Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   BKA Virus, auch im abgesicherten Modus kein Zugriff auf PC (https://www.trojaner-board.de/141935-bka-virus-abgesicherten-modus-kein-zugriff-pc.html)

Bootsektor 25.09.2013 15:21
Hallo Akki18,
das ist merkwürdig. Hast Du eventuell auf einen Werbebanner, als auf den richtigen Download gedrückt?
Anbei ist nun ein direkter Link zum Dateidownload. Versuche es hiermit noch einmal und im Anschluss mache bitte nochmal einen Scan mit FRST und poste mir sowohl das Log von ComboFix als auch das FRST-Log wieder hier in Deinen Thread.

ComboFix.exe
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Akki18 26.09.2013 10:38
Hi,

endlich hat es funktioniert! Hier die Log Files von ComboFix.

Ist es eigentlich schon sicher eine Sicherheitskopie meiner Festplatte zu machen (auf eine Externe)?

Code:
ComboFix 13-09-26.01 - Iris 26.09.2013  11:03:44.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.43.1031.18.3950.2608 [GMT 2:00]
ausgeführt von:: c:\users\Iris\Desktop\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\progra~2\MYWEBS~1\bar\1.bin\mwsoemon.exe
c:\program files (x86)\DealPly
c:\program files (x86)\DealPly\uninst.exe
c:\program files (x86)\FunWebProducts
c:\program files (x86)\Google\Desktop\Install
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\GoogleUpdate.exe
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\00000004.@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\76603ac3
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@
c:\program files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@
c:\program files (x86)\MyWebSearch
c:\program files (x86)\MyWebSearch\bar\1.bin\CHROME.MANIFEST
c:\program files (x86)\MyWebSearch\bar\1.bin\chrome\M3FFXTBR.JAR
c:\program files (x86)\MyWebSearch\bar\1.bin\F3BKGERR.JPG
c:\program files (x86)\MyWebSearch\bar\1.bin\F3CJpeg.dll
c:\program files (x86)\MyWebSearch\bar\1.bin\F3DTACTL.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3HISTSW.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3HKSTUB.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3POPSWT.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
c:\program files (x86)\MyWebSearch\bar\1.bin\F3REGHK.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3REPROX.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3RESTUB.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3SCHMON.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\F3SPACER.WMV
c:\program files (x86)\MyWebSearch\bar\1.bin\F3WALLPP.DAT
c:\program files (x86)\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\FWPBUDDY.PNG
c:\program files (x86)\MyWebSearch\bar\1.bin\INSTALL.RDF
c:\program files (x86)\MyWebSearch\bar\1.bin\M3AUXSTB.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\M3DLGHK.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\M3HIGHIN.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\M3HTML.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\M3IDLE.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\M3MEDINT.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\M3MSg.dll
c:\program files (x86)\MyWebSearch\bar\1.bin\M3OUtlcn.dll
c:\program files (x86)\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\M3SKIN.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSMLBTN.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSOEMON.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSOESTB.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSSVC.EXE
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSUABTN.DLL
c:\program files (x86)\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
c:\program files (x86)\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files (x86)\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files (x86)\MyWebSearch\bar\Game\CHESS.F3S
c:\program files (x86)\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files (x86)\MyWebSearch\bar\icons\CM.ICO
c:\program files (x86)\MyWebSearch\bar\icons\MFC.ICO
c:\program files (x86)\MyWebSearch\bar\icons\PSS.ICO
c:\program files (x86)\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files (x86)\MyWebSearch\bar\icons\WB.ICO
c:\program files (x86)\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files (x86)\MyWebSearch\bar\Message\COMMON.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files (x86)\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files (x86)\MyWebSearch\bar\Settings\s_pid.dat
c:\program files (x86)\StartNow Toolbar
c:\program files (x86)\StartNow Toolbar\Resources\images\engine_images.png
c:\program files (x86)\StartNow Toolbar\Resources\images\engine_maps.png
c:\program files (x86)\StartNow Toolbar\Resources\images\engine_news.png
c:\program files (x86)\StartNow Toolbar\Resources\images\engine_videos.png
c:\program files (x86)\StartNow Toolbar\Resources\images\engine_web.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_amazon.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_ebay.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_facebook.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_games.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_msn.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_shopping.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_travel.png
c:\program files (x86)\StartNow Toolbar\Resources\images\icon_twitter.png
c:\program files (x86)\StartNow Toolbar\Resources\images\startnow_logo.png
c:\program files (x86)\StartNow Toolbar\Resources\installer.xml
c:\program files (x86)\StartNow Toolbar\Resources\protect\index.html
c:\program files (x86)\StartNow Toolbar\Resources\protect\NotIE6.css
c:\program files (x86)\StartNow Toolbar\Resources\protect\OnlyIE6.css
c:\program files (x86)\StartNow Toolbar\Resources\protect\SearchProtectIcon.png
c:\program files (x86)\StartNow Toolbar\Resources\protect\window.css
c:\program files (x86)\StartNow Toolbar\Resources\protect\window.js
c:\program files (x86)\StartNow Toolbar\Resources\reactivate\index.html
c:\program files (x86)\StartNow Toolbar\Resources\reactivate\LeftImage.png
c:\program files (x86)\StartNow Toolbar\Resources\reactivate\NotIE6.css
c:\program files (x86)\StartNow Toolbar\Resources\reactivate\OnlyIE6.css
c:\program files (x86)\StartNow Toolbar\Resources\reactivate\window.css
c:\program files (x86)\StartNow Toolbar\Resources\reactivate\window.js
c:\program files (x86)\StartNow Toolbar\Resources\skin\chevron_button.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_hover.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_normal.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_background.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_left.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_middle.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\separator.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\splitter.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.png
c:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.png
c:\program files (x86)\StartNow Toolbar\Resources\toolbar.xml
c:\program files (x86)\StartNow Toolbar\Resources\update.xml
c:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe
c:\program files (x86)\StartNow Toolbar\Toolbar32.dll
c:\program files (x86)\StartNow Toolbar\ToolbarUpdaterService.exe
c:\program files (x86)\StartNow Toolbar\uninstall.dat
c:\programdata\8692036.bat
c:\programdata\8692036.js
c:\programdata\8692036.pad
c:\programdata\8692036.reg
c:\programdata\DSearchLink
c:\programdata\DSearchLink\DSearchLink.exe
c:\users\Iris\AppData\Local\DProtect
c:\users\Iris\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_eooncjejnppfjjklapaamhcdmjbilmde_0.localstorage
c:\users\Iris\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\users\Iris\AppData\Local\Google\Desktop\Install
