Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung

Plagegeister aller Art und deren Bekämpfung: Probleme mit dem Browser > Malware

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Alt 18.05.2014, 15:21   #1
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Hallo,
ich habe Probleme mit meinem Browser.
Einige Videos bei dailymotion habe ich geschaut. Plötzlich passiert, dass sich die Seite ändert und eine andere Seite erscheint (ein Gameseite).
Manchmal wird eine Software (flash player) automatisch heruntergeladen. Ich habe es zwar nicht installiert und gelöscht aber mein Browser hat sich geändert z..B., obwohl ich als Startseite Google habe, erscheint automatisch eine andere Seite (search.conduit.com). Ich habe es mehrmals geändert aber es hat nichts gefruchtet.
Das Problem habe ich bei Mozilla und Google Chrome.
Von Avast erhalte ich häufige einige Meldungen (siehe unten) aber Avast und Spybot haben nichts gefunden.
Kann jmd mir bitte helfen?
Vielen Dank
Viele Grüße
Miniaturansicht angehängter Grafiken
Probleme mit dem Browser > Malware-unbenannt.jpg   Probleme mit dem Browser > Malware-17.05.14.jpg  

Alt 18.05.2014, 16:36   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Hallo und

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner, sind die mal fündig geworden?

Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs in CODE-Tags posten!
Relevant sind nur Logs der letzten 7 Tage bzw. seitdem das Problem besteht!




Zudem bitte auch ein Log mit Farbars Tool machen:

Scan mit Farbar's Recovery Scan Tool (FRST)

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)



Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 18.05.2014, 21:35   #3
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Hallo, wie finde ich den Addition.txt noch mal?


Anbei die FRST.txt:



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by nerobyrn (administrator) on NEROBYRN-HP on 18-05-2014 21:25:18
Running from C:\Users\nerobyrn\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\EXCEL.EXE
(Microsoft Corporation) C:\Windows\System32\calc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NPSStartup] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = 
SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194

FireFox:
========
FF ProfilePath: C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default
FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB
FF DefaultSearchEngine: Trovi search
FF SelectedSearchEngine: Trovi search
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml
FF Extension: Test Pilot - C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07]
FF Extension: NoScript - C:\Users\nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22]

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=55&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&SSPV=", "hxxp://www.google.de/"
CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18]
CHR Extension: (Google Drive) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18]
CHR Extension: (YouTube) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18]
CHR Extension: (Google-Suche) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18]
CHR Extension: (avast! Online Security) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18]
CHR Extension: (Google Wallet) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18]
CHR Extension: (Google Mail) - C:\Users\nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X]

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\nerobyrn\Downloads\FRST.txt
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\nerobyrn\Downloads\FRST64.exe
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:56 - 2014-05-18 21:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 12:56 - 2014-05-18 20:52 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\nerobyrn\Downloads\ChromeSetup.exe
2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\nerobyrn\Downloads\spybot-2.3.exe
2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleFornerobyrn
2014-05-05 21:40 - 2014-05-18 20:57 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleFornerobyrn.job
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-17 13:55 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\SearchProtect
2014-05-03 23:44 - 2014-05-17 13:36 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\OpenCandy
2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\DVDVideoSoft
2014-04-18 11:35 - 2014-04-27 20:00 - 00000000 ____D () C:\Users\nerobyrn\Documents\Ebay

==================== One Month Modified Files and Folders =======

2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\nerobyrn\Downloads\FRST.txt
2014-05-18 21:25 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\nerobyrn\Downloads\FRST64.exe
2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\nerobyrn\Documents\Budget
2014-05-18 21:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-18 21:06 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\nerobyrn\Desktop\ccntis2.xls
2014-05-18 21:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleFornerobyrn
2014-05-18 20:57 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleFornerobyrn.job
2014-05-18 20:52 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 20:52 - 2013-04-30 20:38 - 00261490 _____ () C:\Windows\PFRO.log
2014-05-18 20:52 - 2013-01-04 11:28 - 00088689 _____ () C:\Windows\setupact.log
2014-05-18 20:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-18 19:34 - 2010-09-23 11:48 - 01390146 _____ () C:\Windows\WindowsUpdate.log
2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0659.tmp
2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL1677.tmp
2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0365.tmp
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\Google
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\nerobyrn\Downloads\ChromeSetup.exe
2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0288.tmp
2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2318.tmp
2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2233.tmp
2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL3087.tmp
2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0740.tmp
2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2460.tmp
2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0595.tmp
2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0301.tmp
2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL2149.tmp
2014-05-17 13:55 - 2014-05-03 23:44 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\SearchProtect
2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 13:36 - 2014-05-03 23:44 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\nerobyrn\Documents\Bookmarks
2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\nerobyrn\Downloads\spybot-2.3.exe
2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\nerobyrn\Desktop\~WRL0012.tmp
2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\nerobyrn\Documents\Jokes
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-15 14:28 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-14 16:10 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 16:10 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 16:10 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\nerobyrn\Documents\Bewerbung
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java
2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java
2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997
2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997
2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\Skype
2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\nerobyrn
2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\nerobyrn\Documents\Deko
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\nerobyrn\AppData\Roaming\OpenCandy
2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\nerobyrn\Desktop\~WRL0011.tmp
2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\nerobyrn\Documents\a_Misc
2014-04-28 16:49 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\nerobyrn\Documents\Artes_artesanato
2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\nerobyrn\Documents\Ebay
2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\nerobyrn\Dropbox
2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNEROBYRN-HP$
2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNEROBYRN-HP$.job
2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\nerobyrn\Documents\Briefe
2014-04-18 23:10 - 2012-01-14 11:26 - 00000000 ____D () C:\Users\nerobyrn\Documents\Dieta

Some content of TEMP:
====================
C:\Users\nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll
C:\Users\nerobyrn\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\nerobyrn\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\nerobyrn\AppData\Local\Temp\nse5A5B.exe
C:\Users\nerobyrn\AppData\Local\Temp\nse996.exe
C:\Users\nerobyrn\AppData\Local\Temp\nsk5F5C.exe
C:\Users\nerobyrn\AppData\Local\Temp\nsp5481.exe
C:\Users\nerobyrn\AppData\Local\Temp\nspEB6.exe
C:\Users\nerobyrn\AppData\Local\Temp\nsu14A0.exe
C:\Users\nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\nerobyrn\AppData\Local\Temp\sp-downloader.exe
C:\Users\nerobyrn\AppData\Local\Temp\sp64126.exe
C:\Users\nerobyrn\AppData\Local\Temp\SPSetup.exe
C:\Users\nerobyrn\AppData\Local\Temp\UninstallHPSA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-12 19:26

==================== End Of Log ============================
         
--- --- ---
__________________

Alt 19.05.2014, 01:13   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Du findest die Logs an den erwähnten Stellen, wenn du die Anleitungen richtig umsetzt:

Zitat:
Running from C:\Users\nerobyrn\Downloads
Es steht nämlich in eigentlich allen unseren Anleitungen dass die Tools auf den Desktop abgelegt werden sollen und nicht nach Downloads oder woanders hin. Außerdem vermiss ich Angaben/Logs zu bisherigen Funden.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 19.05.2014, 17:40   #5
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Hallo,
ich habe nur die Fehlermeldungen v. Avast, die ich bereits angehängt habe.
Der Avast Virusscanner hat nichts gefunden aber meine Browser-Einstellungen haben sich geändert und obwohl ich die Settings wiederhergestellt habe, funktionieren sie nicht, wie gewünscht. Es erscheint immer wieder als erste Seite search.conduit.com obwohl ich Google gewählt habe. Ich habe conduit sogar aus der Suchmaschinenliste gelöscht. Es hat aber nichts genutzt. Ich befürchte, dass mein Browser nicht mehr sicher ist.



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Nerobyrn (administrator) on Nerobyrn-HP on 18-05-2014 21:25:18
Running from C:\Users\Nerobyrn\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\EXCEL.EXE
(Microsoft Corporation) C:\Windows\System32\calc.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NPSStartup] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = 
SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194

FireFox:
========
FF ProfilePath: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default
FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB
FF DefaultSearchEngine: Trovi search
FF SelectedSearchEngine: Trovi search
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml
FF Extension: Test Pilot - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07]
FF Extension: NoScript - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22]

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=55&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&SSPV=", "hxxp://www.google.de/"
CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18]
CHR Extension: (Google Drive) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18]
CHR Extension: (YouTube) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18]
CHR Extension: (Google-Suche) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18]
CHR Extension: (avast! Online Security) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18]
CHR Extension: (Google Wallet) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18]
CHR Extension: (Google Mail) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X]

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:56 - 2014-05-18 21:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 12:56 - 2014-05-18 20:52 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\Nerobyrn\Downloads\ChromeSetup.exe
2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe
2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn
2014-05-05 21:40 - 2014-05-18 20:57 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-17 13:55 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect
2014-05-03 23:44 - 2014-05-17 13:36 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy
2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft
2014-04-18 11:35 - 2014-04-27 20:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay

==================== One Month Modified Files and Folders =======

2014-05-18 21:25 - 2014-05-18 21:25 - 00022178 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt
2014-05-18 21:25 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe
2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Budget
2014-05-18 21:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-18 21:06 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\Nerobyrn\Desktop\ccntis2.xls
2014-05-18 21:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-18 21:00 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn
2014-05-18 20:57 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job
2014-05-18 20:52 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 20:52 - 2013-04-30 20:38 - 00261490 _____ () C:\Windows\PFRO.log
2014-05-18 20:52 - 2013-01-04 11:28 - 00088689 _____ () C:\Windows\setupact.log
2014-05-18 20:52 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-18 19:34 - 2010-09-23 11:48 - 01390146 _____ () C:\Windows\WindowsUpdate.log
2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0659.tmp
2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL1677.tmp
2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0365.tmp
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Google
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-18 12:55 - 2014-05-18 12:55 - 00918672 _____ (Google Inc.) C:\Users\Nerobyrn\Downloads\ChromeSetup.exe
2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0288.tmp
2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2318.tmp
2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2233.tmp
2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL3087.tmp
2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0740.tmp
2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2460.tmp
2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0595.tmp
2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0301.tmp
2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2149.tmp
2014-05-17 13:55 - 2014-05-03 23:44 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect
2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 13:36 - 2014-05-03 23:44 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bookmarks
2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe
2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0012.tmp
2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Jokes
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-15 14:28 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-14 16:10 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-14 16:10 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-14 16:10 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bewerbung
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java
2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java
2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997
2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997
2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\Skype
2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\Nerobyrn
2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Deko
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy
2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0011.tmp
2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\Nerobyrn\Documents\a_Misc
2014-04-28 16:49 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Artes_artesanato
2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay
2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\Nerobyrn\Dropbox
2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn-HP$
2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job
2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Briefe
2014-04-18 23:10 - 2012-01-14 11:26 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Dieta

Some content of TEMP:
====================
C:\Users\Nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll
C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nse5A5B.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nse996.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsk5F5C.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsp5481.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nspEB6.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsu14A0.exe
C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Nerobyrn\AppData\Local\Temp\sp-downloader.exe
C:\Users\Nerobyrn\AppData\Local\Temp\sp64126.exe
C:\Users\Nerobyrn\AppData\Local\Temp\SPSetup.exe
C:\Users\Nerobyrn\AppData\Local\Temp\UninstallHPSA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-12 19:26

==================== End Of Log ============================
         
--- --- ---


Alt 20.05.2014, 01:13   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Scan klicken

__________________
--> Probleme mit dem Browser > Malware

Alt 20.05.2014, 12:46   #7
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware




FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Nerobyrn (administrator) on Nerobyrn-HP on 20-05-2014 12:40:13
Running from C:\Users\Nerobyrn\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NPSStartup] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll File Not Found
AppInit_DLLs-x32: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll => "C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll" File Not Found
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = 
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL = hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = 
SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194

FireFox:
========
FF ProfilePath: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default
FF NewTab: hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB
FF DefaultSearchEngine: Trovi search
FF SelectedSearchEngine: Trovi search
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml
FF Extension: Test Pilot - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07]
FF Extension: NoScript - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22]

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18]
CHR Extension: (Google Drive) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18]
CHR Extension: (YouTube) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18]
CHR Extension: (Google-Suche) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18]
CHR Extension: (avast! Online Security) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18]
CHR Extension: (Google Wallet) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18]
CHR Extension: (Google Mail) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
S2 CltMngSvc; C:\PROGRA~2\SearchProtect\Main\bin\CltMngSvc.exe [X]

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-20 12:40 - 2014-05-20 12:40 - 00022288 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt
2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx
2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee
2014-05-18 21:25 - 2014-05-18 21:25 - 00047303 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:56 - 2014-05-20 12:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 12:56 - 2014-05-20 11:21 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe
2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 21:40 - 2014-05-19 08:45 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job
2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-17 13:55 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect
2014-05-03 23:44 - 2014-05-17 13:36 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy
2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft

==================== One Month Modified Files and Folders =======

2014-05-20 12:40 - 2014-05-20 12:40 - 00022288 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt
2014-05-20 12:40 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST
2014-05-20 12:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-20 12:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-20 11:28 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-20 11:28 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-20 11:25 - 2010-09-23 11:48 - 01434238 _____ () C:\Windows\WindowsUpdate.log
2014-05-20 11:23 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-20 11:21 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-20 11:20 - 2013-01-04 11:28 - 00089361 _____ () C:\Windows\setupact.log
2014-05-20 11:20 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-19 23:42 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL1805.tmp
2014-05-19 20:29 - 2012-02-12 20:56 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Listen_Lesezeichen
2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx
2014-05-19 14:49 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0013.tmp
2014-05-19 14:10 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Artes_artesanato
2014-05-19 09:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 09:44 - 2013-11-15 14:08 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Arzt_Zahnarzt
2014-05-19 09:32 - 2011-03-15 23:15 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Adobe
2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee
2014-05-19 09:31 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-19 09:31 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-19 09:31 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-19 08:45 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job
2014-05-19 00:17 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\Nerobyrn\Desktop\ccntis2.xls
2014-05-18 23:34 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL1601.tmp
2014-05-18 23:04 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3166.tmp
2014-05-18 21:57 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3656.tmp
2014-05-18 21:25 - 2014-05-18 21:25 - 00047303 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe
2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Budget
2014-05-18 21:02 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2412.tmp
2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn
2014-05-18 20:52 - 2013-04-30 20:38 - 00261490 _____ () C:\Windows\PFRO.log
2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0659.tmp
2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL1677.tmp
2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0365.tmp
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Google
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0288.tmp
2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2318.tmp
2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2233.tmp
2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL3087.tmp
2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0740.tmp
2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2460.tmp
2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0595.tmp
2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0301.tmp
2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2149.tmp
2014-05-17 13:55 - 2014-05-03 23:44 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\SearchProtect
2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 13:36 - 2014-05-03 23:44 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bookmarks
2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe
2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0012.tmp
2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Jokes
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bewerbung
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java
2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java
2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997
2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997
2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\Skype
2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\Nerobyrn
2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Deko
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:42 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\OpenCandy
2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0011.tmp
2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\Nerobyrn\Documents\a_Misc
2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay
2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\Nerobyrn\Dropbox
2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn-HP$
2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job
2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Briefe

Some content of TEMP:
====================
C:\Users\Nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll
C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nse5A5B.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nse996.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsk5F5C.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsp5481.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nspEB6.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsu14A0.exe
C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Nerobyrn\AppData\Local\Temp\sp-downloader.exe
C:\Users\Nerobyrn\AppData\Local\Temp\sp64126.exe
C:\Users\Nerobyrn\AppData\Local\Temp\SPSetup.exe
C:\Users\Nerobyrn\AppData\Local\Temp\UninstallHPSA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 12:43

==================== End Of Log ============================
         
--- --- ---



Code:
ATTFilter
 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by Nerobyrn at 2014-05-20 12:40:55
Running from C:\Users\Nerobyrn\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Amazon MP3-Downloader 1.0.15 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.15 - Amazon Services LLC)
avast! Internet Security (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version:  - )
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MG3100 series Benutzerregistrierung (HKLM-x32\...\Canon MG3100 series Benutzerregistrierung) (Version:  - )
Canon MG3100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3100_series) (Version:  - )
Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version:  - )
Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.)
CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Free YouTube Download version 3.2.33.424 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.33.424 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{B360E24A-BF25-4353-AA79-1B54F509024A}) (Version: 1.0.0.0 - Hewlett-Packard)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Software Framework (HKLM-x32\...\{AF6EB833-D48A-49AC-9394-4C57489FDFF2}) (Version: 4.1.13.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2131 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416045FF}) (Version: 6.0.450 - Oracle)
Java(TM) 6 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216045FF}) (Version: 6.0.450 - Oracle)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2000 Professional (HKLM-x32\...\{00010407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.212.0 - Tracker Software Products Ltd)
PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4204 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4204 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.25.824.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
RtVOsd (HKLM\...\{091A0130-A82F-4A6D-9C61-3BBBB3289030}) (Version: 1.0.6 - Realtek Semiconductor Corp.)
Samsung New PC Studio (HKLM-x32\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
waterMark V2 (HKLM-x32\...\waterMark V2) (Version:  - )
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Restore Points  =========================

02-05-2014 10:27:47 Windows Update
02-05-2014 22:31:24 Windows Update
03-05-2014 23:18:09 TuneUp Utilities 2014 wird entfernt
03-05-2014 23:19:02 TuneUp Utilities 2014 (de-DE) wird entfernt
04-05-2014 17:33:43 Windows-Sicherung
10-05-2014 17:41:39 Windows Update
10-05-2014 22:08:09 Windows Update
11-05-2014 18:51:31 Windows-Sicherung
12-05-2014 08:41:38 avast! antivirus system restore point
15-05-2014 20:23:20 Windows Update
17-05-2014 11:54:28 Säuberung (Spybot - Search & Destroy 2.3, Administratorrechte)
18-05-2014 17:00:12 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {00621FE6-97B0-453C-904E-297740F769B6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {0AB49A2C-3AAB-483B-8E5D-3841FFFF6267} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-19] (Adobe Systems Incorporated)
Task: {18D8F90E-1E99-418B-9C1E-2CBB4B717FC8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {4AC7713C-B642-4A37-9AB8-3D3BBEE9A53B} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-05-12] (AVAST Software)
Task: {4BB2EEEE-8399-47DF-8F13-734111D4206A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {5DC1314E-E966-4978-8851-29B9C4E72F13} - System32\Tasks\HPCeeScheduleForNerobyrn-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {724589F9-0A4F-4271-B6A6-AB19ABDC5C85} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {77D2A8AE-EE4C-4A09-A6A7-E4FBCF023B8A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {7D69B46C-12D8-4805-B5D6-C43B34887787} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {86271439-898E-4D0F-BDEF-BA4F04156C7C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {A06276EA-B0B4-40FE-9560-95B334CA9ED4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.)
Task: {C84D2EE0-A35D-4EB5-9BBB-93204A6F493D} - System32\Tasks\HPCeeScheduleForNerobyrn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {E73BC00E-0FEF-4EF3-AC0B-17E4D7A6138A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {F4BA29A6-F96B-41F9-ABC7-6C55FCCB2115} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2012-01-12 22:13 - 2010-06-17 22:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2014-05-19 17:56 - 2014-05-19 17:56 - 02253312 _____ () C:\Program Files\Alwil Software\Avast5\defs\14051901\algo.dll
2014-05-20 11:22 - 2014-05-20 11:22 - 02253312 _____ () C:\Program Files\Alwil Software\Avast5\defs\14052000\algo.dll
2014-05-17 12:50 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-05-17 12:50 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-05-17 12:50 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2010-05-19 10:05 - 2010-05-19 10:05 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2010-05-19 10:05 - 2010-05-19 10:05 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2010-05-19 10:05 - 2010-05-19 10:05 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2013-12-03 10:35 - 2013-12-03 10:35 - 19336120 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2014-02-13 22:44 - 2014-02-13 22:44 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\29335dc88d799664dcd97362bcb687e9\IsdiInterop.ni.dll
2010-09-23 11:52 - 2010-04-13 09:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libglesv2.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libegl.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: avast! SecureLine TAP Adapter v3
Description: avast! SecureLine TAP Adapter v3
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Windows Provider V9
Service: aswTap
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/20/2014 11:24:29 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: fe0

Startzeit: 01cf740d11af2a1a

Endzeit: 9

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/19/2014 09:50:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: f90

Startzeit: 01cf739b6c53fe78

Endzeit: 8

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/19/2014 05:35:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: ca8

Startzeit: 01cf7377cec17644

Endzeit: 9

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/19/2014 00:45:58 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (05/19/2014 08:47:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: c3c

Startzeit: 01cf732e010e2b60

Endzeit: 8

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/18/2014 08:55:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e7c

Startzeit: 01cf72ca7f65373b

Endzeit: 8

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/18/2014 01:03:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e6c

Startzeit: 01cf7288a9d83e79

Endzeit: 8

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/18/2014 09:44:34 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: d24

Startzeit: 01cf726cb35c1d1b

Endzeit: 5

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:

Error: (05/18/2014 02:35:21 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm WINWORD.EXE, Version 9.0.0.2823 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 1154

Startzeit: 01cf71c929838b4e

Endzeit: 12

Anwendungspfad: C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE

Berichts-ID: 45cb4098-de24-11e3-8da8-90fba6b18e40

Error: (05/17/2014 05:27:44 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm Skype.exe, Version 6.11.0.102 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: a8c

Startzeit: 01cf71c72e85cfee

Endzeit: 7

Anwendungspfad: C:\Program Files (x86)\Skype\Phone\Skype.exe

Berichts-ID:


System errors:
=============
Error: (05/20/2014 11:23:45 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Search Protect Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/20/2014 11:22:13 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/20/2014 11:22:13 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (05/20/2014 11:21:29 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/20/2014 11:21:29 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (05/19/2014 09:50:28 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Search Protect Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/19/2014 09:48:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/19/2014 09:48:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.

Error: (05/19/2014 09:47:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Spybot-S&D 2 Scanner Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (05/19/2014 09:47:57 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Scanner Service erreicht.


Microsoft Office Sessions:
=========================
Error: (05/20/2014 11:24:29 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102fe001cf740d11af2a1a9C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/19/2014 09:50:50 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102f9001cf739b6c53fe788C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/19/2014 05:35:10 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102ca801cf7377cec176449C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/19/2014 00:45:58 PM) (Source: SideBySide) (EventID: 35) (User: )
Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8

Error: (05/19/2014 08:47:08 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102c3c01cf732e010e2b608C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/18/2014 08:55:34 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102e7c01cf72ca7f65373b8C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/18/2014 01:03:32 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102e6c01cf7288a9d83e798C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/18/2014 09:44:34 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102d2401cf726cb35c1d1b5C:\Program Files (x86)\Skype\Phone\Skype.exe

Error: (05/18/2014 02:35:21 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: WINWORD.EXE9.0.0.2823115401cf71c929838b4e12C:\Program Files (x86)\Microsoft Office\Office\WINWORD.EXE45cb4098-de24-11e3-8da8-90fba6b18e40

Error: (05/17/2014 05:27:44 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Skype.exe6.11.0.102a8c01cf71c72e85cfee7C:\Program Files (x86)\Skype\Phone\Skype.exe


==================== Memory info =========================== 

Percentage of memory in use: 55%
Total physical RAM: 3893.86 MB
Available physical RAM: 1750.59 MB
Total Pagefile: 7785.9 MB
Available Pagefile: 5060.18 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:282.09 GB) (Free:226 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:15.7 GB) (Free:2.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: CB9E9924)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End Of Log ============================
         

Alt 20.05.2014, 15:58   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Adware/Junkware/Toolbars entfernen


1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 20.05.2014, 15:58   #9
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Hallo,
ich schaue mir bei Dailymotion Videos an und habe das Gefühl, dass die Probleme damit angefangen haben. Leider finde ich diese Videos nur bei Dailymotion. Avast schlägt die ganze Zeit Alarm, blockiert irgendetwas und ich weiß nicht, ob die Meldungen ernst zu nehmend sind oder nicht.

Alt 20.05.2014, 16:01   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Schön, und welchen Bezug hat das jetzt auf meine letzte Antwort zu Junkware entfernen?
Außerdem sind Angaben wie "blockiert irgendwas" nicht hilfreich, wenn musst du schon mal die Logs dazu posten.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 20.05.2014, 16:21   #11
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Sei nicht gleich so schnippisch! Wir haben gleichzeitig gepostet. Deinen Anweisungen muss ich noch folgen.

Anbei die Meldungen:
Miniaturansicht angehängter Grafiken
Probleme mit dem Browser > Malware-20.05.14.jpg  

Alt 20.05.2014, 16:29   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Ist ja schon gut, hab mich nur über den fehlenden Bezug und die genaue fehlende Info zum Fund gewundert.

Aus dem Screenshot geht nur hervor, dass der Avast-Webschutz Chrome daran gehindert hat eine offensichtliche Adware-URL zu laden.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 20.05.2014, 20:13   #13
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.010 - Bericht erstellt am 03/11/2013 um 01:59:14
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Nerobyrn - Nerobyrn-HP
# Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner.exe
# Option : Suchen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Datei Gefunden : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gefunden : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage-journal
Ordner Gefunden : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\125

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\keaillmajpeodnbelalgeffidfcdgiem

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v23.0 (de)

[ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ]

Zeile gefunden : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

-\\ Google Chrome v30.0.1599.101

[ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1452 octets] - [03/11/2013 01:59:14]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [1512 octets] ##########
         
--- --- ---

[/CODE] AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.210 - Bericht erstellt am 20/05/2014 um 19:02:31
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Nerobyrn - Nerobyrn-HP
# Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe
# Option : Suchen

***** [ Dienste ] *****

Dienst Gefunden : CltMngSvc

***** [ Dateien / Ordner ] *****

Ordner Gefunden : C:\Program Files (x86)\SearchProtect
Ordner Gefunden : C:\Users\Nerobyrn\AppData\Local\SearchProtect
Ordner Gefunden : C:\Users\Nerobyrn\AppData\Roaming\OpenCandy

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Daten Gefunden : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Daten Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll
Schlüssel Gefunden : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gefunden : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v

[ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ]

Zeile gefunden : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0[...]

-\\ Google Chrome v34.0.1847.137

[ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gefunden [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
Gefunden [Search Provider] : hxxp://www.foxnews.com/search-results/search?q={searchTerms}&submit=Search
Gefunden [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}

*************************

AdwCleaner[R0].txt - [1592 octets] - [03/11/2013 02:59:14]
AdwCleaner[R1].txt - [2457 octets] - [20/05/2014 19:02:31]
AdwCleaner[S0].txt - [1653 octets] - [03/11/2013 03:16:39]

########## EOF - C:\AdwCleaner\AdwCleaner[R1].txt - [2577 octets] ##########
         
--- --- ---

[/CODE]
Code:
ATTFilter
AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.010 - Bericht erstellt am 03/11/2013 um 02:16:39
# Updated 20/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Nerobyrn - Nerobyrn-HP
# Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\125
Datei Gelöscht : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage-journal

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\keaillmajpeodnbelalgeffidfcdgiem

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16720


-\\ Mozilla Firefox v23.0 (de)

[ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.wrc.SearchRules.ask.com.url", "^hxxp(s)?\\:\\/\\/(.+\\.)?ask\\.com\\/.*");

-\\ Google Chrome v30.0.1599.101

[ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [1592 octets] - [03/11/2013 01:59:14]
AdwCleaner[S0].txt - [1513 octets] - [03/11/2013 02:16:39]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1573 octets] ##########
         
--- --- ---
[/CODE] AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v3.210 - Bericht erstellt am 20/05/2014 um 19:05:27
# Aktualisiert 19/05/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Nerobyrn - Nerobyrn-HP
# Gestartet von : C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : CltMngSvc

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Program Files (x86)\SearchProtect
Ordner Gelöscht : C:\Users\Nerobyrn\AppData\Local\SearchProtect
Ordner Gelöscht : C:\Users\Nerobyrn\AppData\Roaming\OpenCandy

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Daten Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC32Loader.dll
Daten Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows [AppInit_DLLs] - C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll

***** [ Browser ] *****

-\\ Internet Explorer v11.0.9600.17041


-\\ Mozilla Firefox v

[ Datei : C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\prefs.js ]

Zeile gelöscht : user_pref("browser.newtab.url", "hxxp://search.conduit.com/?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=69&CUI=&SSPV=&Lay=1&UM=5&UP=SP7D8FC55B-FB0[...]

-\\ Google Chrome v34.0.1847.137

[ Datei : C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht [Search Provider] : hxxp://search.conduit.com/Results.aspx?gd=&ctid=CT3321540&octid=EB_ORIGINAL_CTID&ISID=M6BE1039A-AA0C-43E9-92D5-DE80B01BEBC2&SearchSource=58&CUI=&UM=5&UP=SP7D8FC55B-FB0B-442C-9272-D3C60E48FDFB&q={searchTerms}&SSPV=
Gelöscht [Search Provider] : hxxp://www.foxnews.com/search-results/search?q={searchTerms}&submit=Search
Gelöscht [Search Provider] : hxxp://www.softonic.de/s/{searchTerms}

*************************

AdwCleaner[R0].txt - [1592 octets] - [03/11/2013 02:59:14]
AdwCleaner[R1].txt - [2669 octets] - [20/05/2014 19:02:31]
AdwCleaner[S0].txt - [1653 octets] - [03/11/2013 03:16:39]
AdwCleaner[S1].txt - [2464 octets] - [20/05/2014 19:05:27]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2524 octets] ##########
         
--- --- ---

[/CODE]
Code:
ATTFilter
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by Nerobyrn on 20.05.2014 at 19:16:00,15
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 20.05.2014 at 19:25:56,98
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-05-2014
Ran by Nerobyrn (administrator) on Nerobyrn-HP on 20-05-2014 19:40:34
Running from C:\Users\Nerobyrn\Downloads
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 11
Boot Mode: Normal



==================== Processes (Whitelisted) =================

(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\afwServ.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(CANON INC.) C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
(CANON INC.) C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe
(AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastUI.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(CANON INC.) C:\Program Files (x86)\Canon\Solution Menu EX\CNSEUPDT.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2095400 2010-04-16] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6486120 2013-05-25] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] => C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM\...\Run: [CanonMyPrinter] => C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2779024 2011-03-14] (CANON INC.)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2010-04-13] (Intel Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [HP Quick Launch] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [577408 2012-02-15] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [CanonSolutionMenuEx] => C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE [1612920 2011-08-04] (CANON INC.)
HKLM-x32\...\Run: [IJNetworkScannerSelectorEX] => C:\Program Files (x86)\Canon\IJ Network Scanner Selector EX\CNMNSST.exe [452016 2011-01-15] (CANON INC.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NPSStartup] => [X]
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3873704 2014-05-12] (AVAST Software)
HKLM-x32\...\Run: [SDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101584 2014-04-25] (Safer-Networking Ltd.)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-13] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2736128 2010-05-19] (Hewlett-Packard Company)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [AutoStartNPSAgent] => C:\Program Files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe [95576 2010-07-04] (Samsung Electronics Co., Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Run: [Spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566984 2014-04-25] (Safer-Networking Ltd.)
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1146403451-687488853-3150606055-1000\...\Policies\system: [DisableChangePassword] 0
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk
ShortcutTarget: Microsoft Office.lnk -> C:\Program Files (x86)\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {09E96A3B-568A-4DA3-B437-56D67F198CD4} URL = 
SearchScopes: HKCU - {1B4F5C0E-573E-4F25-8870-C4FC51119375} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {97221984-DEBA-4A44-956C-CE9EDF3C89F7} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Canon Easy-WebPrint EX BHO - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -  No File
Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} -  No File
Toolbar: HKLM-x32 - Canon Easy-WebPrint EX - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 193.189.244.202 193.189.244.194

FireFox:
========
FF ProfilePath: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default
FF DefaultSearchEngine: Trovi search
FF SelectedSearchEngine: Trovi search
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @java.com/DTPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @canon.com/EPPEX - C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin.dll (Amazon.com, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml
FF Extension: Test Pilot - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\testpilot@labs.mozilla.com.xpi [2012-04-07]
FF Extension: NoScript - C:\Users\Nerobyrn\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2011-05-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0045-ABCDEFFEDCBA} [2014-05-17]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-03-07]
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2012-12-22]

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR StartupUrls: "hxxp://www.google.de/"
CHR DefaultSearchURL: https://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=fflb&q={searchTerms}&ie=utf-8&oe=utf-8&aq=t&channel=rcs
CHR DefaultNewTabURL: 
CHR Extension: (Google Docs) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-05-18]
CHR Extension: (Google Drive) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-05-18]
CHR Extension: (YouTube) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-05-18]
CHR Extension: (Google-Suche) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-05-18]
CHR Extension: (avast! Online Security) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-05-18]
CHR Extension: (Google Wallet) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-05-18]
CHR Extension: (Google Mail) - C:\Users\Nerobyrn\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-05-18]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\Alwil Software\Avast5\WebRep\Chrome\aswWebRepChrome.crx [2014-05-12]

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-12] (AVAST Software)
R2 avast! Firewall; C:\Program Files\Alwil Software\Avast5\afwServ.exe [109048 2014-05-12] (AVAST Software)
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1522312 2012-11-22] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [905864 2012-11-22] (pdfforge GbR)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-12] ()
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [28184 2014-04-08] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-12] (AVAST Software)
R0 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [447888 2014-05-15] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-12] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-12] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
S3 aswTap; C:\Windows\System32\DRIVERS\aswTap.sys [44640 2013-12-03] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-12] ()
S3 RSUSBSTOR; C:\Windows\SysWOW64\Drivers\RtsUStor.sys [225280 2009-09-23] (Realtek Semiconductor Corp.)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-20 19:36 - 2014-05-20 19:36 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe
2014-05-20 19:25 - 2014-05-20 19:25 - 00000628 _____ () C:\Users\Nerobyrn\Desktop\JRT.txt
2014-05-20 19:15 - 2014-05-20 19:15 - 01016261 _____ (Thisisu) C:\Users\Nerobyrn\Downloads\JRT.exe
2014-05-20 19:02 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-20 19:01 - 2014-05-20 19:01 - 01326389 _____ () C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe
2014-05-20 12:40 - 2014-05-20 12:41 - 00048618 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt
2014-05-20 12:40 - 2014-05-20 12:41 - 00032898 _____ () C:\Users\Nerobyrn\Desktop\Addition.txt
2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx
2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee
2014-05-18 21:25 - 2014-05-20 19:40 - 00020628 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:56 - 2014-05-20 19:33 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-18 12:56 - 2014-05-20 19:01 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-17 15:59 - 2014-05-18 14:24 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-17 13:36 - 2014-05-17 13:54 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 12:50 - 2014-05-17 13:36 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 12:50 - 2014-05-17 12:56 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe
2014-05-15 22:26 - 2014-05-06 06:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 22:26 - 2014-05-06 06:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 22:26 - 2014-05-06 05:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 22:26 - 2014-05-06 05:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 22:26 - 2014-05-06 04:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 14:35 - 2014-05-09 08:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 14:35 - 2014-05-09 08:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 14:35 - 2014-04-12 04:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 14:35 - 2014-04-12 04:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 14:35 - 2014-04-12 04:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 14:35 - 2014-04-12 04:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 14:35 - 2014-03-25 04:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 14:35 - 2014-03-25 04:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 14:35 - 2014-03-04 11:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 14:35 - 2014-03-04 11:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 14:35 - 2014-03-04 11:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 14:35 - 2014-03-04 11:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 14:35 - 2014-03-04 11:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 14:35 - 2014-03-04 11:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 14:34 - 2014-04-12 04:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 14:34 - 2014-04-12 04:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 14:34 - 2014-04-12 04:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 14:34 - 2014-03-04 11:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 14:34 - 2014-03-04 11:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 10:58 - 2014-05-12 10:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:42 - 2014-05-15 14:29 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-11 00:08 - 2014-05-16 08:41 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-05 21:40 - 2014-05-19 08:45 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job
2014-05-05 21:40 - 2014-05-18 20:57 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:43 - 2014-05-03 23:44 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:42 - 2014-05-03 23:43 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:41 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft

==================== One Month Modified Files and Folders =======

2014-05-20 19:40 - 2014-05-18 21:25 - 00020628 _____ () C:\Users\Nerobyrn\Downloads\FRST.txt
2014-05-20 19:40 - 2013-10-24 15:59 - 00000000 ____D () C:\FRST
2014-05-20 19:37 - 2010-09-23 11:48 - 01448293 _____ () C:\Windows\WindowsUpdate.log
2014-05-20 19:36 - 2014-05-20 19:36 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Downloads\FRST64.exe
2014-05-20 19:33 - 2014-05-18 12:56 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-20 19:33 - 2013-01-04 11:28 - 00089641 _____ () C:\Windows\setupact.log
2014-05-20 19:33 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-20 19:25 - 2014-05-20 19:25 - 00000628 _____ () C:\Users\Nerobyrn\Desktop\JRT.txt
2014-05-20 19:16 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-20 19:16 - 2009-07-14 06:45 - 00023024 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-20 19:15 - 2014-05-20 19:15 - 01016261 _____ (Thisisu) C:\Users\Nerobyrn\Downloads\JRT.exe
2014-05-20 19:10 - 2012-07-07 11:12 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-05-20 19:08 - 2013-04-30 20:38 - 00261796 _____ () C:\Windows\PFRO.log
2014-05-20 19:06 - 2013-11-03 02:58 - 00000000 ____D () C:\AdwCleaner
2014-05-20 19:01 - 2014-05-20 19:01 - 01326389 _____ () C:\Users\Nerobyrn\Downloads\adwcleaner_3.210.exe
2014-05-20 19:01 - 2014-05-18 12:56 - 00001114 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-05-20 12:41 - 2014-05-20 12:40 - 00048618 _____ () C:\Users\Nerobyrn\Desktop\FRST.txt
2014-05-20 12:41 - 2014-05-20 12:40 - 00032898 _____ () C:\Users\Nerobyrn\Desktop\Addition.txt
2014-05-20 11:23 - 2012-07-10 19:13 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-19 20:29 - 2012-02-12 20:56 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Listen_Lesezeichen
2014-05-19 20:23 - 2014-05-19 20:23 - 00031143 _____ () C:\Users\Nerobyrn\Downloads\20-05-2014_Telefon-_u_email-Liste_OxfamShop_Haidh.xlsx
2014-05-19 14:49 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0013.tmp
2014-05-19 14:10 - 2014-03-20 12:00 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Artes_artesanato
2014-05-19 09:57 - 2009-07-14 05:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-19 09:44 - 2013-11-15 14:08 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Arzt_Zahnarzt
2014-05-19 09:32 - 2011-03-15 23:15 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Adobe
2014-05-19 09:31 - 2014-05-19 09:31 - 00000000 ____D () C:\ProgramData\McAfee
2014-05-19 09:31 - 2012-07-07 11:12 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-19 09:31 - 2012-04-04 18:43 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-19 09:31 - 2011-05-15 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-19 08:45 - 2014-05-05 21:40 - 00000344 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job
2014-05-19 00:17 - 2013-11-11 18:03 - 00053248 _____ () C:\Users\Nerobyrn\Desktop\ccntis2.xls
2014-05-18 23:34 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL1601.tmp
2014-05-18 23:04 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3166.tmp
2014-05-18 21:57 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL3656.tmp
2014-05-18 21:22 - 2014-05-18 21:22 - 02067456 _____ (Farbar) C:\Users\Nerobyrn\Desktop\FRST64.exe
2014-05-18 21:14 - 2011-04-02 22:53 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Budget
2014-05-18 21:02 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2412.tmp
2014-05-18 20:57 - 2014-05-05 21:40 - 00003204 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn
2014-05-18 16:21 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0659.tmp
2014-05-18 15:54 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL1677.tmp
2014-05-18 14:24 - 2014-05-17 15:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-05-18 13:40 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0365.tmp
2014-05-18 12:57 - 2014-05-18 12:57 - 00002207 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-05-18 12:57 - 2014-05-18 12:57 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\Google
2014-05-18 12:57 - 2013-05-12 13:48 - 00000000 ____D () C:\Program Files (x86)\Google
2014-05-18 12:56 - 2014-05-18 12:56 - 00004110 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-05-18 12:56 - 2014-05-18 12:56 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-05-17 22:17 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0288.tmp
2014-05-17 21:35 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2318.tmp
2014-05-17 20:32 - 2011-10-30 17:17 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-05-17 20:32 - 2011-03-15 19:17 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-05-17 18:26 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2233.tmp
2014-05-17 18:25 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL3087.tmp
2014-05-17 18:24 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0740.tmp
2014-05-17 18:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2460.tmp
2014-05-17 17:29 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0595.tmp
2014-05-17 17:04 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0301.tmp
2014-05-17 16:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-05-17 14:11 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL2149.tmp
2014-05-17 13:54 - 2014-05-17 13:36 - 00016941 _____ () C:\Windows\wininit.ini
2014-05-17 13:36 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-17 13:02 - 2011-10-31 21:37 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bookmarks
2014-05-17 12:56 - 2014-05-17 12:50 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-05-17 12:50 - 2014-05-17 12:50 - 00001351 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00001339 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\Windows\System32\Tasks\Safer-Networking
2014-05-17 12:50 - 2014-05-17 12:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 2
2014-05-17 12:48 - 2014-05-17 12:48 - 46392680 _____ (Safer-Networking Ltd. ) C:\Users\Nerobyrn\Downloads\spybot-2.3.exe
2014-05-16 10:19 - 2012-05-28 11:22 - 00020992 ____H () C:\Users\Nerobyrn\Desktop\~WRL0012.tmp
2014-05-16 09:13 - 2012-11-01 12:03 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Jokes
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-05-16 08:46 - 2011-01-28 11:58 - 00000000 ___RD () C:\Users\Nerobyrn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 08:41 - 2014-05-11 00:08 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 22:26 - 2013-07-13 12:09 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 22:24 - 2011-03-07 13:16 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 14:29 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys
2014-05-15 14:29 - 2014-01-08 20:55 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 14:29 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-15 14:29 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-14 09:37 - 2013-04-30 20:31 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-12 21:31 - 2011-04-02 23:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Bewerbung
2014-05-12 11:57 - 2014-05-12 11:57 - 00313256 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2014-05-12 11:57 - 2014-05-12 11:57 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2014-05-12 11:57 - 2013-12-31 02:17 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2014-05-12 11:57 - 2013-05-27 21:25 - 00000000 ____D () C:\Program Files\Java
2014-05-12 10:57 - 2014-05-12 10:58 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-05-12 10:57 - 2014-05-12 10:57 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-05-12 10:57 - 2014-02-05 13:59 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-05-12 10:57 - 2014-02-05 13:59 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-05-12 10:57 - 2013-03-09 07:50 - 00000000 ____D () C:\Program Files (x86)\Java
2014-05-12 10:43 - 2013-05-14 20:24 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk
2014-05-12 10:42 - 2014-05-12 10:42 - 00447888 _____ (AVAST Software) C:\Windows\system32\Drivers\aswndisflt.sys.1400156956997
2014-05-12 10:42 - 2014-05-12 10:42 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-05-12 10:42 - 2014-05-12 10:42 - 00029208 _____ () C:\Windows\system32\Drivers\aswHwid.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00208416 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-05-12 10:42 - 2013-03-19 23:02 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-05-12 10:42 - 2012-02-26 16:36 - 00093568 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-05-12 10:42 - 2011-03-07 12:52 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys.1400156956997
2014-05-12 10:42 - 2011-03-07 12:52 - 00334648 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-05-12 10:42 - 2011-01-28 12:14 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys.1400156956997
2014-05-12 10:42 - 2011-01-28 12:14 - 00079184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-05-09 08:14 - 2014-05-15 14:35 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-09 08:11 - 2014-05-15 14:35 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-06 06:40 - 2014-05-15 22:26 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-06 06:17 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-06 05:25 - 2014-05-15 22:26 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-06 05:07 - 2014-05-15 22:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-06 05:00 - 2014-05-15 22:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-06 04:10 - 2014-05-15 22:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-05 08:39 - 2013-10-27 14:31 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\Skype
2014-05-05 08:39 - 2011-01-28 11:46 - 00000000 ____D () C:\Users\Nerobyrn
2014-05-04 14:29 - 2011-04-21 21:25 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Deko
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieUserList
2014-05-04 11:53 - 2014-05-04 11:53 - 00000000 __SHD () C:\Users\Nerobyrn\AppData\Local\EmieSiteList
2014-05-03 23:44 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00001396 _____ () C:\Users\Public\Desktop\Free YouTube Download.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00001199 _____ () C:\Users\Public\Desktop\DVDVideoSoft Free Studio.lnk
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 __SHD () C:\ProgramData\{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Local\TuneUp Software
2014-05-03 23:43 - 2014-05-03 23:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:42 - 00000000 ____D () C:\Program Files (x86)\DVDVideoSoft
2014-05-03 23:43 - 2014-05-03 23:41 - 00000000 ____D () C:\Users\Nerobyrn\AppData\Roaming\DVDVideoSoft
2014-05-03 19:56 - 2012-05-28 11:22 - 00019456 ____H () C:\Users\Nerobyrn\Desktop\~WRL0011.tmp
2014-05-02 23:27 - 2011-05-14 18:46 - 00000000 ____D () C:\Users\Nerobyrn\Documents\a_Misc
2014-04-27 20:00 - 2014-04-18 11:35 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Ebay
2014-04-25 20:35 - 2009-07-14 07:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-04-24 19:08 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-04-22 22:16 - 2014-04-08 07:27 - 00000000 ___RD () C:\Users\Nerobyrn\Dropbox
2014-04-22 21:35 - 2012-03-24 14:23 - 00003224 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForNerobyrn-HP$
2014-04-22 21:35 - 2012-03-24 14:23 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job
2014-04-20 01:41 - 2011-04-30 12:39 - 00000000 ____D () C:\Users\Nerobyrn\Documents\Briefe

Some content of TEMP:
====================
C:\Users\Nerobyrn\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmptw15mq.dll
C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x64.dll
C:\Users\Nerobyrn\AppData\Local\Temp\DseShExt-x86.dll
C:\Users\Nerobyrn\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nse5A5B.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nse996.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsk5F5C.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsp5481.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nspEB6.exe
C:\Users\Nerobyrn\AppData\Local\Temp\nsu14A0.exe
C:\Users\Nerobyrn\AppData\Local\Temp\Quarantine.exe
C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-win32.dll
C:\Users\Nerobyrn\AppData\Local\Temp\SDShelEx-x64.dll
C:\Users\Nerobyrn\AppData\Local\Temp\sp-downloader.exe
C:\Users\Nerobyrn\AppData\Local\Temp\sp64126.exe
C:\Users\Nerobyrn\AppData\Local\Temp\SPSetup.exe
C:\Users\Nerobyrn\AppData\Local\Temp\UninstallHPSA.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe
[2014-05-15 14:35] - [2014-03-04 11:43] - 0455168 ____A (Microsoft Corporation) 88AB9B72B4BF3963A0DE0820B4B0B06C

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-19 12:43

==================== End Of Log ============================
         
--- --- ---
Code:
ATTFilter
 Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-05-2014
Ran by Nerobyrn at 2014-05-20 19:40:59
Running from C:\Users\Nerobyrn\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Spybot - Search and Destroy (Enabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus (Enabled) {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
AAVUpdateManager (HKLM-x32\...\{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}) (Version: 18.00.0000 - Wolters Kluwer Deutschland GmbH)
Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 13.0.0.111 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 13.0.0.111 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.07) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\{9ECF7817-DB11-4FBA-9DF1-296A578D513A}) (Version: 11.5.7.609 - Adobe Systems, Inc)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Amazon MP3-Downloader 1.0.15 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.15 - Amazon Services LLC)
avast! Internet Security (HKLM-x32\...\avast) (Version: 9.0.2018 - Avast Software)
Broadcom 802.11 Wireless LAN Adapter (HKLM\...\Broadcom 802.11 Wireless LAN Adapter) (Version: 5.60.350.6 - Broadcom Corporation)
Canon Easy-PhotoPrint EX (HKLM-x32\...\Easy-PhotoPrint EX) (Version:  - )
Canon Easy-WebPrint EX (HKLM-x32\...\Easy-WebPrint EX) (Version:  - )
Canon IJ Network Scanner Selector EX (HKLM-x32\...\Canon_IJ_Network_Scanner_Selector_EX) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version:  - )
Canon MG3100 series Benutzerregistrierung (HKLM-x32\...\Canon MG3100 series Benutzerregistrierung) (Version:  - )
Canon MG3100 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG3100_series) (Version:  - )
Canon MG3100 series On-screen Manual (HKLM-x32\...\Canon MG3100 series On-screen Manual) (Version:  - )
Canon MP Navigator EX 5.0 (HKLM-x32\...\MP Navigator EX 5.0) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version:  - )
Canon Solution Menu EX (HKLM-x32\...\CanonSolutionMenuEX) (Version:  - )
CyberLink DVD Suite (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 7.0.3003 - CyberLink Corp.)
CyberLink DVD Suite (x32 Version: 7.0.3003 - CyberLink Corp.) Hidden
CyberLink PowerDVD 9 (HKLM-x32\...\InstallShield_{A8516AC9-AAF1-47F9-9766-03E2D4CDBCF8}) (Version: 9.0.1.4217 - CyberLink Corp.)
CyberLink PowerDVD 9 (x32 Version: 9.0.1.4217 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.0.2511 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.0.2511 - CyberLink Corp.) Hidden
Energy Star Digital Logo (HKLM-x32\...\{BD1A34C9-4764-4F79-AE1F-112F8C89D3D4}) (Version: 1.0.1 - Hewlett-Packard)
ESU for Microsoft Windows 7 (HKLM-x32\...\{3877C901-7B90-4727-A639-B6ED2DD59D43}) (Version: 1.0.0 - Hewlett-Packard)
Free YouTube Download version 3.2.33.424 (HKLM-x32\...\Free YouTube Download_is1) (Version: 3.2.33.424 - DVDVideoSoft Ltd.)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 34.0.1847.137 - Google Inc.)
Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden
GPL Ghostscript (HKLM-x32\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP Advisor (HKLM-x32\...\{40FB8D7C-6FF8-4AF2-BC8B-0B1DB32AF04B}) (Version: 3.4.10262.3295 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.4 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{B360E24A-BF25-4353-AA79-1B54F509024A}) (Version: 1.0.0.0 - Hewlett-Packard)
HP Power Manager (HKLM-x32\...\{D8BCE5B9-67CF-4F3F-93AE-3ACC754C72EB}) (Version: 1.4.7 - Hewlett-Packard Company)
HP Quick Launch (HKLM-x32\...\{00A42832-B21A-4296-B5F4-D296D0BC4A3E}) (Version: 2.6.3 - Hewlett-Packard Company)
HP Setup (HKLM-x32\...\{72D90DB3-A16A-4545-B555-868471101833}) (Version: 8.1.4186.3400 - Hewlett-Packard)
HP Software Framework (HKLM-x32\...\{AF6EB833-D48A-49AC-9394-4C57489FDFF2}) (Version: 4.1.13.1 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Wireless Assistant (HKLM\...\{E342EC6B-5F25-47FE-B92C-DE616149B430}) (Version: 4.0.9.0 - Hewlett-Packard)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2131 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 6.0.0.1179 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 9.6.2.1001 - Intel Corporation)
IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.37 - Irfan Skiljan)
Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle)
Java 7 Update 55 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217055FF}) (Version: 7.0.550 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 45 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416045FF}) (Version: 6.0.450 - Oracle)
Java(TM) 6 Update 45 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216045FF}) (Version: 6.0.450 - Oracle)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2907 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.2907 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{46BA053F-57B3-4153-BDB6-D37EEC8B12D7}) (Version: 1.18.15.1 - LightScribe)
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Office 2000 Professional (HKLM-x32\...\{00010407-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2816 - Microsoft Corporation)
Microsoft Office Excel Viewer (HKLM-x32\...\{95120000-003F-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PDF Architect (HKLM-x32\...\{30B41B7A-3C9D-44DE-A7A1-949011F33CC3}) (Version: 1.0.41.8362 - pdfforge)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.212.0 - Tracker Software Products Ltd)
PhotoNow! (HKLM-x32\...\InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}) (Version: 1.1.6904 - CyberLink Corp.)
PhotoNow! (x32 Version: 1.1.6904 - CyberLink Corp.) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.4204 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.4204 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 8.0.3003 - CyberLink Corp.)
PowerDirector (x32 Version: 8.0.3003 - CyberLink Corp.) Hidden
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.25.824.2010 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6196 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (HKLM-x32\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30105 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.3023 - CyberLink Corp.) Hidden
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
RtVOsd (HKLM\...\{091A0130-A82F-4A6D-9C61-3BBBB3289030}) (Version: 1.0.6 - Realtek Semiconductor Corp.)
Samsung New PC Studio (HKLM-x32\...\InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}) (Version: 1.00.0000 - Samsung Electronics Co., Ltd.)
Samsung New PC Studio (x32 Version: 1.00.0000 - Samsung Electronics Co., Ltd.) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.3.650.0 - SAMSUNG Electronics Co., Ltd.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.3.39 - Safer-Networking Ltd.)
Steuer-Spar-Erklärung 2013 (HKLM-x32\...\{AEB61F7A-4BBA-4292-A096-7893E09034A4}) (Version: 18.09 - Wolters Kluwer Deutschland GmbH)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.0.17.0 - Synaptics Incorporated)
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
waterMark V2 (HKLM-x32\...\waterMark V2) (Version:  - )
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{586509F0-350D-48B5-B763-9CC2F8D96C4C}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live-Uploadtool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)

