08-14 20:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 17:10 - 2010-12-14 00:50 - 00002082 _____ () C:\Users\Leah\Desktop\Google Chrome.lnk
2014-02-05 16:19 - 2012-05-22 11:44 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-05 15:58 - 2008-09-09 08:18 - 00005648 _____ () C:\Users\Leah\AppData\Local\d3d9caps.dat
2014-02-05 09:58 - 2014-02-14 00:28 - 12345344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-05 09:56 - 2014-02-14 00:28 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-05 09:53 - 2014-02-14 00:28 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-05 09:51 - 2014-02-14 00:28 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-05 09:50 - 2014-02-14 00:28 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-05 09:49 - 2014-02-14 00:28 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-05 09:49 - 2014-02-14 00:28 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-05 09:48 - 2014-02-14 00:28 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-05 09:48 - 2014-02-14 00:28 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-05 09:47 - 2014-02-14 00:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-05 09:47 - 2014-02-14 00:28 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-05 09:47 - 2014-02-14 00:28 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-02-05 09:46 - 2014-02-14 00:28 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-03 21:34 - 2010-12-13 23:13 - 00000000 ____D () C:\ProgramData\PCDr
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
2014-02-03 20:44 - 2006-11-02 13:52 - 00235301 _____ () C:\Windows\setupact.log
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ___RD () C:\Program Files\Skype
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ____D () C:\ProgramData\Skype
2014-01-17 18:59 - 2008-02-24 10:52 - 00000000 ____D () C:\ProgramData\Microsoft Help

Some content of TEMP:
====================
C:\Users\Leah\AppData\Local\Temp\avgnt.exe
C:\Users\Leah\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-16 14:58

==================== End Of Log ============================

--- --- ---

Und - weil ja jetzt wieder neu installiert - auch ein Addition:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 12-02-2014 01
Ran by Leah at 2014-02-16 17:51:32
Running from C:\Users\Leah\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
7-Zip 9.20 (Version:  - )
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) (Version: 10.1.9 - Adobe Systems Incorporated)
Advanced Audio FX Engine (Version:  - )
Advanced Video FX Engine (Version:  - )
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Conexant HDA D330 MDC V.92 Modem (Version:  - )
Dell Getting Started Guide (Version: 1.00.0000 - Dell Inc.)
Dell Touchpad (Version: 7.1.103.4 - Alps Electric)
Dell Webcam Center (Version:  - )
Dell Webcam Manager (Version:  - )
Digital Line Detect (Version: 1.21 - BVRP Software, Inc)
Google Chrome (HKCU Version: 32.0.1700.107 - Google Inc.)
Highlight Viewer (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
HP Update (Version: 5.003.003.001 - Hewlett-Packard)
Intel(R) Matrix Storage Manager (Version:  - )
Intel(R) PROSet/Wireless Software (Version: 11.01.0000 - Intel Corporation)
Iomega Product Registration (Version: 7.24.0000 - Iomega Corporation)
Laptop Integrated Webcam Driver (1.04.01.1011)   (Version:  - )
Live! Cam Avatar Creator (Version: 4.6.0817.1 - Creative Technology Ltd.)
Live! Cam Avatar v1.0 (Version: 1.0 - Creative Technology Ltd.)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
mCore (Version: 9.24.0000 - Intel Corporation) Hidden
MediaDirect (Version: 3.5 - Dell)
mHelp (Version: 9.24.0000 - Intel) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Search Enhancement Pack (Version: 3.0.133.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
mMHouse (Version: 9.24.0000 - Intel Corporation) Hidden
Modem Diagnostic Tool (Version: 1.0.20.0 - Dell)
Mozilla Firefox 27.0.1 (x86 en-GB) (Version: 27.0.1 - Mozilla)
Mozilla Maintenance Service (Version: 27.0.1 - Mozilla)
mPfMgr (Version: 9.24.0000 - Intel Corporation) Hidden
MSVC80_x86 (Version: 1.0.1.0 - Nokia) Hidden
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
mWMI (Version: 9.24.0000 - Intel Corporation) Hidden
My Dell (Version: 3.4.6422.14 - PC-Doctor, Inc.)
NetWaiting (Version: 2.5.44 - BVRP Software, Inc)
Notepad++ (Version: 6.5.2 - Notepad++ Team)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OutlookAddinSetup (Version: 1.0.0 - CyberLink)
Password Safe (Version:  - )
PC Connectivity Solution (Version: 10.18.0.0 - Nokia)
QuickSet (Version: 8.2.17 - Dell Inc.)
Roxio Creator Audio (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Copy (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Data (Version: 3.7.0 - Roxio) Hidden
Roxio Creator DE (Version: 10.1 - )
Roxio Creator DE (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Tools (Version: 3.7.0 - Roxio) Hidden
Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden
Roxio Update Manager (Version: 6.0.0 - Roxio) Hidden
Secunia PSI (3.0.0.9016) (Version: 3.0.0.9016 - Secunia)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Smart Menus (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
User's Guides (Version:  - )
WIDCOMM Bluetooth Software 6.0.1.3100 (Version: 6.0.1.3100 - Dell)
Windows Live Toolbar Extension (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)