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\???\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\???\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\???\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\GoogleUpdate.exe
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\L\76603ac3
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@
c:\users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@
c:\users\Iris\AppData\Roaming\Ezuf
c:\users\Iris\AppData\Roaming\Ezuf\lado.exe
c:\users\Iris\Desktop\Search.lnk
c:\users\Public\mdsys.s
c:\users\Public\mdusys.s
c:\windows\assembly\GAC_32\Desktop.ini
c:\windows\assembly\GAC_64\Desktop.ini
c:\windows\Downloaded Program Files\f3initialsetup1.0.1.1.inf
c:\windows\SysWow64\f3PSSavr.scr
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_MyWebSearchService
-------\Service_WsysSvc
-------\Service_Updater Service for StartNow Toolbar
-------\Service_Updater Service for StartNow Toolbar
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-08-26 bis 2013-09-26  ))))))))))))))))))))))))))))))
.
.
2013-09-26 09:14 . 2013-09-26 09:14        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-09-24 22:19 . 2013-09-25 21:22        --------        d-----w-        c:\programdata\eSafe
2013-09-24 22:13 . 2013-09-26 09:18        --------        d-----w-        c:\program files (x86)\DealPlyLive
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\users\Iris\AppData\Local\DealPlyLive
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\programdata\DealPlyLive
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\users\Iris\AppData\Roaming\Dealply
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\users\Iris\AppData\Local\avgchrome
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\windows\SysWow64\Extensions
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\windows\SysWow64\searchplugins
2013-09-24 22:12 . 2013-09-24 22:12        --------        d-----w-        c:\programdata\Babylon
2013-09-24 22:12 . 2013-09-24 22:12        --------        d-----w-        c:\users\Iris\AppData\Roaming\Babylon
2013-09-22 22:19 . 2013-09-22 22:19        --------        d-----w-        C:\FRST
2013-09-03 13:53 . 2013-09-03 13:53        187248        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-23 22:11 . 2012-03-31 20:12        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-23 22:11 . 2011-06-04 17:45        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-08-12 21:38 . 2013-08-12 21:38        70        ----a-w-        c:\programdata\qyvgnuqcgekkslpoggp.bat
2013-08-12 21:38 . 2013-08-12 21:38        165        ----a-w-        c:\programdata\qyvgnuqcgekkslpoggp.reg
2013-07-12 22:26 . 2010-04-13 12:22        78185248        ----a-w-        c:\windows\system32\MRT.exe
2013-07-02 08:34 . 2013-08-13 15:24        9460976        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{D67F7D1E-0DEA-4D71-8E1B-B9368C8A9DBD}\mpengine.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-15 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"NortonUtilities"="c:\program files (x86)\Norton Utilities 14\RMTray.exe" [2009-09-14 279912]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19876968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-08-26 320880]
"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2010-01-15 26624]
"NortonOnlineBackup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-03-15 972632]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"UIExec"="c:\program files (x86)\Orange Mobiles Internet\UIExec.exe" [2012-07-25 157000]
.
c:\users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-12-01 21:03        98304        ------w-        c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 dealplylive;DealPly Live-Dienst (dealplylive);c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe;c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe [x]
R2 LMIRescue_2573fcbc-dcd7-4e8d-9006-71e6e999152e;LogMeIn Rescue (2573fcbc-dcd7-4e8d-9006-71e6e999152e);c:\users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe;c:\users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dealplylivem;DealPly Live-Dienst (dealplylivem);c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe;c:\program files (x86)\DealPlyLive\Update\DealPlyLive.exe [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 zte_cdc_acm;ZTE All CDC-ACM driver;c:\windows\system32\DRIVERS\zte_cdc_acm.sys;c:\windows\SYSNATIVE\DRIVERS\zte_cdc_acm.sys [x]
R3 zte_cdc_ecm;zte_cdc_ecm;c:\windows\system32\DRIVERS\zte_cdc_ecm.sys;c:\windows\SYSNATIVE\DRIVERS\zte_cdc_ecm.sys [x]
R3 zte_cpo;ZTE All Install;c:\windows\system32\DRIVERS\zte_cpo.sys;c:\windows\SYSNATIVE\DRIVERS\zte_cpo.sys [x]
R3 zte_ecm_enum;ZTE All DC Enumerator;c:\windows\system32\DRIVERS\zte_ecm_enum.sys;c:\windows\SYSNATIVE\DRIVERS\zte_ecm_enum.sys [x]
R3 zte_ecm_enum_filter;zte_ecm_enum_filter;c:\windows\system32\DRIVERS\zte_ecm_enum_filter.sys;c:\windows\SYSNATIVE\DRIVERS\zte_ecm_enum_filter.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys;c:\windows\SYSNATIVE\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\Orange Mobiles Internet\AssistantServices.exe;c:\program files (x86)\Orange Mobiles Internet\AssistantServices.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys;c:\windows\SYSNATIVE\drivers\HECIx64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x]
S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 22:11]
.
2013-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-15 07:24]
.
2013-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-15 07:24]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-16 9636896]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143967
mDefault_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
mStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
TCP: DhcpNameServer = 10.0.0.138 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: NameServer = 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\244584572633D284838493: NameServer = 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\2445F40756E6A7F6E656D224: NameServer = 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\8445340205F627471626C6560284F6473707F647: NameServer = 10.0.0.138
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{00A6FAF1-072E-44cf-8957-5838F569A31D} - c:\program files (x86)\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
BHO-{07B18EA1-A523-4961-B6BB-170DE4475CCA} - c:\program files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL
BHO-{6E13D095-45C3-4271-9475-F3B48227DD9F} - c:\program files (x86)\StartNow Toolbar\Toolbar32.dll
Toolbar-{07B18EA9-A523-4961-B6BB-170DE4475CCA} - c:\program files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL
Toolbar-{5911488E-9D1E-40ec-8CBB-06B231CC153F} - c:\program files (x86)\StartNow Toolbar\Toolbar32.dll
Wow6432Node-HKCU-Run-MobileDocuments - c:\program files (x86)\Common Files\Apple\Internet Services\ubd.exe
Wow6432Node-HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~2\MYWEBS~1\bar\1.bin\m3SrchMn.exe
Wow6432Node-HKLM-Run-MyWebSearch Email Plugin - c:\progra~2\MYWEBS~1\bar\1.bin\mwsoemon.exe
SafeBoot-mcmscsvc
SafeBoot-MCODS
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
AddRemove-Free YouTube to MP3 Converter_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-StartNow Toolbar - c:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgr.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
c:\program files\Sony\VAIO Care\listener.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-09-26  11:33:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-09-26 09:33
.
Vor Suchlauf: 13 Verzeichnis(se), 275.375.693.824 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 276.493.934.592 Bytes frei
.
- - End Of File - - 9247AAC21E40B76B6DF3CCAC5AE07A4F

Bootsektor 26.09.2013 10:45
Hallo Akki18,

Schön, dass der Scan von ComboFix funktionierte, ich brauche allerdings zur Analyse unbedingt nochmals ein neues FRST-Log.
So erstellst Du es:
Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Akki18 26.09.2013 10:46

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-09-2013
Ran by Iris (administrator) on IRIS-VAIO on 26-09-2013 11:44:19
Running from C:\Users\Iris\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
() C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-16] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-01-15] (Google Inc.)
HKCU\...\Run: [NortonUtilities] - C:\Program Files (x86)\Norton Utilities 14\RMTray.exe [279912 2009-09-14] (Symantec Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876968 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] - C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [NortonOnlineBackup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [972632 2010-03-15] (Symantec Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe [157000 2012-07-25] ()
Startup: C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143967
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=ds&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380061157&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=ds&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380061157&type=default&q={searchTerms}
SearchScopes: HKLM-x32 - {56256A51-B582-467e-B8D4-7786EDA79AE0} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?id=ZKxdm022YYAT&ptb=r.si49dBOvMsnk.kMM6m8g&psa=&ind=2010040811&ptnrS=ZKxdm022YYAT&si=19870&st=sb&n=77cec9eb&searchfor={searchTerms}
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=38CC2A8158FA21EB&affID=121240&tt=240913_238&tsp=5015
SearchScopes: HKCU - {33BB0A4E-99AF-4226-BDF6-49120163DE86} URL = hxxp://search.qvo6.com/web/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=ds&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143967&type=default&q={searchTerms}
SearchScopes: HKCU - {533D741B-78C5-46F0-8D2C-55E34CDC92E3} URL = hxxp://www.zinio.com/search/index.jsp?s={searchTerms}&rf=sonyie8search
SearchScopes: HKCU - {5A393B65-86DB-4383-B7E0-11A5F2CF5E14} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
SearchScopes: HKCU - {EB7DB293-EF0E-1B68-3751-120934CB891A} URL = hxxp://secnet.startnow.com/s/?q={searchTerms}&src=defsearch&provider=bing&provider_name=bing&provider_code=Z081&partner_id=196&product_id=606&affiliate_id=&channel=msn&toolbar_id=200&toolbar_version=2.1.0&install_country=US&install_date=20110531&user_guid=DFFAB998B304411689BC7CAC9CBBD048&machine_id=46cc128a5401164983ca1718ce3ad8e6&browser=IE&os=win&os_version=6.1-x64-SP0&iesrc={referrer:source}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSSRCAS.DLL No File
BHO-x32: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL No File
BHO-x32: StartNow Toolbar Helper - {6E13D095-45C3-4271-9475-F3B48227DD9F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL No File
Toolbar: HKLM-x32 - StartNow Toolbar - {5911488E-9D1E-40ec-8CBB-06B231CC153F} - C:\Program Files (x86)\StartNow Toolbar\Toolbar32.dll No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 -  No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU -  No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU -  No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Toolbar: HKCU -  No Name - {30F9B915-B755-4826-820B-08FBA6BD249D} -  No File
DPF: HKLM-x32 {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
DPF: HKLM-x32 {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138
Tcpip\..\Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: [NameServer]10.0.0.138