==================== Restore Points  =========================

02-05-2014 10:27:47 Windows Update
02-05-2014 22:31:24 Windows Update
03-05-2014 23:18:09 TuneUp Utilities 2014 wird entfernt
03-05-2014 23:19:02 TuneUp Utilities 2014 (de-DE) wird entfernt
04-05-2014 17:33:43 Windows-Sicherung
10-05-2014 17:41:39 Windows Update
10-05-2014 22:08:09 Windows Update
11-05-2014 18:51:31 Windows-Sicherung
12-05-2014 08:41:38 avast! antivirus system restore point
15-05-2014 20:23:20 Windows Update
17-05-2014 11:54:28 Säuberung (Spybot - Search & Destroy 2.3, Administratorrechte)
18-05-2014 17:00:12 Windows-Sicherung

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {00621FE6-97B0-453C-904E-297740F769B6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {0AB49A2C-3AAB-483B-8E5D-3841FFFF6267} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-19] (Adobe Systems Incorporated)
Task: {18D8F90E-1E99-418B-9C1E-2CBB4B717FC8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-03-21] (Hewlett-Packard)
Task: {4AC7713C-B642-4A37-9AB8-3D3BBEE9A53B} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-05-12] (AVAST Software)
Task: {4BB2EEEE-8399-47DF-8F13-734111D4206A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {5DC1314E-E966-4978-8851-29B9C4E72F13} - System32\Tasks\HPCeeScheduleForNerobyrn-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {724589F9-0A4F-4271-B6A6-AB19ABDC5C85} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {77D2A8AE-EE4C-4A09-A6A7-E4FBCF023B8A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {7D69B46C-12D8-4805-B5D6-C43B34887787} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)
Task: {86271439-898E-4D0F-BDEF-BA4F04156C7C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {A06276EA-B0B4-40FE-9560-95B334CA9ED4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.)
Task: {C84D2EE0-A35D-4EB5-9BBB-93204A6F493D} - System32\Tasks\HPCeeScheduleForNerobyrn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-01-05] (Hewlett-Packard)
Task: {E73BC00E-0FEF-4EF3-AC0B-17E4D7A6138A} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {F4BA29A6-F96B-41F9-ABC7-6C55FCCB2115} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-05-18] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\Windows\Tasks\HPCeeScheduleForNerobyrn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2012-01-12 22:13 - 2010-06-17 22:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2008-10-24 16:35 - 2008-10-24 16:35 - 00128296 _____ () C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
2010-06-18 16:26 - 2010-06-18 16:26 - 00267832 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPCommon.XmlSerializers.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00030264 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_LogicLayer.dll
2010-06-18 16:26 - 2010-06-18 16:26 - 00052280 _____ () C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HardwareAccess.dll
2014-05-20 11:22 - 2014-05-20 11:22 - 02253312 _____ () C:\Program Files\Alwil Software\Avast5\defs\14052000\algo.dll
2014-05-17 12:50 - 2014-04-25 14:11 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl
2014-05-17 12:50 - 2014-04-25 14:11 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl
2014-05-17 12:50 - 2014-04-25 14:11 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl
2014-05-17 12:50 - 2012-08-23 10:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll
2014-05-17 12:50 - 2012-04-03 17:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll
2010-05-19 10:05 - 2010-05-19 10:05 - 02121728 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
2010-05-19 10:05 - 2010-05-19 10:05 - 07745536 _____ () C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
2010-05-19 10:05 - 2010-05-19 10:05 - 00135168 _____ () C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
2013-12-03 10:35 - 2013-12-03 10:35 - 19336120 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00065352 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\chrome_elf.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00674632 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libglesv2.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00093000 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\libegl.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 04081480 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\pdf.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 00390472 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ppGoogleNaClPluginChrome.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 01647432 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\ffmpegsumo.dll
2014-05-18 12:57 - 2014-05-08 01:29 - 13695816 _____ () C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\PepperFlash\pepflashplayer.dll
2014-02-13 22:44 - 2014-02-13 22:44 - 00170496 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\29335dc88d799664dcd97362bcb687e9\IsdiInterop.ni.dll
2010-09-23 11:52 - 2010-04-13 09:52 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============


==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============

Name: avast! SecureLine TAP Adapter v3
Description: avast! SecureLine TAP Adapter v3
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: TAP-Windows Provider V9
Service: aswTap
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: avast! Firewall NDIS Filter Miniport
Description: avast! Firewall NDIS Filter Miniport
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: ALWIL Software
Service: aswNdis
Problem: : Windows cannot start this hardware device because its configuration information (in the registry) is incomplete or damaged. (Code 19)
Resolution: A registry problem was detected.
 This can occur when more than one service is defined for a device, if there is a failure opening the service subkey, or if the driver name cannot be obtained from the service subkey. Try these options:
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
Click "Uninstall", and then click "Scan for hardware changes" to load a usable driver.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 3893.86 MB
Available physical RAM: 2106.18 MB
Total Pagefile: 7785.9 MB
Available Pagefile: 5667.48 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:282.09 GB) (Free:225.84 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:15.7 GB) (Free:2.23 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: CB9E9924)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=282 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=16 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 MB) - (Type=0C)

==================== End Of Log ============================
         

Alt 20.05.2014, 23:29   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Okay, dann bitte Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 23.05.2014, 01:21   #15
Libellum
 
Probleme mit dem Browser > Malware - Standard

Probleme mit dem Browser > Malware



Code:
ATTFilter
<?xml version="1.0" encoding="UTF-16"?>

-<mbam-log>


-<header>

<date>2014/05/22 23:05:27 +0200</date>

<logfile>mbam-log-2014-05-22 (23-05-25).xml</logfile>

<isadmin>yes</isadmin>

</header>


-<engine>

<version>2.00.2.1012</version>

<malware-database>v2014.05.22.12</malware-database>

<rootkit-database>v2014.05.21.01</rootkit-database>

<license>trial</license>

<file-protection>enabled</file-protection>

<web-protection>enabled</web-protection>

<self-protection>disabled</self-protection>

</engine>


-<system>

<osversion>Windows 7 Service Pack 1</osversion>

<arch>x64</arch>

<username>NEROBYRN</username>

<filesys>NTFS</filesys>

</system>


-<summary>

<type>threat</type>

<result>completed</result>

<objects>268002</objects>

<time>584</time>

<processes>0</processes>

<modules>0</modules>

<keys>0</keys>

<values>0</values>

<datas>0</datas>

<folders>0</folders>

<files>9</files>

<sectors>0</sectors>

</summary>


-<options>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>disabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>


-<items>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nse5A5B.exe</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>95df9db7dc9f191d3873f43520e1de22</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nse996.exe</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>bdb7db798fec290df2b9df4ad62bbd43</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nsk5F5C.exe</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>1c58084cee8d26104467e84135cc649c</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nsp5481.exe</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>3d37aba909726acc3972d1585ea3a858</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nspEB6.exe</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>0173a4b04932f343802bd059d928ef11</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nsu14A0.exe</path>

<vendor>PUP.Optional.SearchProtect.A</vendor>

<action>success</action>

<hash>4e26450f730854e2d2d938f138c9ee12</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\sp-downloader.exe</path>

<vendor>PUP.Optional.Conduit.A</vendor>

<action>success</action>

<hash>a1d365efc0bb2016b027bf5da1609d63</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Local\Temp\nseD839\SpSetup.exe</path>

<vendor>PUP.Optional.Conduit.A</vendor>

<action>success</action>

<hash>b6bee371413ae452a1fa72acaa5741bf</hash>

</file>


-<file>

<path>C:\Users\NEROBYRN\AppData\Roaming\Mozilla\Firefox\Profiles\62q0d7pb.default\searchplugins\trovi-search.xml</path>

<vendor>PUP.Optional.Trovi.A</vendor>

<action>success</action>

<hash>443084d0b9c2a5914eb76a21fd055aa6</hash>

</file>

</items>

</mbam-log>


<?xml version="1.0" encoding="UTF-8"?>

-<logs>

<record subtype="Malware Protection" result="Starting" last_modified_tag="644b0f66-520d-4165-9397-d170cbfa46ee" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:31.204128+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malware Protection" result="Started" last_modified_tag="1e9a658a-976f-48b3-abd9-5ffb46dfd5cd" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:31.221129+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Starting" last_modified_tag="86ff5491-7bee-4e57-bc8b-626f6719f31f" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:31.261132+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Started" last_modified_tag="3fb54c18-bd8e-4ba9-b3ed-b4ae1f515ddc" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:35.034347+02:00" LoggingEventType="2" severity="debug"/>

<record last_modified_tag="514db02e-5759-4193-a028-765fe93ed1cb" systemname="NEROBYRN-HP" username="SYSTEM" type="Update" source="Manual" datetime="2014-05-22T23:04:36.867452+02:00" LoggingEventType="1" severity="debug" toVersion="2014.5.21.1" name="Rootkit Database" fromVersion="2014.2.20.1"/>

<record last_modified_tag="58f72d65-2d8d-4207-8539-b4d7bc794a3d" systemname="NEROBYRN-HP" username="SYSTEM" type="Update" source="Manual" datetime="2014-05-22T23:04:43.970858+02:00" LoggingEventType="1" severity="debug" toVersion="2014.5.22.12" name="Malware Database" fromVersion="2014.3.4.9"/>

<record subtype="Refresh" result="Starting" last_modified_tag="36ee7bbd-bfe0-4aa6-8a64-0e58fbea687a" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:45.107924+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Stopping" last_modified_tag="a1416317-5680-4e19-9424-04718df078ba" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:45.112924+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Stopped" last_modified_tag="affde5f4-c02f-4428-ab80-20bd2bef9e95" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:45.149926+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Refresh" result="Success" last_modified_tag="0f8b91cb-3ed1-43a7-a1bf-83faa5f031f7" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:49.850195+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Starting" last_modified_tag="8d9a2f22-1e76-4321-b7bd-bb04055bd804" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:49.874196+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Started" last_modified_tag="55e7b22c-5209-47d7-a381-5beceb16993f" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:04:50.120210+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malware Protection" result="Starting" last_modified_tag="34babcaa-5a4c-43ec-a983-f1720d926263" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:18:50.523709+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malware Protection" result="Started" last_modified_tag="bdda5f08-0f0b-4f41-bc09-7a97ba9212b4" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:18:50.601709+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Starting" last_modified_tag="5bbf3d5e-eae0-4046-a318-4a95cb45c3a5" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:18:50.617309+02:00" LoggingEventType="2" severity="debug"/>

<record subtype="Malicious Website Protection" result="Started" last_modified_tag="091cb075-12c0-451d-b766-078fc266aeeb" systemname="NEROBYRN-HP" username="SYSTEM" type="Protection" source="Protection" datetime="2014-05-22T23:20:44.513109+02:00" LoggingEventType="2" severity="debug"/>

</logs>
         
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=0a8fe4f326ffd04bb15721ac3172180a
# engine=18372
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2014-05-22 11:15:54
# local_time=2014-05-23 01:15:54 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 124494 152430404 0 0
# scanned=212901
# found=2
# cleaned=0
# scan_time=4732
sh=A15C9536148CE02615132AE1DB1A6BF8F873A726 ft=1 fh=41c25fe63c7f6257 vn="Win32/Toolbar.Conduit.R evtl. unerwünschte Anwendung" ac=I fn="C:\AdwCleaner\Quarantine\C\Users\babyrose\AppData\Roaming\OpenCandy\03B1B1E072A64E1CA01CCC8B46D54048\search_protect_global.exe.vir"
sh=08ADA5974AE4CDE0E1A2610F48486C71833811B7 ft=1 fh=39a4b8e5163e42ce vn="Variante von Win32/Conduit.SearchProtect.H evtl. unerwünschte Anwendung" ac=I fn="C:\Users\babyrose\AppData\Local\Temp\SPSetup.exe"
         

Antwort

Themen zu Probleme mit dem Browser > Malware
.com, andere, automatisch, avast, browser, erhalte, flash, flash player, gelöscht, gen, geändert, google, installiert, malware, meldungen, mozilla, nichts, player, plötzlich, probleme, seite, software, spybot, startseite, videos



Ähnliche Themen: Probleme mit dem Browser > Malware


  1. Malware erscheint nur im Firefox-Browser
    Plagegeister aller Art und deren Bekämpfung - 10.09.2015 (13)
  2. Malware im Browser und System
    Log-Analyse und Auswertung - 30.04.2015 (13)
  3. Malware / Browser Problem
    Plagegeister aller Art und deren Bekämpfung - 30.04.2015 (24)
  4. oha pc langsam und probleme mit dem browser
    Plagegeister aller Art und deren Bekämpfung - 22.10.2014 (17)
  5. Browser Popup Malware-Problem
    Plagegeister aller Art und deren Bekämpfung - 08.11.2013 (20)
  6. Probleme mit Browser
    Plagegeister aller Art und deren Bekämpfung - 17.01.2013 (3)
  7. Probleme mit Internet Browser
    Log-Analyse und Auswertung - 18.02.2011 (1)
  8. Browser Hijacker / Malware
    Plagegeister aller Art und deren Bekämpfung - 30.09.2010 (4)
  9. probleme mit Ton, Browser etc.
    Plagegeister aller Art und deren Bekämpfung - 17.07.2010 (7)
  10. Probleme mit Browser
    Alles rund um Windows - 20.04.2010 (27)
  11. Probleme mit Browser
    Alles rund um Windows - 30.11.2007 (3)
  12. Probleme mit Browser
    Plagegeister aller Art und deren Bekämpfung - 16.09.2007 (5)
  13. Probleme mit dem Browser
    Log-Analyse und Auswertung - 03.02.2007 (3)
  14. Probleme mit Browser
    Plagegeister aller Art und deren Bekämpfung - 28.01.2007 (1)
  15. Browser probleme
    Log-Analyse und Auswertung - 13.10.2006 (7)
  16. Probleme mit Browser 2. Ich hab's
    Log-Analyse und Auswertung - 01.05.2006 (1)
  17. Probleme mit dem Browser
    Log-Analyse und Auswertung - 01.05.2006 (13)

Zum Thema Probleme mit dem Browser > Malware - Hallo, ich habe Probleme mit meinem Browser. Einige Videos bei dailymotion habe ich geschaut. Plötzlich passiert, dass sich die Seite ändert und eine andere Seite erscheint (ein Gameseite). Manchmal wird - Probleme mit dem Browser > Malware...
Archiv
Du betrachtest: Probleme mit dem Browser > Malware auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.