==================== Restore Points  =========================

16-02-2014 13:49:41 End of disinfection

==================== Hosts content: ==========================

2006-11-02 11:23 - 2014-02-14 00:22 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {06DBA3A5-144B-4A03-9521-7CC720DE6165} - System32\Tasks\{E72283E4-1774-42B8-B8FF-304A4E5DA9B8} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0C003265-4905-48AB-BEDC-510CC00AF517} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {0EE9C2FC-7C71-4D55-8B83-429FBF2A5AE3} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-12-07] (PC-Doctor, Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E80B85F-473D-4157-BDD5-21ED0AD186A7} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {2D63378D-EE90-4DE4-BE6C-52705345E0AC} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {2DBEE28A-314F-43D2-881A-AEB7B1E81FBC} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Leah => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {2FF92470-CDA0-4AE6-9506-AA6CE98C6EFD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {44F1C48E-75D3-409A-B6DC-78643828A7C4} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {62ED58DC-65F8-4EB2-AB4B-8D55875A1A93} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {77F6DEAA-077F-4A8E-A989-710146F9603F} - System32\Tasks\{86F4E43F-1BBB-4F2B-A302-E694F21AC20E} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {B43B4946-2DF2-424B-978F-09723934A10A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C0E06D20-DE13-4D4E-A4C8-B5AE08EA3332} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {D5B7A726-E835-4C53-8922-443BBADAF95B} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {D68D82DB-ED91-44FE-8A48-7B95C5CB7BCA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-06] (PC-Doctor, Inc.)
Task: {DF32DA4A-B92B-4F92-9A9A-FC9D603347B9} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {EDAEB69B-4680-401D-8F06-F5875C178759} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-19] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2006-11-03 18:46 - 2006-11-03 18:46 - 00126976 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2012-06-18 16:24 - 2012-06-18 16:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll
2008-02-24 18:26 - 2007-12-15 04:54 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2008-07-08 17:21 - 2008-07-08 17:21 - 00081408 _____ () C:\Program Files\DAEMON Tools Lite\Lang\ENU.dll
2007-11-09 11:39 - 2007-11-09 11:39 - 00007680 _____ () C:\Program Files\DAEMON Tools Lite\Plugins\Images\bw5mount.dll
2006-11-03 18:25 - 2006-11-03 18:25 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2014-02-15 19:06 - 2014-02-15 19:06 - 03578992 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/16/2014 03:45:51 PM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (02/16/2014 03:45:49 PM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (02/16/2014 02:49:40 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {e768f979-dc89-48fc-bcce-1e051cf11679}


System errors:
=============
Error: (02/16/2014 02:52:32 PM) (Source: DCOM) (User: )
Description: {0228576F-6E6C-4E1A-B175-0E46A316AFE2}

Error: (02/16/2014 02:52:07 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/16/2014 02:52:07 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/16/2014 02:43:06 PM) (Source: Service Control Manager) (User: )
Description: XAudioService1

Error: (02/16/2014 02:38:33 PM) (Source: DCOM) (User: )
Description: {0228576F-6E6C-4E1A-B175-0E46A316AFE2}

Error: (02/16/2014 02:38:08 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/16/2014 02:38:08 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/16/2014 02:28:27 PM) (Source: DCOM) (User: )
Description: {0228576F-6E6C-4E1A-B175-0E46A316AFE2}

Error: (02/16/2014 02:28:09 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/16/2014 02:28:09 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058


Microsoft Office Sessions:
=========================
Error: (12/05/2009 04:42:08 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/10/2009 07:20:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7308 seconds with 4920 seconds of active time.  This session ended with a crash.

Error: (07/25/2009 05:46:00 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15612 seconds with 7080 seconds of active time.  This session ended with a crash.

Error: (07/09/2009 09:45:54 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4397 seconds with 1500 seconds of active time.  This session ended with a crash.

Error: (06/22/2009 00:51:51 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31569 seconds with 3540 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-02-10 20:38:33.825
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:33.544
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:33.248
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.967
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.671
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.374
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:32.585
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:32.304
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:31.992
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:31.711
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Percentage of memory in use: 55%
Total physical RAM: 3061.31 MB
Available physical RAM: 1362.18 MB
Total Pagefile: 6328.88 MB
Available Pagefile: 4475.59 MB
Total Virtual: 2047.88 MB
Available Virtual: 1902.83 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:220.29 GB) (Free:143.83 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 88000000)
Partition 1: (Not Active) - (Size=94 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=220 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=OF Extended)

==================== End Of Log ============================

Ich wuensche auf jeden Fall einen guten Start in die Woche Aussendienst!

schrauber · 17.02.2014, 13:32

Revo Uninstaller - Download - Filepony
damit Deamon Tools und HandBrake deinstallieren, Reste entfernen lassen.

Und während dessen Avira abschalten

Rusty11 · 18.02.2014, 08:39

Hi mal wieder,
leider zeigt auch Revo Uninstaller die beiden Programme nicht an.
Finden kann man sie nur ueber Start > Alle Programme.
Dort gibt es in dem jeweiligen Ordner auch eine Uninstall-Option. Bei Daemon Tools hab ich die am Sonntag auch schon ausprobiert, da hatte Avira sofort den Virusfund gemeldet - scheint also der "Ort der Infektion" zu sein?

Bei HandBrake hab ich das dann nicht mehr probiert - aus Angst dass noch mehr passiert

Was nun?
Viele Gruesse und weiter Danke fuer die tolle Unterstuetzung!!

11.02.2014, 13:06	#2
schrauber /// the machine /// TB-Ausbilder	Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem Hi, einfach aufteilen und mehrere Posts nutzen. __________________ __________________

12.02.2014, 17:38	#4
schrauber /// the machine /// TB-Ausbilder	Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem Ok dann zippe es und hänge es an. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem

Plagegeister aller Art und deren Bekämpfung: Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem