Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   System Care Antivirus wirklich komplett entfernt? (https://www.trojaner-board.de/137734-system-care-antivirus-wirklich-komplett-entfernt.html)

trishohara 05.07.2013 07:49
System Care Antivirus wirklich komplett entfernt?
 
Hallo,
Donnerstag nachmittag poppte bei mir das System Care Antivirus Fenster hoch und fing an zu 'scannen'.
Ich war etwas irritiert, aber fuhr den Sony Laptop sofort runter und startete in abgesicherten Modus.
Dann googelte ich übers iPad, und fand ein paar Foreneinträge, wo bechrieben war, was man tun könnte. Ich probierte einige der Tools aus, alles im abgesicherten Modus.
Eins der Tools machte dann einen Neustart, darauf hin scannte ich den Computer noch mit Eset Online Scanner.
Es schien dann alles ok.
Nur Microsoft Security Essentials ließ sich nicht starten.
Also dachte ich, ich gehe auf einen Wiederherstellungspunkt zurück, ich wählte den am weitesten zurückliegenden von Ende Mai.
Beim nächsten Neustart lief MSE, ich aktualisierte die Virendefinition. Dabei merkte ich, daß im Reiter Verlauf stand: rogue win32/winwebsec, gefährlich, Aktion: zugelassen
Das heißt, der Virus war immer noch da, und hatte sich automatisch im Virenscanner als 'zugelassen' aktiviert. Dies konnte ich auch nicht ändern.
Während ich einen Scan mit Malwarebytes Anti-Malware machte, erkannte MSE dieses rogue win32... noch einmal, diesmal stellte es es aber in Quarantäne. Ebenso wie einen anderen Trojaner.
Malware fand nichts.
Danach ließ ich eine Rescue CD von Avira durchlaufen. (neu downgeloaded und gestern gebrannt)
Diese fand auch nichts.
Danach eine ebenso gestern downgeloadete Rescue CD von Kapersky mit Windows Unlocker.
Windows Unlocker fand ein googleupdate.exe, das es entfernte.
Der Scan danach mit der Rescue Disk fand nichts.

Aber ist das jetzt sicher? Ist der Virus wirklich weg?
Oder sollte ich doch lieber ein komplettes Restore mit der Recovery von Vaio machen?

Bitte um Rat.

gruß
Andi

schrauber 05.07.2013 08:57
Hi,

Systemscan mit FRST
Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Scan.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

trishohara 05.07.2013 09:18
Hallo Schrauber,
vielen Dank für deine schnelle Antwort und vielen Dank im Vorraus für die Hilfe.

frst.txt

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by trishohara (administrator) on 05-07-2013 10:14:59
Running from C:\Users\trishohara\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
() C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe
() C:\Program Files (x86)\Expat Shield\bin\hsswd.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
() C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicator.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [13374568 2011-12-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO  [2277992 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [947360 2011-07-05] (Atheros Communications)
HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [797344 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated)
HKLM\...\Run: [Classic Start Menu] C:\Program Files\Classic Shell\ClassicStartMenu.exe [98304 2010-07-29] (IvoSoft)
HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436736 2011-06-15] (Microsoft Corporation)
HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4  [2277992 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /DTSU2P  [2277992 2011-11-15] (Realtek Semiconductor)
HKCU\...\Run: [HP Deskjet 3520 series (NET)] "C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AN112P705SY:NW" -scfn "HP Deskjet 3520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [7032920 2013-04-10] (SlySoft, Inc.)
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [2801288 2011-05-31] (Sony Corporation)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [151952 2012-11-29] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [x]
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [513048 2013-03-20] (CyberLink Corp.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk
ShortcutTarget: BBC iPlayer Desktop.lnk -> C:\Program Files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe ()
Startup: C:\Users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://sony.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://vaioportal.sony.eu
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {41812E44-598A-401F-AB23-573502F38661} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
SearchScopes: HKCU - {DD40B60A-0114-4FB6-B335-1277870C1021} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE_64.dll (AnchorFree Inc.)
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll (AnchorFree Inc.)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: msdaipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Winsock: Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.)
Winsock: Catalog9 13 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.)
Winsock: Catalog9-x64 12 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.)
Winsock: Catalog9-x64 13 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.)
Tcpip\Parameters: [DhcpNameServer] 8.8.8.8 8.8.4.4
Tcpip\..\Interfaces\{E4AA3406-CA7C-4E4A-AD32-E3DDBB9ABD9C}: [NameServer]8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default
FF Homepage: https://twitter.com/|hxxp://www.angrybirdsnest.com/|https://www.facebook.com/|hxxp://www.flickr.com/photos/hansolo401/|hxxp://www.fbtb.net/forums/search.php?search_id=newposts|hxxp://www.1000steine.de/de/gemeinschaft/forum/?show=1&cat=a
FF NetworkProxy: "http", "216.155.139.115"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Extension: British English Dictionary - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\en-GB@dictionaries.addons.mozilla.org
FF Extension: Echofon - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\twitternotifier@naan.net
FF Extension: ColorZilla - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
FF Extension: DownloadHelper - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: compatibility - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\compatibility@addons.mozilla.org.xpi
FF Extension: firebug - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: leethax - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\leethax@leethax.net.xpi
FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}.xpi
FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\afurladvisor@anchorfree.com
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Media Go Detector) - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Angry Birds) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.1.2.1_0
CHR Extension: (YouTube) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0
CHR Extension: (Google Search) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0
CHR Extension: (Gmail) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros)
R2 CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-03-20] (CyberLink)
R2 CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [323336 2013-03-20] (CyberLink)
R2 ExpatShieldService; C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [331608 2011-12-29] ()
S4 ExpatTrayService; C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.EXE [77520 2012-01-06] ()
R2 ExpatWd; C:\Program Files (x86)\Expat Shield\bin\hsswd.exe [329544 2012-01-05] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [12784 2011-04-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [288272 2011-04-27] (Microsoft Corporation)
S4 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S4 ufad-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [x]

==================== Drivers (Whitelisted) ====================

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [142424 2013-03-18] (SlySoft, Inc.)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [189440 2011-04-18] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [84864 2011-04-27] (Microsoft Corporation)
S2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC)
R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R3 WsAudio_Device; C:\Windows\System32\drivers\VirtualAudio.sys [31080 2013-01-08] (Wondershare)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-05 10:10 - 2013-07-05 10:11 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe
2013-07-03 21:38 - 2013-07-03 21:41 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe
2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan
2013-07-03 21:30 - 2013-07-03 21:35 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part
2013-07-03 20:37 - 2013-07-03 20:38 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796
2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt
2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt
2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt
2013-07-03 18:02 - 2013-07-03 18:02 - 00001452 ____A C:\Users\trishohara\Desktop\JRT.txt
2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 17:58 - 2013-07-03 21:14 - 00000000 ____D C:\JRT
2013-07-03 17:54 - 2013-07-03 17:55 - 00001601 ____A C:\AdwCleaner[S1].txt
2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt
2013-07-03 17:49 - 2013-07-03 21:13 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine
2013-07-03 17:43 - 2013-07-03 17:43 - 00025107 ____A C:\ComboFix.txt
2013-07-03 17:20 - 2013-07-03 21:13 - 00000000 ____D C:\Windows\erdnt
2013-07-03 17:20 - 2013-07-03 17:43 - 00000000 ____D C:\Qoobox
2013-07-03 17:13 - 2013-07-03 17:13 - 00029531 ____A C:\Users\trishohara\Downloads\Addition.txt
2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST
2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip
2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore
2013-06-21 15:59 - 2013-06-26 13:00 - 00000000 ____D C:\ProgramData\tmp
2013-06-21 15:59 - 2013-06-21 21:22 - 00000000 ____D C:\ProgramData\hps
2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR
2013-06-21 12:42 - 2013-06-21 14:31 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls
2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls