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (QuickShare Widget) - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl\1.4_0
CHR Extension: () - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo\1.1.5.2
CHR Extension: (Wajam) - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp\1.24
CHR Extension: (Skype Click to Call) - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR HKLM-x32\...\Chrome\Extension: [ifohbjbgfchkkfhphahclmkpgejiplfo] - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\newtab.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2792280 2010-03-15] (Symantec Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe [274760 2012-07-25] ()
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
S2 dealplylive; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /svc [x]
S3 dealplylivem; C:\Program Files (x86)\DealPlyLive\Update\DealPlyLive.exe /medsvc [x]
S2 LMIRescue_2573fcbc-dcd7-4e8d-9006-71e6e999152e; "C:\Users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe" -service -sid 2573fcbc-dcd7-4e8d-9006-71e6e999152e [x]

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102472 2010-02-17] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [308296 2010-02-17] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2010-02-17] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2010-02-17] (McAfee, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-11-12] ()
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-08-11] (ZTE)
S3 zte_cdc_ecm; C:\Windows\System32\DRIVERS\zte_cdc_ecm.sys [36864 2011-08-11] (ZTE)
S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [14336 2011-08-11] (ZTE)
S3 zte_ecm_enum; C:\Windows\System32\DRIVERS\zte_ecm_enum.sys [56320 2011-08-11] (ZTE)
S3 zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\zte_ecm_enum_filter.sys [56320 2011-08-11] (ZTE)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [x]
U2 wuaserv;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-26 11:43 - 2013-09-26 11:44 - 01956432 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-26 11:42 - 2013-09-26 11:42 - 05688040 _____ (Systweak Inc                                                ) C:\Users\Iris\Desktop\rcpafterdownloadcp_ad_2092_cp1.exe
2013-09-26 11:34 - 2013-09-26 11:34 - 00037691 _____ C:\ComboFix.txt
2013-09-26 11:01 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-26 11:01 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-26 11:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-26 11:00 - 2013-09-26 11:34 - 00000000 ____D C:\Qoobox
2013-09-26 11:00 - 2013-09-26 11:30 - 00000000 ____D C:\Windows\erdnt
2013-09-26 10:59 - 2013-09-26 10:58 - 05129554 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-25 00:19 - 2013-09-25 23:22 - 00000000 ____D C:\ProgramData\eSafe
2013-09-25 00:13 - 2013-09-26 11:18 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-09-25 00:13 - 2013-09-25 00:13 - 00003226 _____ C:\Windows\System32\Tasks\Dealply
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Dealply
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\DealPlyLive
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-25 00:12 - 2013-09-25 00:12 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Babylon
2013-09-25 00:12 - 2013-09-25 00:12 - 00000000 ____D C:\ProgramData\Babylon
2013-09-24 00:09 - 2013-09-24 00:10 - 00050535 _____ C:\Users\Iris\Desktop\Addition.txt
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat
2013-09-05 23:52 - 2013-09-05 23:52 - 00000000 ____D C:\Users\Iris\AppData\Local\{781020B9-D51D-4092-B41E-87BBD163918D}
2013-09-05 23:50 - 2013-09-05 23:50 - 00000000 ____D C:\Users\Iris\AppData\Local\{F1F44777-78FA-4E82-879A-AA6DDC71E9F9}
2013-09-05 23:46 - 2013-09-05 23:46 - 00000000 ____D C:\Users\Iris\AppData\Local\{14FFB91F-FBA0-441A-A477-8972095852C1}
2013-09-05 23:45 - 2013-09-05 23:45 - 00000000 ____D C:\Users\Iris\AppData\Local\{18E720C6-DDAA-47E7-AC4D-C2F5A3B046AA}

==================== One Month Modified Files and Folders =======

2013-09-26 11:44 - 2013-09-26 11:43 - 01956432 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-26 11:42 - 2013-09-26 11:42 - 05688040 _____ (Systweak Inc                                                ) C:\Users\Iris\Desktop\rcpafterdownloadcp_ad_2092_cp1.exe
2013-09-26 11:34 - 2013-09-26 11:34 - 00037691 _____ C:\ComboFix.txt
2013-09-26 11:34 - 2013-09-26 11:00 - 00000000 ____D C:\Qoobox
2013-09-26 11:34 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-26 11:31 - 2010-04-02 14:28 - 01523897 _____ C:\Windows\WindowsUpdate.log
2013-09-26 11:30 - 2013-09-26 11:00 - 00000000 ____D C:\Windows\erdnt
2013-09-26 11:26 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-26 11:26 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-26 11:19 - 2010-01-15 09:24 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-26 11:18 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\DealPlyLive
2013-09-26 11:18 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-26 11:17 - 2013-08-13 17:18 - 00008091 _____ C:\Windows\setupact.log
2013-09-26 11:17 - 2010-01-15 09:24 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-26 11:17 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-26 11:16 - 2013-08-13 17:17 - 00502014 _____ C:\Windows\PFRO.log
2013-09-26 11:15 - 2009-07-14 04:34 - 78381056 _____ C:\Windows\system32\config\software.bak
2013-09-26 11:15 - 2009-07-14 04:34 - 20971520 _____ C:\Windows\system32\config\system.bak
2013-09-26 11:15 - 2009-07-14 04:34 - 00524288 _____ C:\Windows\system32\config\default.bak
2013-09-26 11:15 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\security.bak
2013-09-26 11:15 - 2009-07-14 04:34 - 00262144 _____ C:\Windows\system32\config\sam.bak
2013-09-26 11:13 - 2010-08-22 13:07 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Skype
2013-09-26 11:11 - 2012-03-31 22:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-26 11:00 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 10:58 - 2013-09-26 10:59 - 05129554 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-26 00:05 - 2010-01-15 09:21 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2013-09-25 23:27 - 2010-01-15 09:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-25 23:25 - 2010-04-02 14:32 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D1B11C91-16E4-4B70-85ED-51D8A96B0160}
2013-09-25 23:22 - 2013-09-25 00:19 - 00000000 ____D C:\ProgramData\eSafe
2013-09-25 23:21 - 2011-06-19 19:05 - 00001729 _____ C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-25 23:21 - 2010-04-02 14:31 - 00001717 _____ C:\Users\Iris\Desktop\Internet Explorer.lnk
2013-09-25 00:13 - 2013-09-25 00:13 - 00003226 _____ C:\Windows\System32\Tasks\Dealply
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Dealply
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\DealPlyLive
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\ProgramData\DealPlyLive
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-25 00:12 - 2013-09-25 00:12 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Babylon
2013-09-25 00:12 - 2013-09-25 00:12 - 00000000 ____D C:\ProgramData\Babylon
2013-09-25 00:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-24 23:55 - 2012-03-01 19:58 - 00000000 ____D C:\Program Files (x86)\Norton 360 Premier Edition
2013-09-24 23:55 - 2010-06-20 15:53 - 00000000 ____D C:\ProgramData\Norton
2013-09-24 11:55 - 2011-04-21 04:18 - 00000000 ____D C:\Users\Iris\AppData\Local\Conduit
2013-09-24 11:50 - 2012-03-01 19:36 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2013-09-24 11:48 - 2012-03-01 19:36 - 00001300 _____ C:\Users\Iris\Desktop\Norton-Installationsdateien.lnk
2013-09-24 00:11 - 2012-03-31 22:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-24 00:11 - 2012-03-31 22:12 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-24 00:11 - 2011-06-04 19:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-24 00:10 - 2013-09-24 00:09 - 00050535 _____ C:\Users\Iris\Desktop\Addition.txt
2013-09-24 00:09 - 2010-01-15 18:11 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-09-24 00:09 - 2010-01-15 18:11 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-09-24 00:09 - 2009-07-14 07:13 - 01512244 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-16 00:53 - 2010-12-10 03:55 - 00009968 _____ C:\Users\Iris\Documents\Filme.xlsx
2013-09-14 23:15 - 2013-08-04 20:16 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Lyax
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat
2013-09-13 01:26 - 2010-12-25 22:02 - 00000207 _____ C:\Windows\system32\sstates.sdt
2013-09-13 01:26 - 2010-12-25 22:02 - 00000040 _____ C:\Windows\system32\sstate_prev.sdt
2013-09-08 01:40 - 2011-06-08 00:23 - 00000000 ____D C:\Users\Iris\AppData\Local\CrashDumps
2013-09-05 23:52 - 2013-09-05 23:52 - 00000000 ____D C:\Users\Iris\AppData\Local\{781020B9-D51D-4092-B41E-87BBD163918D}
2013-09-05 23:50 - 2013-09-05 23:50 - 00000000 ____D C:\Users\Iris\AppData\Local\{F1F44777-78FA-4E82-879A-AA6DDC71E9F9}
2013-09-05 23:46 - 2013-09-05 23:46 - 00000000 ____D C:\Users\Iris\AppData\Local\{14FFB91F-FBA0-441A-A477-8972095852C1}
2013-09-05 23:45 - 2013-09-05 23:45 - 00000000 ____D C:\Users\Iris\AppData\Local\{18E720C6-DDAA-47E7-AC4D-C2F5A3B046AA}
2013-09-05 23:45 - 2012-07-01 10:04 - 00000000 ____D C:\Users\Iris\AppData\Local\Windows Live

Files to move or delete:
====================
C:\ProgramData\qyvgnuqcgekkslpoggp.bat
C:\ProgramData\qyvgnuqcgekkslpoggp.reg


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-21 15:01

==================== End Of Log ============================
--- --- ---

Bootsektor 26.09.2013 19:42
Hallo Akki18,
mache die Sicherungen bitte erst dann, wenn wir komplett durch sind mit der Bereinigung.

Schritt 1
Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.

    Code:
    Driver::
    dealplylive
    dealplylivem

    Folder::
    c:\programdata\Babylon
    c:\users\Iris\AppData\Roaming\Babylon
    c:\users\Iris\AppData\Local\DealPlyLive
    c:\users\Iris\AppData\Roaming\Dealply
    c:\program files (x86)\DealPlyLive

    File::
    C:\ProgramData\qyvgnuqcgekkslpoggp.bat
    C:\ProgramData\qyvgnuqcgekkslpoggp.reg


    DDS::
    uStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143967
    mDefault_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
    mStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!



Schritt 2
Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).


Schritt 3

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.



Schritt 4
Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Akki18 27.09.2013 16:26
Hi,
hier sind alle 4 angeforderten LogFiles :)

Code:
ComboFix 13-09-26.03 - Iris 27.09.2013  15:56:14.2.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.43.1031.18.3950.2183 [GMT 2:00]
ausgeführt von:: c:\users\Iris\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\Iris\Desktop\CFScript.txt
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\programdata\qyvgnuqcgekkslpoggp.bat"
"c:\programdata\qyvgnuqcgekkslpoggp.reg"
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\DealPlyLive
c:\programdata\Babylon
c:\programdata\qyvgnuqcgekkslpoggp.bat
c:\programdata\qyvgnuqcgekkslpoggp.reg
c:\users\Iris\AppData\Local\DealPlyLive
c:\users\Iris\AppData\Roaming\Babylon
c:\users\Iris\AppData\Roaming\Babylon\log_file.txt
c:\users\Iris\AppData\Roaming\Dealply
c:\users\Iris\AppData\Roaming\Dealply\UpdateProc\config.dat
c:\users\Iris\AppData\Roaming\Dealply\UpdateProc\TTL.DAT
.
Infizierte Kopie von c:\windows\system32\Services.exe wurde gefunden und desinfiziert
Kopie von - c:\windows\erdnt\cache64\services.exe wurde wiederhergestellt
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_dealplylive
-------\Service_dealplylivem
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-08-27 bis 2013-09-27  ))))))))))))))))))))))))))))))
.
.
2013-09-27 14:07 . 2013-09-27 14:07        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-09-27 13:46 . 2013-09-15 22:50        9694160        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{354F0C67-1B6C-4AA2-8F05-B8A8F4D5CD83}\mpengine.dll
2013-09-26 09:38 . 2013-07-09 05:46        1472512        ----a-w-        c:\windows\system32\crypt32.dll
2013-09-24 22:19 . 2013-09-25 21:22        --------        d-----w-        c:\programdata\eSafe
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\programdata\DealPlyLive
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\users\Iris\AppData\Local\avgchrome
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\windows\SysWow64\Extensions
2013-09-24 22:13 . 2013-09-24 22:13        --------        d-----w-        c:\windows\SysWow64\searchplugins
2013-09-22 22:19 . 2013-09-22 22:19        --------        d-----w-        C:\FRST
2013-09-03 13:53 . 2013-09-03 13:53        187248        ----a-w-        c:\program files (x86)\Internet Explorer\Plugins\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-09-23 22:11 . 2012-03-31 20:12        692616        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-09-23 22:11 . 2011-06-04 17:45        71048        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-09-01 15:08 . 2010-04-13 12:22        79143768        ----a-w-        c:\windows\system32\MRT.exe
2013-08-07 02:22 . 2012-02-25 15:00        278800        ------w-        c:\windows\system32\MpSigStub.exe
2013-08-02 01:48 . 2013-09-26 09:38        44032        ----a-w-        c:\windows\apppatch\acwow64.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{00A6FAF1-072E-44cf-8957-5838F569A31D}]
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSSRCAS.DLL [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}]
c:\program files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}]
c:\program files (x86)\StartNow Toolbar\Toolbar32.dll [BU]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{07B18EA9-A523-4961-B6BB-170DE4475CCA}"= "c:\program files (x86)\MyWebSearch\bar\1.bin\MWSBAR.DLL" [BU]
"{5911488E-9D1E-40ec-8CBB-06B231CC153F}"= "c:\program files (x86)\StartNow Toolbar\Toolbar32.dll" [BU]
.
[HKEY_CLASSES_ROOT\clsid\{07b18ea9-a523-4961-b6bb-170de4475cca}]
.
[HKEY_CLASSES_ROOT\clsid\{5911488e-9d1e-40ec-8cbb-06b231cc153f}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-15 39408]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"NortonUtilities"="c:\program files (x86)\Norton Utilities 14\RMTray.exe" [2009-09-14 279912]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-21 19876968]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2009-11-20 284696]
"ISBMgr.exe"="c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2009-08-26 320880]
"MarketingTools"="c:\program files (x86)\Sony\Marketing Tools\MarketingTools.exe" [2010-01-15 26624]
"NortonOnlineBackup"="c:\program files (x86)\Symantec\Norton Online Backup\NOBuClient.exe" [2010-03-15 972632]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-31 152392]
"UIExec"="c:\program files (x86)\Orange Mobiles Internet\UIExec.exe" [2012-07-25 157000]
.
c:\users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2009-12-01 21:03        98304        ------w-        c:\windows\System32\VESWinlogon.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=""
.
R2 LMIRescue_2573fcbc-dcd7-4e8d-9006-71e6e999152e;LogMeIn Rescue (2573fcbc-dcd7-4e8d-9006-71e6e999152e);c:\users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe;c:\users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys;c:\windows\SYSNATIVE\drivers\btusbflt.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys;c:\windows\SYSNATIVE\drivers\Impcd.sys [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 SOHCImp;VAIO Media plus Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDms;VAIO Media plus Digital Media Server;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDms.exe [x]
R3 SOHDs;VAIO Media plus Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 zte_cdc_acm;ZTE All CDC-ACM driver;c:\windows\system32\DRIVERS\zte_cdc_acm.sys;c:\windows\SYSNATIVE\DRIVERS\zte_cdc_acm.sys [x]
R3 zte_cdc_ecm;zte_cdc_ecm;c:\windows\system32\DRIVERS\zte_cdc_ecm.sys;c:\windows\SYSNATIVE\DRIVERS\zte_cdc_ecm.sys [x]
R3 zte_cpo;ZTE All Install;c:\windows\system32\DRIVERS\zte_cpo.sys;c:\windows\SYSNATIVE\DRIVERS\zte_cpo.sys [x]
R3 zte_ecm_enum;ZTE All DC Enumerator;c:\windows\system32\DRIVERS\zte_ecm_enum.sys;c:\windows\SYSNATIVE\DRIVERS\zte_ecm_enum.sys [x]
R3 zte_ecm_enum_filter;zte_ecm_enum_filter;c:\windows\system32\DRIVERS\zte_ecm_enum_filter.sys;c:\windows\SYSNATIVE\DRIVERS\zte_ecm_enum_filter.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 NOBU;Norton Online Backup;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service;c:\program files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe service [x]
S2 rimspci;rimspci;c:\windows\system32\drivers\rimssne64.sys;c:\windows\SYSNATIVE\drivers\rimssne64.sys [x]
S2 risdsnpe;risdsnpe;c:\windows\system32\drivers\risdsne64.sys;c:\windows\SYSNATIVE\drivers\risdsne64.sys [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\Orange Mobiles Internet\AssistantServices.exe;c:\program files (x86)\Orange Mobiles Internet\AssistantServices.exe [x]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\drivers\HECIx64.sys;c:\windows\SYSNATIVE\drivers\HECIx64.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\drivers\SFEP.sys;c:\windows\SYSNATIVE\drivers\SFEP.sys [x]
S3 VAIO Power Management;VAIO Power Management;c:\program files\Sony\VAIO Power Management\SPMService.exe;c:\program files\Sony\VAIO Power Management\SPMService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys;c:\windows\SYSNATIVE\DRIVERS\yk62x64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-27 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 22:11]
.
2013-09-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-15 07:24]
.
2013-09-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-01-15 07:24]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-12-16 9636896]
"Apoint"="c:\program files (x86)\Apoint\Apoint.exe" [BU]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mDefault_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
mStart Page = hxxp://www.qvo6.com/?utm_source=b&utm_medium=adks&utm_campaign=eXQ&utm_content=hp&from=adks&uid=WDCXWD5000BEVT-26A0RT0_WD-WX11A10S9454S9454&ts=1380143736
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
TCP: DhcpNameServer = 10.0.0.138 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: NameServer = 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\244584572633D284838493: NameServer = 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\2445F40756E6A7F6E656D224: NameServer = 10.0.0.138
TCP: Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}\8445340205F627471626C6560284F6473707F647: NameServer = 10.0.0.138
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
WebBrowser-{872B5B88-9DB5-4310-BDD0-AC189557E5F5} - (no file)
WebBrowser-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
AddRemove-Free YouTube to MP3 Converter_is1 - c:\program files (x86)\Common Files\DVDVideoSoft\Uninstall.exe
AddRemove-StartNow Toolbar - c:\program files (x86)\StartNow Toolbar\StartNowToolbarUninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\VCPerfService.exe\" \"/service\" \"/sstates\" \"/sampleinterval=5000\" \"/procinterval=5\" \"/dllinterval=120\" \"/counter=\Processor(_Total)\% Processor Time:1/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \"/counter=\Network Interface(*)\Bytes Total/sec:1\" \"/expandcounter=\Processor Information(*)\Processor Frequency:1\" \"/expandcounter=\Processor(*)\% Idle Time:1\" \"/expandcounter=\Processor(*)\% C1 Time:1\" \"/expandcounter=\Processor(*)\% C2 Time:1\" \"/expandcounter=\Processor(*)\% C3 Time:1\" \"/expandcounter=\Processor(*)\% Processor Time:1\" \"/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_175_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_175.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgr.exe
c:\windows\SysWOW64\DllHost.exe
c:\program files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-09-27  16:17:36 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2013-09-27 14:17
ComboFix2.txt  2013-09-26 09:34
.
Vor Suchlauf: 20 Verzeichnis(se), 275.088.150.528 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 274.901.053.440 Bytes frei
.
- - End Of File - - 1D5EE5BA2DF916878962CB6D0EB9EE26
Code:
# AdwCleaner v3.005 - Bericht erstellt am 27/09/2013 um 17:02:37
# Updated 22/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Iris - IRIS-VAIO
# Gestartet von : C:\Users\Iris\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\DealPlyLive
Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Users\Iris\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\Iris\AppData\Local\ConduitEngine
Ordner Gelöscht : C:\Users\Iris\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\Iris\AppData\LocalLow\delta
Ordner Gelöscht : C:\Users\Iris\AppData\LocalLow\FunWebProducts
Ordner Gelöscht : C:\Users\Iris\AppData\LocalLow\MyWebSearch
Ordner Gelöscht : C:\Users\Iris\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\Iris\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\amfclgbdpgndipgoegfpkkgobahigbcl
Ordner Gelöscht : C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
Ordner Gelöscht : C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpmbfleldcgkldadpdinhjjopdfpjfjp
Datei Gelöscht : C:\Windows\System32\Tasks\Dealply