==================== One Month Modified Files and Folders =======

2013-07-05 10:14 - 2013-05-02 19:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-05 10:14 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-05 10:14 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-05 10:13 - 2011-12-06 19:44 - 01750609 ____A C:\Windows\WindowsUpdate.log
2013-07-05 10:12 - 2011-08-13 00:32 - 00705888 ____A C:\Windows\System32\perfh007.dat
2013-07-05 10:12 - 2011-08-13 00:32 - 00151918 ____A C:\Windows\System32\perfc007.dat
2013-07-05 10:12 - 2009-07-14 07:13 - 01638732 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 10:11 - 2013-07-05 10:10 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe
2013-07-05 10:10 - 2012-01-29 15:20 - 00000000 ____D C:\Users\trishohara\Documents\Mein Steuer-Sparbuch Heute
2013-07-05 10:07 - 2013-05-02 16:47 - 00000040 ___SH C:\ProgramData\.zreglib
2013-07-05 10:07 - 2011-12-06 20:23 - 00000000 ____D C:\Users\trishohara\Documents\Bluetooth Folder
2013-07-05 10:06 - 2011-12-07 19:50 - 00000000 ____D C:\ProgramData\VMware
2013-07-05 10:06 - 2011-08-12 14:52 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-05 10:06 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-05 10:06 - 2009-07-14 06:51 - 00055162 ____A C:\Windows\setupact.log
2013-07-05 10:06 - 2009-07-14 06:45 - 00446336 ____A C:\Windows\System32\FNTCACHE.DAT
2013-07-04 10:53 - 2012-02-05 21:23 - 00001140 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job
2013-07-04 10:41 - 2013-03-31 13:11 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-03 21:41 - 2013-07-03 21:38 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe
2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan
2013-07-03 21:35 - 2013-07-03 21:30 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part
2013-07-03 21:16 - 2011-12-06 19:45 - 00000000 ____D C:\users\trishohara
2013-07-03 21:14 - 2013-07-03 17:58 - 00000000 ____D C:\JRT
2013-07-03 21:14 - 2012-05-31 19:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-03 21:14 - 2012-05-03 21:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 21:14 - 2012-04-17 18:37 - 00000000 ____D C:\Program Files (x86)\Software4u
2013-07-03 21:14 - 2012-02-13 21:21 - 00000000 ____D C:\Windows\System32\Macromed
2013-07-03 21:14 - 2012-02-06 13:43 - 00000000 ____D C:\Program Files\Oracle
2013-07-03 21:14 - 2012-01-17 21:20 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\vlc
2013-07-03 21:14 - 2011-12-10 15:20 - 00000000 ____D C:\Program Files (x86)\IrfanView
2013-07-03 21:14 - 2011-12-10 15:18 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Notepad++
2013-07-03 21:14 - 2011-08-12 14:56 - 00000000 ____D C:\Program Files\Java
2013-07-03 21:14 - 2011-08-12 14:53 - 00000000 ____D C:\ProgramData\Atheros
2013-07-03 21:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-07-03 21:13 - 2013-07-03 17:49 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine
2013-07-03 21:13 - 2013-07-03 17:20 - 00000000 ____D C:\Windows\erdnt
2013-07-03 21:13 - 2011-12-07 18:43 - 00000000 ____D C:\Users\trishohara\AppData\Local\Thunderbird
2013-07-03 21:13 - 2011-12-06 22:33 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Mozilla
2013-07-03 21:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-03 21:11 - 2012-02-19 12:14 - 00000000 ____D C:\ProgramData\CyberLink
2013-07-03 21:11 - 2012-02-05 21:23 - 00000000 ____D C:\Users\trishohara\AppData\Local\Google
2013-07-03 21:11 - 2011-08-12 15:01 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-07-03 21:10 - 2011-08-12 14:57 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-03 20:38 - 2013-07-03 20:37 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796
2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt
2013-07-03 20:22 - 2012-05-05 18:46 - 00000000 ____D C:\Windows\System32\appmgmt
2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt
2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt
2013-07-03 18:02 - 2013-07-03 18:02 - 00001452 ____A C:\Users\trishohara\Desktop\JRT.txt
2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 17:55 - 2013-07-03 17:54 - 00001601 ____A C:\AdwCleaner[S1].txt
2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt
2013-07-03 17:43 - 2013-07-03 17:43 - 00025107 ____A C:\ComboFix.txt
2013-07-03 17:43 - 2013-07-03 17:20 - 00000000 ____D C:\Qoobox
2013-07-03 17:13 - 2013-07-03 17:13 - 00029531 ____A C:\Users\trishohara\Downloads\Addition.txt
2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST
2013-07-01 16:47 - 2012-01-12 13:29 - 00036352 ____A C:\Users\trishohara\Documents\monatlAusgaben.xls
2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip
2013-06-26 13:00 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\tmp
2013-06-24 12:18 - 2011-12-10 15:05 - 00000000 ____D C:\Users\trishohara\Documents\Eigene PSP-Dateien
2013-06-22 21:21 - 2012-03-14 19:03 - 00000000 ____D C:\Users\trishohara\AppData\Local\CrashDumps
2013-06-21 21:22 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\hps
2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore
2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR
2013-06-21 14:31 - 2013-06-21 12:42 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls
2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls
2013-06-10 16:13 - 2013-05-07 18:15 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Mai2013.xls

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-04 10:00

==================== End Of Log ============================
--- --- ---


addition.txt
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-07-2013
Ran by trishohara at 2013-07-05 10:15:17
Running from C:\Users\trishohara\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

?????? Windows Live (x32 Version: 15.4.3502.0922)
??????? ????????? Windows Live Mesh ActiveX ??? ?????????? ?????????? (x32 Version: 15.4.5722.2)
??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ??????????? (x32 Version: 15.4.5722.2)
???????? ?????????? Windows Live (x32 Version: 15.4.3502.0922)
?????????? Windows Live (x32 Version: 15.4.3502.0922)
??????????? ?? Windows Live (x32 Version: 15.4.3502.0922)
???????????? Windows Live (x32 Version: 15.4.3502.0922)
7-Zip 9.20 (x32)
Adobe AIR (x32 Version: 2.7.0.19460)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.202)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.202)
Adobe Photoshop Elements 9 (x32 Version: 9.0)
Adobe Premiere Elements 9 (x32 Version: 9.0)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Aimersoft Video Converter Ultimate(Build 5.0.1.0) (x32 Version: 5.0.1.0)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Android SDK Tools (x32 Version: 1.14)
Angry Birds Seasons (x32 Version: 2.2.0)
AnyDVD (x32 Version: 7.1.8.0)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.149)
ArcSoft WebCam Companion 4 (x32 Version: 4.0.444)
Atheros WiFi Driver Installation (x32 Version: 3.0)
AVIcodec (remove only) (x32)
BBC iPlayer Desktop (x32 Version: 3.2.15)
Bing Bar (x32 Version: 7.0.850.0)
Bluetooth Win7 Suite (64) (Version: 7.04.000.82)
Bonjour (Version: 3.0.0.10)
BrickStore (x32 Version: 1.1.16)
Classic Shell (Version: 2.8.3)
Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6514.5001)
Corel WinDVD (x32 Version: 10.0.6.108)
Corel WinDVD (x32 Version: 11)
Corel WinDVD Pro 11 (x32 Version: 11.0.0.342)
CSS3 Menu (x32)
CyberLink PowerDVD 13 (x32 Version: 13.0.2720.57)
D3DX10 (x32 Version: 15.4.2368.0902)
Dolby Home Theater v4 (x32 Version: 7.2.7000.6)
DVD Shrink 3.2 (x32)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
Evernote v. 4.4 (x32 Version: 4.4.0.4848)
Expat Shield 2.24 (x32 Version: 2.24)
FileZilla Client 3.5.3 (x32 Version: 3.5.3)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Google Chrome (HKCU Version: 26.0.1410.64)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Deskjet 3520 series Hilfe (x32 Version: 27.0.0)
HP Deskjet 3520 series Setup Guide (x32 Version: 27.0.0)
HP FWUpdateEDO2 (x32 Version: 1.2.0.0)
HP Photo Creations (x32 Version: 1.0.0.7702)
HP Update (x32 Version: 5.003.003.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
ICA (x32 Version: 1.0)
iDevice Manager (x32 Version: 1.2.1.0)
iExplorer 2.2.1.3 (x32)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
IPM (x32 Version: 1.00.0000)
IrfanView (remove only) (x32)
iTunes (Version: 11.0.0.163)
Jasc Paint Shop Pro 9 (x32 Version: 9.00.0000)
Java Auto Updater (x32 Version: 2.0.5.1)
Java(TM) 6 Update 26 (64-bit) (Version: 6.0.260)
Java(TM) 6 Update 26 (x32 Version: 6.0.260)
Java(TM) 7 Update 2 (64-bit) (Version: 7.0.20)
Java(TM) SE Development Kit 7 Update 2 (64-bit) (Version: 1.7.0.20)
JavaFX 2.0.2 (64-bit) (Version: 2.0.2)
JavaFX 2.0.2 SDK (64-bit) (Version: 2.0.2)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
LEGO® Star Wars™: Die Komplette Saga (x32 Version: 1.00.0000)
LEGO® Star Wars™: The Complete Saga (x32 Version: 1.00.0000)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)
MAGIX Video deluxe MX Premium (x32 Version: 11.0.0.42)
Malwarebytes Anti-Malware Version 1.61.0.1400 (x32 Version: 1.61.0.1400)
Media Gallery (Version: 1.5.0.17250)
Media Go (x32 Version: 1.7.254)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Antimalware (Version: 3.0.8402.2)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Security Client (Version: 2.1.1116.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 2.1.1116.0)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 20.0.1 (x86 de) (x32 Version: 20.0.1)
Mozilla Maintenance Service (x32 Version: 20.0.1)
Mozilla Thunderbird 9.0.1 (x86 de) (x32 Version: 9.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Notepad++ (x32 Version: 5.9.6.2)
NVIDIA 3D Vision Treiber 268.93 (Version: 268.93)
NVIDIA 3D Vision Video Player (x32 Version: 1.6.9)
NVIDIA Grafiktreiber 268.93 (Version: 268.93)
NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1)
NVIDIA Install Application (Version: 2.265.42.0)
NVIDIA PhysX (x32 Version: 9.10.0514)
NVIDIA PhysX-Systemsoftware 9.10.0514 (Version: 9.10.0514)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6893)
NVIDIA Systemsteuerung 268.93 (Version: 268.93)
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená pripojení (x32 Version: 15.4.5722.2)
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2)
Pazera Free MP4 to AVI Converter 1.6 (x32 Version: 1.6)
PlayStation(R)Network Downloader (x32 Version: 2.05.00710)
PlayStation(R)Store (x32 Version: 4.1.8.11883)
PMB (x32 Version: 5.6.01.03300)
PMB VAIO Edition Plug-in (Version: 1.5.10.05300)
PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06010)
Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Portal (x32)
Portal 2 (x32)
PowerDVD (x32)
Quick Web Access (x32 Version: 1.4.6.10)
QuickTime (x32 Version: 7.73.80.64)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526)
Remote Keyboard (x32 Version: 1.1.1.07060)
Remote Play with PlayStation 3 (x32 Version: 1.1.0.15072)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922)
Setup (x32 Version: 11.0)
Skype™ 5.1 (x32 Version: 5.1.104)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090)
Sony Corporation (Version: 1.0.0)
SourceTree (HKCU Version: 0.9.1.0)
SSLx64 (Version: 1.0.0)
SSLx86 (x32 Version: 1.0.0)
St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se?? (x32 Version: 15.4.5722.2)
Star Wars Knights of the Old Republic (x32 Version: 1.0)
Steam (x32 Version: 1.0.0.0)
StreamTransport version: 1.0.2.2171 (x32)
Studie zur Verbesserung von HP Deskjet 3520 series Produkten (Version: 28.0.1315.0)
SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49 (x32 Version: v2011.build.49)
Synaptics Pointing Device Driver (Version: 15.2.6.0)
tools-freebsd (x32 Version: 8.4.6.16648)
tools-linux (x32 Version: 8.4.6.16648)
tools-netware (x32 Version: 8.4.6.16648)
tools-solaris (x32 Version: 8.4.6.16648)
tools-windows (x32 Version: 8.4.6.16648)
tools-winPre2k (x32 Version: 8.4.6.16648)
TVO version 3.7 (x32 Version: 3.7)
TweetDeck (x32 Version: 1.0.0)
Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
V3DPX86 (x32 Version: 1.0.0)
VAIO - Media Gallery (x32 Version: 1.5.0.18100)
VAIO - PMB VAIO Edition Guide (x32 Version: 1.6.00.06030)
VAIO - PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06140)
VAIO - Remote Play mit PlayStation®3 (x32 Version: 1.1.0.15072)
VAIO - Remote-Tastatur  (x32 Version: 1.1.0.07060)
VAIO 3D Portal (x32 Version: 1.1.0.06232)
VAIO Control Center (x32 Version: 5.0.0.07070)
VAIO Data Restore Tool (x32 Version: 1.7.0.05270)
VAIO Easy Connect (x32 Version: 1.0.0.03050)
VAIO Gate (x32 Version: 2.4.0.06210)
VAIO Gate Default (x32 Version: 2.5.0.07080)
VAIO Hero Screensaver - Fall 2011 Screensaver (x32)
VAIO Improvement (x32 Version: 1.1.0.06030)
VAIO Improvement Validation (Version: 1.0.4.01190)
VAIO Sample Contents (x32 Version: 1.4.2.09010)
VAIO Smart Network (x32 Version: 3.7.0.07150)
VAIO Update (x32 Version: 5.5.0.06290)
VAIO Update Merge Module x64 (Version: 5.5.06290)
VAIO-Handbuch (x32 Version: 1.4.0.05310)
VAIO-Support für Übertragungen (x32 Version: 1.4.0.14230)
VCCx64 (Version: 1.0.0)
VCCx86 (x32 Version: 1.0.0)
VHD (x32 Version: 1.0.0)
VIx64 (Version: 1.0.0)
VIx86 (x32 Version: 1.0.0)
VLC media player 2.0.6 (x32 Version: 2.0.6)
VMware Workstation (x32 Version: 7.1.4.16648)
VPMx64 (Version: 1.0.0)
VSNx64 (Version: 1.0.0)
VSNx86 (x32 Version: 1.0.0)
VWSTx86 (x32 Version: 1.0.0)
Winamp (Remove Only) (x32)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WinSCP 4.3.8 (x32 Version: 4.3.8)
WISO Steuer-Sparbuch 2012 (x32 Version: 19.00.7303)
WISO Steuer-Sparbuch 2013 (x32 Version: 20.00.8137)
XAMPP 1.8.1-0 (x32 Version: 1.8.1-0)
Xvid 1.2.2 final uninstall (x32 Version: 1.2)

==================== Restore Points  =========================

01-06-2013 20:56:06 Windows Update
05-06-2013 16:20:26 Windows Update
09-06-2013 09:24:31 Windows Update
20-06-2013 08:12:54 Windows Update
23-06-2013 14:28:04 Windows Update
28-06-2013 14:49:48 Windows Update
03-07-2013 18:21:20 Removed JavaFX 2.0.2 SDK (64-bit)
03-07-2013 18:22:44 Removed Java(TM) 6 Update 26
03-07-2013 18:24:01 Removed Java(TM) 6 Update 26 (64-bit)
03-07-2013 18:24:43 Removed Java(TM) 7 Update 2 (64-bit)
03-07-2013 18:25:19 Removed Java(TM) SE Development Kit 7 Update 2 (64-bit)
03-07-2013 18:26:01 Removed JavaFX 2.0.2 (64-bit)
03-07-2013 18:37:10 Windows Update
03-07-2013 19:07:33 Wiederherstellungsvorgang
03-07-2013 19:20:29 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {0F4AB92F-E05D-4A8F-9E77-55DDAC553141} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-06-03] (Sony Corporation)
Task: {1466E89D-C2CC-49AE-A4D8-6764E7FA65B4} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {1D983A4E-E1DB-4085-A2E8-75F279F16B1C} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation)
Task: {1F36B366-6BA0-470A-8E08-16076FD91E8A} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-06-21] (Sony Corporation)
Task: {27D1261B-2559-4EE7-99DC-0BDC4BFF1528} - System32\Tasks\{9FCEF174-62CC-4642-B14F-3A2DF8501B8A} => C:\Program Files (x86)\CyberLink\PowerDVD\PowerDVD.exe [2003-08-05] (CyberLink Corp.)
Task: {337C50B5-B503-4C7E-8D3E-A630C0C40C6B} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation)
Task: {3D37C76C-BA73-4084-B316-CBC83ADEDBBD} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2011-06-30] (Sony Corporation)
Task: {433AB431-E3FC-4B78-A7C8-053CBF353BF8} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIcon => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe No File
Task: {44FADF11-9AB6-46DD-9816-5F965A440DBB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31] (Adobe Systems Incorporated)
Task: {479102CF-47D9-4E1B-9E27-77563BA3B8A7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4B8E085B-F53F-4C27-BDCD-0A4B4B5A7E16} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {542A311B-52F0-4D32-A452-47105714073F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {618ADA85-A135-4D81-8A4E-87CE17798D3D} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation)
Task: {7127EFC9-ED61-42E9-B823-C6F4BA2A3F61} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient No File
Task: {7692B3EA-121B-4ECF-87A6-CC6AD35746F6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.)
Task: {814A056C-ED62-4262-ADFA-9DB0B6A028BC} - System32\Tasks\Sony Corporation\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2011-06-21] (Sony Corporation)
Task: {91D0B37E-238F-473D-B7CD-02CAD0C04B5F} - System32\Tasks\Microsoft\Microsoft Antimalware\MpIdleTask => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation)
Task: {A19FD96A-A3A7-48E1-915A-F04F8BFA8C75} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation)
Task: {A7E245A6-921F-4EEE-B4A3-A00F1861B897} - System32\Tasks\Sony Corporation\VAIO Care\VCUpdateLearn => C:\Program Files\Sony\VAIO Care\VCsystray.exe No File
Task: {B7EADB6F-BC45-43A0-8E38-2D57816D7331} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.)
Task: {D42077B3-CA2B-4ADF-B38A-049AF9C70FEA} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation)
Task: {DC14E697-3EC4-486F-8C12-CA347690845D} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation)
Task: {DC21B924-5D92-4393-A11B-AB883C4661C4} - System32\Tasks\{35CEFC5E-F302-42EB-91C9-A97F243584F9} => C:\Program Files (x86)\iPhone Explorer\iExplorer.exe [2011-12-06] (Macroplant)
Task: {FC50458D-C82F-44AE-B805-1D07EDF4BCCA} - System32\Tasks\AdobeAAMUpdater-1.0-trishohara-VAIO-trishohara => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {FCBAAC13-FEC3-441D-91B9-ACE445E4C9E0} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (07/05/2013 10:07:41 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service) (User: )
Description: Fehler bei der Erfassung des authentischen Tickets (hr=0x80072EE7) für die Vorlagen-ID 66c92734-d682-4d71-983e-d6ec3f16059f.

Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service) (User: )
Description: Lizenzerwerb-Fehlerdetails.
hr=0x80072EE7

Error: (07/04/2013 10:02:38 AM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>. Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.

Error: (07/04/2013 07:51:27 AM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/03/2013 09:17:36 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/03/2013 08:33:02 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/03/2013 08:26:33 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in
Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit
einer anderen, bereits aktiven Komponentenversion.
In Konflikt stehende Komponenten:.
Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.


System errors:
=============
Error: (07/05/2013 10:06:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "risdsnpe" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1058

Error: (07/05/2013 10:06:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (07/04/2013 07:50:04 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (07/03/2013 09:16:28 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (07/03/2013 09:16:14 PM) (Source: Microsoft Antimalware) (User: )
Description: Fehler in %60 beim Laden von Signaturen. Es wird versucht, einen bekannten Signatursatz wiederherzustellen.

        Versuchte Signaturen: %24

        Fehlercode: 0x80070002

        Fehlerbeschreibung: Das System kann die angegebene Datei nicht finden.

        Signaturversion: 0.0.0.0;0.0.0.0

        Modulversion: %600

Error: (07/03/2013 08:31:35 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee SiteAdvisor Service" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2

Error: (07/03/2013 06:17:20 PM) (Source: DCOM) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (07/05/2013 10:07:41 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service)(User: )
Description: hr=0x80072EE766c92734-d682-4d71-983e-d6ec3f16059f

Error: (07/04/2013 10:02:51 AM) (Source: Software Protection Platform Service)(User: )
Description: hr=0x80072EE700010001(0x00000000, 10:02:44:501 - hxxp://go.microsoft.com/fwlink/?LinkId=151642)
00020001(0x00000000, 10:02:44:501)
00030001(0x00000000, 10:02:44:501 - hxxp://go.microsoft.com)
00030002(0x00000000, 10:02:44:501 - 0)
00040001(0x00000000, 10:02:44:501 - hxxp://go.microsoft.com)
00040002(0x00000000, 10:02:44:501 - 1, <NULL>, <NULL>, <NULL>)
00040004(0x80072F94, 10:02:51:677 - <NULL>)
00040006(0x00000000, 10:02:51:677 - 1, hxxp://go.microsoft.com, <NULL>, <local>)
00020005(0x00000000, 10:02:51:677 - 0)
00020007(0x80072EE7, 10:02:51:677)
00010002(0x80072EE7, 10:02:51:677 - <NULL>)
00010003(0x80072EE7, 10:02:51:677)

Error: (07/04/2013 10:02:38 AM) (Source: Microsoft-Windows-CAPI2)(User: )
Description: hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabEin erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.

Error: (07/04/2013 07:51:27 AM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/03/2013 09:17:36 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/03/2013 08:33:02 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/03/2013 08:26:33 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\trishohara\Downloads\esetsmartinstaller_enu.exe


CodeIntegrity Errors:
===================================
  Date: 2013-07-03 17:36:19.853
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-03 17:36:19.853
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-05-06 13:19:45.182
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:45.161
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:45.105
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:45.025
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:44.979
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:44.826
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:44.747
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:44.211
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 31%
Total physical RAM: 8173.22 MB
Available physical RAM: 5606.23 MB
Total Pagefile: 16344.63 MB
Available Pagefile: 13652.77 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:328.45 GB) (Free:161.01 GB) NTFS (Disk=0 Partition=3)
Drive g: (Volume) (Fixed) (Total:249.23 GB) (Free:35.84 GB) NTFS (Disk=0 Partition=4)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 7FA122EA)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=328 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=249 GB) - (Type=OF Extended)

==================== End Of Log ============================

schrauber 05.07.2013 09:42
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!
Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

trishohara 05.07.2013 10:10
Wieso hat Combofix den BBC iPlayer gelöscht? Kann der infiziert gewesen sein?

Code:
ComboFix 13-07-04.01 - trishohara 05.07.2013  10:55:44.1.4 - x64
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.8173.6415 [GMT 2:00]
ausgeführt von:: c:\users\trishohara\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-06-05 bis 2013-07-05  ))))))))))))))))))))))))))))))
.
.
2013-07-05 09:04 . 2013-07-05 09:04        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-07-03 15:12 . 2013-07-03 15:12        --------        d-----w-        C:\FRST
2013-06-21 18:13 . 2013-06-21 18:13        --------        d-----w-        c:\users\trishohara\restore
2013-06-21 13:59 . 2013-06-26 11:00        --------        d-----w-        c:\programdata\tmp
2013-06-21 13:59 . 2013-06-21 19:22        --------        d-----w-        c:\programdata\hps
2013-06-21 13:53 . 2013-06-21 13:53        --------        d-----w-        c:\program files (x86)\CEWE COLOR
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-05 08:41 . 2013-03-31 11:11        692104        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-07-05 08:41 . 2011-08-12 13:06        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-05 08:41 . 2013-03-31 11:41        17018248        ----a-w-        c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-07-05 08:07 . 2010-06-24 09:33        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-06-12 03:08 . 2011-12-07 17:52        9552976        ----a-w-        c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-05-02 15:29 . 2010-11-21 03:27        278800        ------w-        c:\windows\system32\MpSigStub.exe
2006-05-03 11:06        163328        --sha-r-        c:\windows\SysWOW64\flvDX.dll
2007-02-21 12:47        31232        --sha-r-        c:\windows\SysWOW64\msfDX.dll
2008-03-16 14:30        216064        --sha-r-        c:\windows\SysWOW64\nbDX.dll
2010-01-06 23:00        107520        --sha-r-        c:\windows\SysWOW64\TAKDSDecoder.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2012-01-04 23:02        233288        ----a-w-        c:\program files (x86)\Expat Shield\HssIE\ExpatIE.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-07-29 06:15        316416        ----a-w-        c:\program files\Classic Shell\ClassicExplorer32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Deskjet 3520 series (NET)"="c:\program files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416]
"AnyDVD"="c:\program files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe" [2013-04-10 7032920]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-12 283160]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-05-31 2801288]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-11-28 151952]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"Aimersoft Helper Compact.exe"="c:\program files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe" [BU]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"PowerDVD13Agent"="c:\program files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [2013-03-20 513048]
.
c:\users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN2AN112P705SY;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
WISO Mein Steuer-Sparbuch heute.lnk - c:\program files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe [2013-1-5 1397840]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer6"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe;c:\progra~2\mcafee\SITEAD~1\mcsacore.exe [x]
R2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsnxc64.sys;c:\windows\SYSNATIVE\drivers\risdsnxc64.sys [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 ATHDFU;Atheros Valkyrie USB BootROM;c:\windows\System32\Drivers\AthDfu.sys;c:\windows\SYSNATIVE\Drivers\AthDfu.sys [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 btath_avdt;Atheros Bluetooth AVDT Service;c:\windows\system32\drivers\btath_avdt.sys;c:\windows\SYSNATIVE\drivers\btath_avdt.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\drivers\btath_hcrp.sys;c:\windows\SYSNATIVE\drivers\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\drivers\btath_rcp.sys;c:\windows\SYSNATIVE\drivers\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft-Netzwerkinspektion;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe;c:\program files\Microsoft Security Client\Antimalware\NisSrv.exe [x]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;%TsUsbGD.DeviceDesc.Generic%;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [x]
R4 ExpatSrv;Expat Shield Routing Service;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe;c:\program files (x86)\Expat Shield\HssWPR\hsssrv.exe [x]
R4 ExpatTrayService;Expat Shield Tray Service;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE;c:\program files (x86)\Expat Shield\bin\ExpatTrayService.EXE [x]
R4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [x]
R4 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
R4 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
R4 VMUSBArbService;VMware USB Arbitration Service;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe;c:\program files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
S2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2013/05/02 17:36];c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [x]
S2 AdobeActiveFileMonitor9.0;Adobe Active File Monitor V9;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe [x]
S2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
S2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [x]
S2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [x]
S2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [x]
S2 ExpatShieldService;Expat Shield Service;c:\program files (x86)\Expat Shield\bin\openvpnas.exe;c:\program files (x86)\Expat Shield\bin\openvpnas.exe [x]
S2 ExpatWd;Expat Shield Monitoring Service;c:\program files (x86)\Expat Shield\bin\hsswd.exe;c:\program files (x86)\Expat Shield\bin\hsswd.exe [x]
S2 Fabs;FABS - Helping agent for MAGIX media database;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe;c:\program files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys;c:\windows\SYSNATIVE\drivers\vmci.sys [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\drivers\btath_bus.sys;c:\windows\SYSNATIVE\drivers\btath_bus.sys [x]
S3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
S3 MpNWMon;Microsoft Malware Protection Network Driver;c:\windows\system32\DRIVERS\MpNWMon.sys;c:\windows\SYSNATIVE\DRIVERS\MpNWMon.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
S3 Point64;Microsoft IntelliPoint Filter Driver;c:\windows\system32\DRIVERS\point64.sys;c:\windows\SYSNATIVE\DRIVERS\point64.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update Common\VUAgent.exe;c:\program files\Sony\VAIO Update Common\VUAgent.exe [x]
S3 WsAudio_Device;WsAudio_Device;c:\windows\system32\drivers\VirtualAudio.sys;c:\windows\SYSNATIVE\drivers\VirtualAudio.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-05 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31 11:11]
.
2013-05-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job
- c:\users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05 19:23]
.
2013-07-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job
- c:\users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05 19:23]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908}]
2012-01-04 23:02        287048        ----a-w-        c:\program files (x86)\Expat Shield\HssIE\ExpatIE_64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ShareOverlay]
@="{594D4122-1F87-41E2-96C7-825FB4796516}"
[HKEY_CLASSES_ROOT\CLSID\{594D4122-1F87-41E2-96C7-825FB4796516}]
2010-07-29 06:15        378368        ----a-w-        c:\program files\Classic Shell\ClassicExplorer64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992]
"AtherosBtStack"="c:\program files (x86)\Bluetooth Suite\BtvStack.exe" [2011-07-05 947360]
"AthBtTray"="c:\program files (x86)\Bluetooth Suite\AthBtTray.exe" [2011-07-05 797344]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"Classic Start Menu"="c:\program files\Classic Shell\ClassicStartMenu.exe" [2010-07-29 98304]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2011-08-01 2417032]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 1436736]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992]
"RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://vaioportal.sony.eu
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = <local>;*.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\program files (x86)\VMware\VMware Workstation\vsocklib.dll
TCP: Interfaces\{E4AA3406-CA7C-4E4A-AD32-E3DDBB9ABD9C}: NameServer = 8.8.8.8
FF - ProfilePath - c:\users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\
FF - prefs.js: browser.startup.homepage - hxxps://twitter.com/|hxxp://www.angrybirdsnest.com/|https://www.facebook.com/|hxxp://www.flickr.com/photos/hansolo401/|hxxp://www.fbtb.net/forums/search.php?search_id=newposts|hxxp://www.1000steine.de/de/gemeinschaft/forum/?show=1&cat=a
FF - prefs.js: network.proxy.http - 216.155.139.115
FF - prefs.js: network.proxy.http_port - 3128
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2013-05-24 17:04; {e4a8a97b-f2ed-450b-b12d-ee082ba24781}; c:\users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
c:\users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BBC iPlayer Desktop.lnk - c:\program files (x86)\BBC iPlayer Desktop\BBC iPlayer Desktop.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{09F57980-3432-4AFC-957D-27AC45FAE1F5}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
  00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-05  11:06:17
ComboFix-quarantined-files.txt  2013-07-05 09:06
ComboFix2.txt  2013-07-03 15:43
.
Vor Suchlauf: 21 Verzeichnis(se), 172.261.580.800 Bytes frei
Nach Suchlauf: 26 Verzeichnis(se), 172.899.737.600 Bytes frei
.
- - End Of File - - E14CE2A3B5D37E3040F533E17D93617F
D41D8CD98F00B204E9800998ECF8427E

schrauber 05.07.2013 16:56
Das war ne Fehlerkennung. Einfach neu installieren :)

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.

trishohara 05.07.2013 17:56
Sorry, hat ein bisschen gedauert.

Code:
# AdwCleaner v2.304 - Datei am 03/07/2013 um 17:54:28 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : trishohara - TRISHOHARA-VAIO
# Bootmodus : Abgesicherter Modus mit Netzwerkunterstützung
# Ausgeführt unter : C:\Users\trishohara\Downloads\adwcleaner.exe
# Option [Suche]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Ordner Gefunden : C:\Program Files (x86)\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com
Ordner Gefunden : C:\Program Files (x86)\software4u
Ordner Gefunden : C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\jetpack
Ordner Gefunden : C:\Users\trishohara\AppData\Roaming\software4u

***** [Registrierungsdatenbank] *****

Schlüssel Gefunden : HKLM\Software\DeviceVM
Schlüssel Gefunden : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}

***** [Internet Browser] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v21.0 (de)

Datei : C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Google Chrome v27.0.1453.116

Datei : C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [1410 octets] - [03/07/2013 17:54:28]

########## EOF - C:\AdwCleaner[R1].txt - [1470 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Professional x64
Ran by trishohara on 05.07.2013 at 18:49:28,32
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\trishohara\AppData\Roaming\mozilla\firefox\profiles\pp3cugsz.default\minidumps [2 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 05.07.2013 at 18:52:32,18
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013
Ran by trishohara (administrator) on 05-07-2013 18:53:28
Running from C:\Users\trishohara\Downloads
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 9 Organizer\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
() C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe
() C:\Program Files (x86)\Expat Shield\bin\hsswd.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgr.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Control Center\VESMgrSub.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Atheros Communications) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
() C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
(Sony Corporation) C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPNetworkCommunicatorCom.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update Common\VUAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe
(Google Inc.) C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [13374568 2011-12-13] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SONYAPO  [2277992 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [AtherosBtStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [947360 2011-07-05] (Atheros Communications)
HKLM\...\Run: [AthBtTray] "C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe" [797344 2011-07-05] (Atheros Commnucations)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2531624 2011-06-22] (Synaptics Incorporated)
HKLM\...\Run: [Classic Start Menu] C:\Program Files\Classic Shell\ClassicStartMenu.exe [98304 2010-07-29] (IvoSoft)
HKLM\...\Run: [IntelliPoint] "c:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2417032 2011-08-01] (Microsoft Corporation)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1436736 2011-06-15] (Microsoft Corporation)
HKLM\...\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4  [2277992 2011-11-15] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_DTS] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /DTSU2P  [2277992 2011-11-15] (Realtek Semiconductor)
HKCU\...\Run: [HP Deskjet 3520 series (NET)] "C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2AN112P705SY:NW" -scfn "HP Deskjet 3520 series (NET)" -AutoStart 1 [2573416 2012-10-17] (Hewlett-Packard Co.)
HKCU\...\Run: [AnyDVD] C:\Program Files (x86)\SlySoft\AnyDVD\AnyDVDtray.exe [7032920 2013-04-10] (SlySoft, Inc.)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-12] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe" [2801288 2011-05-31] (Sony Corporation)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [151952 2012-11-29] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Aimersoft Helper Compact.exe] C:\Program Files (x86)\Common Files\Aimersoft\Aimersoft Helper Compact\ASHelper.exe [x]
HKLM-x32\...\Run: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [513048 2013-03-20] (CyberLink Corp.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\trishohara\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk
ShortcutTarget: Tintenwarnungen überwachen - HP Deskjet 3520 series (Netzwerk).lnk -> C:\Program Files\HP\HP Deskjet 3520 series\bin\HPStatusBL.dll (Hewlett-Packard Co.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://vaioportal.sony.eu
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKCU - {41812E44-598A-401F-AB23-573502F38661} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-27/4?mpre=hxxp://shop.ebay.de/?oemInLn=ieSrch-Q311&_nkw={searchTerms}
SearchScopes: HKCU - {DD40B60A-0114-4FB6-B335-1277870C1021} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE_64.dll (AnchorFree Inc.)
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE.dll (AnchorFree Inc.)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Handler: msdaipp - No CLSID Value -
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Winsock: Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.)
Winsock: Catalog9 13 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346736] (VMware, Inc.)
Winsock: Catalog9-x64 12 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.)
Winsock: Catalog9-x64 13 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446576] (VMware, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.135.1
Tcpip\..\Interfaces\{E4AA3406-CA7C-4E4A-AD32-E3DDBB9ABD9C}: [NameServer]8.8.8.8

FireFox:
========
FF ProfilePath: C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default
FF Homepage: https://twitter.com/|hxxp://www.angrybirdsnest.com/|https://www.facebook.com/|hxxp://www.flickr.com/photos/hansolo401/|hxxp://www.fbtb.net/forums/search.php?search_id=newposts|hxxp://www.1000steine.de/de/gemeinschaft/forum/?show=1&cat=a
FF NetworkProxy: "http", "216.155.139.115"
FF NetworkProxy: "http_port", 3128
FF NetworkProxy: "no_proxies_on", "localhost, 127.0.0.1, stealthy.co"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_202.dll ()
FF Plugin: @java.com/DTPlugin,version=10.2.1 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.2.1 - C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
FF Plugin-x32: @videolan.org/vlc,version=2.0.6 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Extension: British English Dictionary - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\en-GB@dictionaries.addons.mozilla.org
FF Extension: Echofon - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\twitternotifier@naan.net
FF Extension: ColorZilla - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{6AC85730-7D0F-4de0-B3FA-21142DD85326}
FF Extension: DownloadHelper - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
FF Extension: compatibility - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\compatibility@addons.mozilla.org.xpi
FF Extension: firebug - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\firebug@software.joehewitt.com.xpi
FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{75CEEE46-9B64-46f8-94BF-54012DE155F0}.xpi
FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: No Name - C:\Users\trishohara\AppData\Roaming\Mozilla\Firefox\Profiles\pp3cugsz.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Users\trishohara\AppData\Local\Google\Chrome\Application\16.0.912.77\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.260.3) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U26) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Media Go Detector) - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Network Entertainment International LLC)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Google Update) - C:\Users\trishohara\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Angry Birds) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.1.2.1_0
CHR Extension: (YouTube) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2_0
CHR Extension: (Google Search) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.14_0
CHR Extension: (Gmail) - C:\Users\trishohara\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\6.1.3_0

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-07-05] (Atheros)
R2 CyberLink PowerDVD 13 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [77576 2013-03-20] (CyberLink)
R2 CyberLink PowerDVD 13 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [323336 2013-03-20] (CyberLink)
R2 ExpatShieldService; C:\Program Files (x86)\Expat Shield\bin\openvpnas.exe [331608 2011-12-29] ()
S4 ExpatTrayService; C:\Program Files (x86)\Expat Shield\bin\ExpatTrayService.EXE [77520 2012-01-06] ()
R2 ExpatWd; C:\Program Files (x86)\Expat Shield\bin\hsswd.exe [329544 2012-01-05] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [12784 2011-04-27] (Microsoft Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe [288272 2011-04-27] (Microsoft Corporation)
S4 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [105024 2011-02-23] (ArcSoft, Inc.)
S4 ufad-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.)
S2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [x]

==================== Drivers (Whitelisted) ====================

R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [142424 2013-03-18] (SlySoft, Inc.)
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R1 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [189440 2011-04-18] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [84864 2011-04-27] (Microsoft Corporation)
R2 risdsnpe; C:\Windows\system32\drivers\risdsnxc64.sys [98816 2011-06-23] (REDC)
R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R3 WsAudio_Device; C:\Windows\System32\drivers\VirtualAudio.sys [31080 2013-01-08] (Wondershare)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.)
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5}; C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [130320 2013-03-19] (CyberLink Corp.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-05 18:52 - 2013-07-05 18:52 - 00000766 ____A C:\Users\trishohara\Desktop\JRT.txt
2013-07-05 18:07 - 2013-07-05 18:07 - 00650027 ____A C:\Users\trishohara\Downloads\adwcleaner.exe
2013-07-05 18:07 - 2013-07-05 18:07 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\trishohara\Downloads\JRT.exe
2013-07-05 11:06 - 2013-07-05 11:06 - 00024607 ____A C:\ComboFix.txt
2013-07-05 10:54 - 2013-07-05 11:08 - 00000000 ____D C:\ComboFix
2013-07-05 10:54 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-05 10:54 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-05 10:54 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-05 10:54 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-05 10:54 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-05 10:54 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-05 10:54 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-05 10:54 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-05 10:45 - 2013-07-05 10:45 - 05085494 ____R (Swearware) C:\Users\trishohara\Downloads\ComboFix.exe
2013-07-05 10:31 - 2013-07-05 10:34 - 156721576 ____N (Symantec Corporation) C:\Users\trishohara\Downloads\NIS-TW-30-20-3-0-36-GE.exe
2013-07-05 10:10 - 2013-07-05 10:11 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe
2013-07-03 21:38 - 2013-07-03 21:41 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe
2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan
2013-07-03 21:30 - 2013-07-03 21:35 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part
2013-07-03 20:37 - 2013-07-03 20:38 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796
2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt
2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt
2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt
2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 17:58 - 2013-07-05 18:48 - 00000000 ____D C:\JRT
2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt
2013-07-03 17:49 - 2013-07-03 21:13 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine
2013-07-03 17:20 - 2013-07-05 11:06 - 00000000 ____D C:\Qoobox
2013-07-03 17:20 - 2013-07-05 11:05 - 00000000 ____D C:\Windows\erdnt
2013-07-03 17:13 - 2013-07-05 18:03 - 00032883 ____A C:\Users\trishohara\Downloads\Addition.txt
2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST
2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip
2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore
2013-06-21 15:59 - 2013-06-26 13:00 - 00000000 ____D C:\ProgramData\tmp
2013-06-21 15:59 - 2013-06-21 21:22 - 00000000 ____D C:\ProgramData\hps
2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR
2013-06-21 12:42 - 2013-06-21 14:31 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls
2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls

==================== One Month Modified Files and Folders =======

2013-07-05 18:53 - 2012-02-05 21:23 - 00001140 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job
2013-07-05 18:52 - 2013-07-05 18:52 - 00000766 ____A C:\Users\trishohara\Desktop\JRT.txt
2013-07-05 18:49 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-05 18:49 - 2009-07-14 06:45 - 00026112 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-05 18:48 - 2013-07-03 17:58 - 00000000 ____D C:\JRT
2013-07-05 18:46 - 2011-12-06 19:44 - 01836735 ____A C:\Windows\WindowsUpdate.log
2013-07-05 18:46 - 2011-08-13 00:32 - 00705888 ____A C:\Windows\System32\perfh007.dat
2013-07-05 18:46 - 2011-08-13 00:32 - 00151918 ____A C:\Windows\System32\perfc007.dat
2013-07-05 18:46 - 2009-07-14 07:13 - 01638732 ____A C:\Windows\System32\PerfStringBackup.INI
2013-07-05 18:43 - 2012-01-29 15:20 - 00000000 ____D C:\Users\trishohara\Documents\Mein Steuer-Sparbuch Heute
2013-07-05 18:42 - 2013-05-02 16:47 - 00000040 ___SH C:\ProgramData\.zreglib
2013-07-05 18:42 - 2013-04-23 18:03 - 00000000 ____D C:\Users\trishohara\AppData\Local\Apps\2.0
2013-07-05 18:41 - 2011-12-07 19:50 - 00000000 ____D C:\ProgramData\VMware
2013-07-05 18:41 - 2011-08-12 14:52 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-05 18:41 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-05 18:41 - 2009-07-14 06:51 - 00056013 ____A C:\Windows\setupact.log
2013-07-05 18:40 - 2010-11-21 05:47 - 00215536 ____A C:\Windows\PFRO.log
2013-07-05 18:07 - 2013-07-05 18:07 - 00650027 ____A C:\Users\trishohara\Downloads\adwcleaner.exe
2013-07-05 18:07 - 2013-07-05 18:07 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\trishohara\Downloads\JRT.exe
2013-07-05 18:05 - 2011-12-06 20:23 - 00000000 ____D C:\Users\trishohara\Documents\Bluetooth Folder
2013-07-05 18:03 - 2013-07-03 17:13 - 00032883 ____A C:\Users\trishohara\Downloads\Addition.txt
2013-07-05 17:49 - 2012-02-05 21:23 - 00001088 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job
2013-07-05 17:41 - 2013-03-31 13:11 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-05 11:08 - 2013-07-05 10:54 - 00000000 ____D C:\ComboFix
2013-07-05 11:08 - 2013-05-02 19:17 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-05 11:06 - 2013-07-05 11:06 - 00024607 ____A C:\ComboFix.txt
2013-07-05 11:06 - 2013-07-03 17:20 - 00000000 ____D C:\Qoobox
2013-07-05 11:05 - 2013-07-03 17:20 - 00000000 ____D C:\Windows\erdnt
2013-07-05 11:04 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-05 10:45 - 2013-07-05 10:45 - 05085494 ____R (Swearware) C:\Users\trishohara\Downloads\ComboFix.exe
2013-07-05 10:41 - 2013-03-31 13:41 - 17018248 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-07-05 10:41 - 2013-03-31 13:11 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-05 10:41 - 2011-08-12 15:06 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-05 10:34 - 2013-07-05 10:31 - 156721576 ____N (Symantec Corporation) C:\Users\trishohara\Downloads\NIS-TW-30-20-3-0-36-GE.exe
2013-07-05 10:11 - 2013-07-05 10:10 - 01934636 ____A (Farbar) C:\Users\trishohara\Downloads\FRST64.exe
2013-07-05 10:06 - 2009-07-14 06:45 - 00446336 ____A C:\Windows\System32\FNTCACHE.DAT
2013-07-03 21:41 - 2013-07-03 21:38 - 109927703 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe
2013-07-03 21:36 - 2013-07-03 21:36 - 00000041 ____A C:\Users\trishohara\AppData\Roaming\mbam.context.scan
2013-07-03 21:35 - 2013-07-03 21:30 - 172886528 ____A (Symantec Corporation) C:\Users\trishohara\Downloads\NAV-TW-30-20-3-0-36-GE.exe.part
2013-07-03 21:16 - 2011-12-06 19:45 - 00000000 ____D C:\users\trishohara
2013-07-03 21:14 - 2012-05-31 19:46 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-03 21:14 - 2012-05-03 21:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 21:14 - 2012-02-13 21:21 - 00000000 ____D C:\Windows\System32\Macromed
2013-07-03 21:14 - 2012-02-06 13:43 - 00000000 ____D C:\Program Files\Oracle
2013-07-03 21:14 - 2012-01-17 21:20 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\vlc
2013-07-03 21:14 - 2011-12-10 15:20 - 00000000 ____D C:\Program Files (x86)\IrfanView
2013-07-03 21:14 - 2011-12-10 15:18 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Notepad++
2013-07-03 21:14 - 2011-08-12 14:56 - 00000000 ____D C:\Program Files\Java
2013-07-03 21:14 - 2011-08-12 14:53 - 00000000 ____D C:\ProgramData\Atheros
2013-07-03 21:14 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\System32\NDF
2013-07-03 21:13 - 2013-07-03 17:49 - 00000000 ____D C:\Users\trishohara\Desktop\RK_Quarantine
2013-07-03 21:13 - 2011-12-07 18:43 - 00000000 ____D C:\Users\trishohara\AppData\Local\Thunderbird
2013-07-03 21:13 - 2011-12-06 22:33 - 00000000 ____D C:\Users\trishohara\AppData\Roaming\Mozilla
2013-07-03 21:13 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-03 21:11 - 2012-02-19 12:14 - 00000000 ____D C:\ProgramData\CyberLink
2013-07-03 21:11 - 2012-02-05 21:23 - 00000000 ____D C:\Users\trishohara\AppData\Local\Google
2013-07-03 21:11 - 2011-08-12 15:01 - 00000000 ____D C:\ProgramData\Sony Corporation
2013-07-03 21:10 - 2011-08-12 14:57 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-03 20:38 - 2013-07-03 20:37 - 00000000 ____D C:\67abfb933ea67e8babbc1c7dd37b9796
2013-07-03 20:23 - 2013-07-03 20:23 - 00000540 ____A C:\Users\trishohara\Downloads\virus.txt
2013-07-03 20:22 - 2012-05-05 18:46 - 00000000 ____D C:\Windows\System32\appmgmt
2013-07-03 18:08 - 2013-07-03 18:08 - 00000000 ____D C:\Program Files (x86)\ESET
2013-07-03 18:07 - 2013-07-03 18:07 - 00001960 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180734.txt
2013-07-03 18:07 - 2013-07-03 18:07 - 00001209 ____A C:\Users\trishohara\Desktop\RKreport[0]_PR_07032013_180737.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001896 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180623.txt
2013-07-03 18:06 - 2013-07-03 18:06 - 00001087 ____A C:\Users\trishohara\Desktop\RKreport[0]_H_07032013_180633.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00002061 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_180527.txt
2013-07-03 18:05 - 2013-07-03 18:05 - 00001955 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_180506.txt
2013-07-03 17:59 - 2013-07-03 17:59 - 00000000 ____D C:\Windows\ERUNT
2013-07-03 17:54 - 2013-07-03 17:54 - 00001539 ____A C:\AdwCleaner[R1].txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002962 ____A C:\Users\trishohara\Desktop\RKreport[0]_D_07032013_175047.txt
2013-07-03 17:50 - 2013-07-03 17:50 - 00002781 ____A C:\Users\trishohara\Desktop\RKreport[0]_S_07032013_175024.txt
2013-07-03 17:12 - 2013-07-03 17:12 - 00000000 ____D C:\FRST
2013-07-01 16:47 - 2012-01-12 13:29 - 00036352 ____A C:\Users\trishohara\Documents\monatlAusgaben.xls
2013-06-29 13:29 - 2013-06-29 13:29 - 02367452 ____A C:\Users\trishohara\Downloads\bewerbungsunterlagen.zip
2013-06-26 13:00 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\tmp
2013-06-24 12:18 - 2011-12-10 15:05 - 00000000 ____D C:\Users\trishohara\Documents\Eigene PSP-Dateien
2013-06-22 21:21 - 2012-03-14 19:03 - 00000000 ____D C:\Users\trishohara\AppData\Local\CrashDumps
2013-06-21 21:22 - 2013-06-21 15:59 - 00000000 ____D C:\ProgramData\hps
2013-06-21 20:13 - 2013-06-21 20:13 - 00000000 ____D C:\Users\trishohara\restore
2013-06-21 15:53 - 2013-06-21 15:53 - 00000000 ____D C:\Program Files (x86)\CEWE COLOR
2013-06-21 14:31 - 2013-06-21 12:42 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013_2.xls
2013-06-10 16:15 - 2013-06-10 16:15 - 00019456 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Juni2013.xls
2013-06-10 16:13 - 2013-05-07 18:15 - 00025088 ____A C:\Users\trishohara\Documents\Mama_Tabletten_Mai2013.xls

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-07-04 10:00

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-07-2013
Ran by trishohara at 2013-07-05 18:53:53
Running from C:\Users\trishohara\Downloads
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

?????? Windows Live (x32 Version: 15.4.3502.0922)
??????? ????????? Windows Live Mesh ActiveX ??? ?????????? ?????????? (x32 Version: 15.4.5722.2)
??????? ?????????? Windows Live Mesh ActiveX ??? ????????? ??????????? (x32 Version: 15.4.5722.2)
???????? ?????????? Windows Live (x32 Version: 15.4.3502.0922)
?????????? Windows Live (x32 Version: 15.4.3502.0922)
??????????? ?? Windows Live (x32 Version: 15.4.3502.0922)
???????????? Windows Live (x32 Version: 15.4.3502.0922)
7-Zip 9.20 (x32)
Adobe AIR (x32 Version: 2.7.0.19460)
Adobe Community Help (x32 Version: 3.2.1)
Adobe Community Help (x32 Version: 3.2.1.650)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.202)
Adobe Photoshop Elements 9 (x32 Version: 9.0)
Adobe Premiere Elements 9 (x32 Version: 9.0)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Aimersoft Video Converter Ultimate(Build 5.0.1.0) (x32 Version: 5.0.1.0)
Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17)
Android SDK Tools (x32 Version: 1.14)
Angry Birds Seasons (x32 Version: 2.2.0)
AnyDVD (x32 Version: 7.1.8.0)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.149)
ArcSoft WebCam Companion 4 (x32 Version: 4.0.444)
Atheros WiFi Driver Installation (x32 Version: 3.0)
AVIcodec (remove only) (x32)
BBC iPlayer Desktop (x32 Version: 3.2.15)
Bing Bar (x32 Version: 7.0.850.0)
Bluetooth Win7 Suite (64) (Version: 7.04.000.82)
Bonjour (Version: 3.0.0.10)
BrickStore (x32 Version: 1.1.16)
Classic Shell (Version: 2.8.3)
Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6514.5001)
Corel WinDVD (x32 Version: 10.0.6.108)
Corel WinDVD (x32 Version: 11)
Corel WinDVD Pro 11 (x32 Version: 11.0.0.342)
CSS3 Menu (x32)
CyberLink PowerDVD 13 (x32 Version: 13.0.2720.57)
D3DX10 (x32 Version: 15.4.2368.0902)
Dolby Home Theater v4 (x32 Version: 7.2.7000.6)
DVD Shrink 3.2 (x32)
Elements 9 Organizer (x32 Version: 9.0)
Elements STI Installer (x32 Version: 1.0)
Evernote v. 4.4 (x32 Version: 4.4.0.4848)
Expat Shield 2.24 (x32 Version: 2.24)
FileZilla Client 3.5.3 (x32 Version: 3.5.3)
Firebird SQL Server - MAGIX Edition (x32 Version: 2.1.27.0)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922)
Galeria fotografii uslugi Windows Live (x32 Version: 15.4.3502.0922)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
Galerie foto Windows Live (x32 Version: 15.4.3502.0922)
Google Chrome (HKCU Version: 26.0.1410.64)
HP Deskjet 3520 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HP Deskjet 3520 series Hilfe (x32 Version: 27.0.0)
HP Deskjet 3520 series Setup Guide (x32 Version: 27.0.0)
HP FWUpdateEDO2 (x32 Version: 1.2.0.0)
HP Photo Creations (x32 Version: 1.0.0.7702)
HP Update (x32 Version: 5.003.003.001)
HPDiagnosticAlert (x32 Version: 1.00.0000)
ICA (x32 Version: 1.0)
iDevice Manager (x32 Version: 1.2.1.0)
iExplorer 2.2.1.3 (x32)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
IPM (x32 Version: 1.00.0000)
IrfanView (remove only) (x32)
iTunes (Version: 11.0.0.163)
Jasc Paint Shop Pro 9 (x32 Version: 9.00.0000)
Java Auto Updater (x32 Version: 2.0.5.1)
Java(TM) 6 Update 26 (64-bit) (Version: 6.0.260)
Java(TM) 6 Update 26 (x32 Version: 6.0.260)
Java(TM) 7 Update 2 (64-bit) (Version: 7.0.20)
Java(TM) SE Development Kit 7 Update 2 (64-bit) (Version: 1.7.0.20)
JavaFX 2.0.2 (64-bit) (Version: 2.0.2)
JavaFX 2.0.2 SDK (64-bit) (Version: 2.0.2)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
LEGO® Star Wars™: Die Komplette Saga (x32 Version: 1.00.0000)
LEGO® Star Wars™: The Complete Saga (x32 Version: 1.00.0000)
MAGIX Screenshare (x32 Version: 4.3.6.1987)
MAGIX Speed burnR (MSI) (x32 Version: 7.0.2.6)
MAGIX Video deluxe MX Premium (x32 Version: 11.0.0.42)
Malwarebytes Anti-Malware Version 1.61.0.1400 (x32 Version: 1.61.0.1400)
Media Gallery (Version: 1.5.0.17250)
Media Go (x32 Version: 1.7.254)
Mesh Runtime (x32 Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended DEU Language Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft Antimalware (Version: 3.0.8402.2)
Microsoft Antimalware Service DE-DE Language Pack (Version: 3.0.8402.2)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft IntelliPoint 8.2 (Version: 8.20.468.0)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Professional Edition 2003 (x32 Version: 11.0.8173.0)
Microsoft Security Client (Version: 2.1.1116.0)
Microsoft Security Client DE-DE Language Pack (Version: 2.1.1116.0)
Microsoft Security Essentials (Version: 2.1.1116.0)
Microsoft Silverlight (x32 Version: 4.1.10329.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 20.0.1 (x86 de) (x32 Version: 20.0.1)
Mozilla Maintenance Service (x32 Version: 20.0.1)
Mozilla Thunderbird 9.0.1 (x86 de) (x32 Version: 9.0.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB973685) (x32 Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0)
Notepad++ (x32 Version: 5.9.6.2)
NVIDIA 3D Vision Treiber 268.93 (Version: 268.93)
NVIDIA 3D Vision Video Player (x32 Version: 1.6.9)
NVIDIA Grafiktreiber 268.93 (Version: 268.93)
NVIDIA HD-Audiotreiber 1.2.22.1 (Version: 1.2.22.1)
NVIDIA Install Application (Version: 2.265.42.0)
NVIDIA PhysX (x32 Version: 9.10.0514)
NVIDIA PhysX-Systemsoftware 9.10.0514 (Version: 9.10.0514)
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6893)
NVIDIA Systemsteuerung 268.93 (Version: 268.93)
Ovládací prvek ActiveX platformy Windows Live Mesh pro vzdálená pripojení (x32 Version: 15.4.5722.2)
Ovládací prvok ActiveX programu Windows Live Mesh pre vzdialené pripojenia (x32 Version: 15.4.5722.2)
Pazera Free MP4 to AVI Converter 1.6 (x32 Version: 1.6)
PlayStation(R)Network Downloader (x32 Version: 2.05.00710)
PlayStation(R)Store (x32 Version: 4.1.8.11883)
PMB (x32 Version: 5.6.01.03300)
PMB VAIO Edition Plug-in (Version: 1.5.10.05300)
PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06010)
Poczta uslugi Windows Live (x32 Version: 15.4.3502.0922)
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922)
Portal (x32)
Portal 2 (x32)
PowerDVD (x32)
Quick Web Access (x32 Version: 1.4.6.10)
QuickTime (x32 Version: 7.73.80.64)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6526)
Remote Keyboard (x32 Version: 1.1.1.07060)
Remote Play with PlayStation 3 (x32 Version: 1.1.0.15072)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.32.0)
S?????? f?t???af??? t?? Windows Live (x32 Version: 15.4.3502.0922)
Setup (x32 Version: 11.0)
Skype™ 5.1 (x32 Version: 5.1.104)
SmartSound Quicktracks for Premiere Elements 9.0 (x32 Version: 3.12.3090)
Sony Corporation (Version: 1.0.0)
SourceTree (HKCU Version: 0.9.1.0)
SSLx64 (Version: 1.0.0)
SSLx86 (x32 Version: 1.0.0)
St???e?? e?????? ActiveX t?? Windows Live Mesh ??a ap?µa???sµ??e? s??d?se?? (x32 Version: 15.4.5722.2)
Star Wars Knights of the Old Republic (x32 Version: 1.0)
Steam (x32 Version: 1.0.0.0)
StreamTransport version: 1.0.2.2171 (x32)
Studie zur Verbesserung von HP Deskjet 3520 series Produkten (Version: 28.0.1315.0)
SUPER © v2011.build.49 (July 1st, 2011) Version v2011.build.49 (x32 Version: v2011.build.49)
Synaptics Pointing Device Driver (Version: 15.2.6.0)
tools-freebsd (x32 Version: 8.4.6.16648)
tools-linux (x32 Version: 8.4.6.16648)
tools-netware (x32 Version: 8.4.6.16648)
tools-solaris (x32 Version: 8.4.6.16648)
tools-windows (x32 Version: 8.4.6.16648)
tools-winPre2k (x32 Version: 8.4.6.16648)
TVO version 3.7 (x32 Version: 3.7)
TweetDeck (x32 Version: 1.0.0)
Uzak Baglantilar Için Windows Live Mesh ActiveX Denetimi (x32 Version: 15.4.5722.2)
V3DPX86 (x32 Version: 1.0.0)
VAIO - Media Gallery (x32 Version: 1.5.0.18100)
VAIO - PMB VAIO Edition Guide (x32 Version: 1.6.00.06030)
VAIO - PMB VAIO Edition Plug-in (x32 Version: 1.6.00.06140)
VAIO - Remote Play mit PlayStation®3 (x32 Version: 1.1.0.15072)
VAIO - Remote-Tastatur  (x32 Version: 1.1.0.07060)
VAIO 3D Portal (x32 Version: 1.1.0.06232)
VAIO Control Center (x32 Version: 5.0.0.07070)
VAIO Data Restore Tool (x32 Version: 1.7.0.05270)
VAIO Easy Connect (x32 Version: 1.0.0.03050)
VAIO Gate (x32 Version: 2.4.0.06210)
VAIO Gate Default (x32 Version: 2.5.0.07080)
VAIO Hero Screensaver - Fall 2011 Screensaver (x32)
VAIO Improvement (x32 Version: 1.1.0.06030)
VAIO Improvement Validation (Version: 1.0.4.01190)
VAIO Sample Contents (x32 Version: 1.4.2.09010)
VAIO Smart Network (x32 Version: 3.7.0.07150)
VAIO Update (x32 Version: 5.5.0.06290)
VAIO Update Merge Module x64 (Version: 5.5.06290)
VAIO-Handbuch (x32 Version: 1.4.0.05310)
VAIO-Support für Übertragungen (x32 Version: 1.4.0.14230)
VCCx64 (Version: 1.0.0)
VCCx86 (x32 Version: 1.0.0)
VHD (x32 Version: 1.0.0)
VIx64 (Version: 1.0.0)
VIx86 (x32 Version: 1.0.0)
VLC media player 2.0.6 (x32 Version: 2.0.6)
VMware Workstation (x32 Version: 7.1.4.16648)
VPMx64 (Version: 1.0.0)
VSNx64 (Version: 1.0.0)
VSNx86 (x32 Version: 1.0.0)
VWSTx86 (x32 Version: 1.0.0)
Winamp (Remove Only) (x32)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3508.1109)
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922)
Windows Live Fotograf Galerisi (x32 Version: 15.4.3502.0922)
Windows Live Fotótár (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3508.1109)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-kontroll for eksterne tilkoblinger (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2)
Windows Live Mesh ActiveX-vezérlo távoli kapcsolatokhoz (x32 Version: 15.4.5722.2)
Windows Live Meshin etäyhteyksien ActiveX-komponentti (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922)
Windows Liven sähköposti (x32 Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922)
WinSCP 4.3.8 (x32 Version: 4.3.8)
WISO Steuer-Sparbuch 2012 (x32 Version: 19.00.7303)
WISO Steuer-Sparbuch 2013 (x32 Version: 20.00.8137)
XAMPP 1.8.1-0 (x32 Version: 1.8.1-0)
Xvid 1.2.2 final uninstall (x32 Version: 1.2)

==================== Restore Points  =========================

09-06-2013 09:24:31 Windows Update
20-06-2013 08:12:54 Windows Update
23-06-2013 14:28:04 Windows Update
28-06-2013 14:49:48 Windows Update
03-07-2013 18:21:20 Removed JavaFX 2.0.2 SDK (64-bit)
03-07-2013 18:22:44 Removed Java(TM) 6 Update 26
03-07-2013 18:24:01 Removed Java(TM) 6 Update 26 (64-bit)
03-07-2013 18:24:43 Removed Java(TM) 7 Update 2 (64-bit)
03-07-2013 18:25:19 Removed Java(TM) SE Development Kit 7 Update 2 (64-bit)
03-07-2013 18:26:01 Removed JavaFX 2.0.2 (64-bit)
03-07-2013 18:37:10 Windows Update
03-07-2013 19:07:33 Wiederherstellungsvorgang
03-07-2013 19:20:29 Windows Update
05-07-2013 08:54:54 ComboFix created restore point

==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-07-05 11:04 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0881E3A4-1947-405E-A120-7036242BDB04} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update 5 => C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe [2011-06-30] (Sony Corporation)
Task: {0F4AB92F-E05D-4A8F-9E77-55DDAC553141} - System32\Tasks\Sony Corporation\VAIO Improvement\VAIOImprovementUploader => C:\Program Files\Sony\VAIO Improvement\viuploader.exe [2011-06-03] (Sony Corporation)
Task: {1466E89D-C2CC-49AE-A4D8-6764E7FA65B4} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {1D983A4E-E1DB-4085-A2E8-75F279F16B1C} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Daily => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation)
Task: {1F36B366-6BA0-470A-8E08-16076FD91E8A} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-06-21] (Sony Corporation)
Task: {27D1261B-2559-4EE7-99DC-0BDC4BFF1528} - System32\Tasks\{9FCEF174-62CC-4642-B14F-3A2DF8501B8A} => C:\Program Files (x86)\CyberLink\PowerDVD\PowerDVD.exe [2003-08-05] (CyberLink Corp.)
Task: {337C50B5-B503-4C7E-8D3E-A630C0C40C6B} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation)
Task: {433AB431-E3FC-4B78-A7C8-053CBF353BF8} - System32\Tasks\Sony Corporation\VAIO Care\VCCheckIcon => C:\Program Files\Sony\VAIO Care\VCSystemTray.exe No File
Task: {44FADF11-9AB6-46DD-9816-5F965A440DBB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-03-31] (Adobe Systems Incorporated)
Task: {479102CF-47D9-4E1B-9E27-77563BA3B8A7} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {4B8E085B-F53F-4C27-BDCD-0A4B4B5A7E16} - System32\Tasks\HPCustParticipation HP Deskjet 3520 series => C:\Program Files\HP\HP Deskjet 3520 series\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {542A311B-52F0-4D32-A452-47105714073F} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation)
Task: {618ADA85-A135-4D81-8A4E-87CE17798D3D} - System32\Tasks\Sony Corporation\VAIO Control Center\Level4Month => C:\Program Files (x86)\Sony\VAIO Control Center\WBCBatteryCare.exe [2011-07-07] (Sony Corporation)
Task: {7127EFC9-ED61-42E9-B823-C6F4BA2A3F61} - System32\Tasks\Sony Corporation\VAIO Smart Network\VSN Logon Start => C:\Program Files\Sony\VAIO Smart Network\VSNClient No File
Task: {71F13F70-73E0-41BE-8B15-EB972D15C9D7} - System32\Tasks\Microsoft\Microsoft Antimalware\MP Scheduled Scan => C:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27] (Microsoft Corporation)
Task: {7692B3EA-121B-4ECF-87A6-CC6AD35746F6} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.)
Task: {814A056C-ED62-4262-ADFA-9DB0B6A028BC} - System32\Tasks\Sony Corporation\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2011-06-21] (Sony Corporation)
Task: {A19FD96A-A3A7-48E1-915A-F04F8BFA8C75} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation)
Task: {A7E245A6-921F-4EEE-B4A3-A00F1861B897} - System32\Tasks\Sony Corporation\VAIO Care\VCUpdateLearn => C:\Program Files\Sony\VAIO Care\VCsystray.exe No File
Task: {B7EADB6F-BC45-43A0-8E38-2D57816D7331} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe [2012-02-05] (Google Inc.)
Task: {DC14E697-3EC4-486F-8C12-CA347690845D} - System32\Tasks\Sony Corporation\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2011-05-31] (Sony Corporation)
Task: {DC21B924-5D92-4393-A11B-AB883C4661C4} - System32\Tasks\{35CEFC5E-F302-42EB-91C9-A97F243584F9} => C:\Program Files (x86)\iPhone Explorer\iExplorer.exe [2011-12-06] (Macroplant)
Task: {FC50458D-C82F-44AE-B805-1D07EDF4BCCA} - System32\Tasks\AdobeAAMUpdater-1.0-trishohara-VAIO-trishohara => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2010-07-29] (Adobe Systems Incorporated)
Task: {FCBAAC13-FEC3-441D-91B9-ACE445E4C9E0} - System32\Tasks\Sony Corporation\VAIO Improvement Validation\VAIO Improvement Validation => C:\Program Files\Sony\VAIO Improvement Validation\viv.exe [2011-01-20] (Sony Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001Core.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3351839369-2974415085-3751294646-1001UA.job => C:\Users\trishohara\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-07-05 11:04:24.093
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-05 11:04:24.093
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-03 17:36:19.853
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-07-03 17:36:19.853
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2012-05-06 13:19:45.182
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:45.161
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:45.105
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:45.025
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:44.979
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2012-05-06 13:19:44.826
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info ===========================

Percentage of memory in use: 20%
Total physical RAM: 8173.22 MB
Available physical RAM: 6508.46 MB
Total Pagefile: 16344.63 MB
Available Pagefile: 14569.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:328.45 GB) (Free:161.11 GB) NTFS (Disk=0 Partition=3)
Drive d: (KRD10) (CDROM) (Total:0.31 GB) (Free:0 GB) CDFS
Drive e: () (Removable) (Total:29.8 GB) (Free:22.64 GB) FAT32 (Disk=1 Partition=1)
Drive g: (Volume) (Fixed) (Total:249.23 GB) (Free:35.84 GB) NTFS (Disk=0 Partition=4)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596 GB) (Disk ID: 7FA122EA)
Partition 1: (Not Active) - (Size=18 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=328 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=249 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 30 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=30 GB) - (Type=0C)

==================== End Of Log ============================

schrauber 05.07.2013 18:00

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST Log bitte. Noch Probleme? :)

trishohara 05.07.2013 21:27
ESET ist endlich fertig, hat zwei Threats gefunden.

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7b378ef894330443a894433b151b21cc
# engine=14256
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-07-03 06:14:19
# local_time=2013-07-03 08:14:19 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5892 16777213 100 100 49595365 69746129 0 0
# scanned=399880
# found=5
# cleaned=0
# scan_time=7375
sh=5D37A014DFBF23C6BD9472475806611E7E3367E9 ft=1 fh=673693b06d190801 vn="a variant of Win32/Kryptik.BEWO trojan" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\A6D355FB7DBFE66B0000A6D2AF32F08D\A6D355FB7DBFE66B0000A6D2AF32F08D.exe.vir"
sh=F9F9525705D7097D69FAE20BE7BD6FEB168665C7 ft=1 fh=5ce88cf60f53c1ed vn="a variant of Win32/Injector.AIXM trojan" ac=I fn="C:\Users\trishohara\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\346bb111-6c7f6c29"
sh=431C3C88B0BD65AF49F43C06CA712C3E18EDFADB ft=1 fh=28585be5f68f22b8 vn="Win32/InstallMonetizer.AF application" ac=I fn="C:\Users\trishohara\Downloads\Pazera_Free_MP4_to_AVI_Converter.exe"
sh=D34C3EE54383C1834BBDFAE67239AAF3DC75AB5F ft=0 fh=0000000000000000 vn="Win32/PSWTool.ProductKey.126 application" ac=I fn="C:\Users\trishohara\Downloads\USB_MultiBoot_10.zip"
sh=38CCEB47628D4C73344595B1FAF505F874B86EB0 ft=1 fh=8c018257833e8034 vn="Win32/OpenCandy application" ac=I fn="G:\Install-Dateien\SUPERsetup.exe"
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=b243d68e6a5ba3449c9752d1a6a9a71e
# engine=14283
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-07-05 08:23:28
# local_time=2013-07-05 10:23:28 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5892 16777213 100 100 49775914 69926678 0 0
# scanned=400458
# found=2
# cleaned=0
# scan_time=10149
sh=431C3C88B0BD65AF49F43C06CA712C3E18EDFADB ft=1 fh=28585be5f68f22b8 vn="Win32/InstallMonetizer.AF application" ac=I fn="C:\Users\trishohara\Downloads\Pazera_Free_MP4_to_AVI_Converter.exe"
sh=38CCEB47628D4C73344595B1FAF505F874B86EB0 ft=1 fh=8c018257833e8034 vn="Win32/OpenCandy application" ac=I fn="G:\Install-Dateien\SUPERsetup.exe"
SecurityCheck macht diese Meldung.
UNSUPPORTED OPERATING SYSTEM! ABORTED!
Läuft wohl nicht in Windows 7?

Ich danke dir für deine Hilfe. Das Topic kann geschlossen werden.
Ich werde den Computer heute auf Werkszustand zurücksetzen. Ich habe gestern abend ein Macbook gekauft.

schrauber 06.07.2013 08:51
Zitat:
Ich werde den Computer heute auf Werkszustand zurücksetzen.
Er ist jetzt zwar sauber, aber wie du magst.


Alle Zeitangaben in WEZ +1. Es ist jetzt 00:39 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131