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\Users\Iris\Desktop\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Iris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Iris\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Internet Explorer.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [m3ffxtbr@mywebsearch.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\ifohbjbgfchkkfhphahclmkpgejiplfo
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\dealplylive.exe
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\Toolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Conduit.Engine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.coreclass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclasssvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc.1.0
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.BandObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.BandObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObject
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows Media\Wmsdk\Sources [F3PopularScreenSavers]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\post platform [FunWebProducts]
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@mywebsearch.com/Plugin
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\58e8d8ab268e942
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00A6FAF1-072E-44CF-8957-5838F569A31D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00A6FAF6-072E-44CF-8957-5838F569A31D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25560540-9571-4D7B-9389-0F166788785A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{3E720452-B472-4954-B7AA-33069EB53906}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{53CED2D0-5E9A-4761-9005-648404E6F7E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5911488E-9D1E-40EC-8CBB-06B231CC153F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E13D095-45C3-4271-9475-F3B48227DD9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7473D292-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{7473D296-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{799391D3-EB86-4BAC-9BD3-CBFEA58A0E15}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{84DA4FDF-A1CF-4195-8688-3E961F505983}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{8E6F1832-9607-4440-8530-13BE7C4B1D14}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{938AA51A-996C-4884-98CE-80DD16A5C9DA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A4730EBE-43A6-443E-9776-36915D323AD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A9571378-68A1-443D-B082-284F960C6D17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{ADB01E81-3C79-4272-A0F1-7B2BE7A782DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{B813095C-81C0-4E40-AA14-67520372B987}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{C9D7BE3E-141A-4C85-8CD6-32461F3DF2C7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CFF4CE82-3AA2-451F-9B77-7165605FB835}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D858DAFC-9573-4811-B323-7011A3AA7E61}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{D9FFFB27-D62A-4D64-8CEC-1FF006528805}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{07B18EAA-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{07B18EAC-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1093995A-BA37-41D2-836E-091067C4AD17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{120927BF-1700-43BC-810F-FAB92549B390}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{17DE5E5E-BFE3-4E83-8E1F-8755795359EC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1F52A5FA-A705-4415-B975-88503B291728}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{247A115F-06C2-4FB3-967D-2D62D3CF4F0A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2E3537FC-CF2F-4F56-AF54-5A6A3DD375CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3E1656ED-F60E-4597-B6AA-B6A58E171495}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3E53E2CB-86DB-4A4A-8BD9-FFEB7A64DF82}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3E720451-B472-4954-B7AA-33069EB53906}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3E720453-B472-4954-B7AA-33069EB53906}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{63D0ED2B-B45B-4458-8B3B-60C69BBBD83C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{63D0ED2D-B45B-4458-8B3B-60C69BBBD83C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6E74766C-4D93-4CC0-96D1-47B8E07FF9CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72EE7F04-15BD-4845-A005-D6711144D86A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7473D291-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7473D293-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7473D295-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7473D297-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7D86A08B-0A8F-4BE0-B693-F05E6947E780}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{90449521-D834-4703-BB4E-D3AA44042FF8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{991AAC62-B100-47CE-8B75-253965244F69}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A626CDBD-3D13-4F78-B819-440A28D7E8FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BBABDC90-F3D5-4801-863A-EE6AE529862D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D6FF3684-AD3B-48EB-BBB4-B9E6C5A355C1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DE38C398-B328-4F4C-A3AD-1B5E4ED93477}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E342AF55-B78A-4CD0-A2BB-DA7F52D9D25F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E79DFBC9-5697-4FBD-94E5-5B2A9C7C1612}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E79DFBCB-5697-4FBD-94E5-5B2A9C7C1612}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EB9E5C1C-B1F9-4C2B-BE8A-27D6446FDAF8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F87D7FB5-9DC5-4C8C-B998-D8DFE02E2978}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E47CAEE0-DEEA-464A-9326-3F2801535A4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{F42228FB-E84E-479E-B922-FBBD096E792C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00A6FAF1-072E-44CF-8957-5838F569A31D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E13D095-45C3-4271-9475-F3B48227DD9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5911488E-9D1E-40EC-8CBB-06B231CC153F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6E13D095-45C3-4271-9475-F3B48227DD9F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00A6FAF1-072E-44CF-8957-5838F569A31D}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA9-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{1E0DE227-5CE4-4EA3-AB0C-8B03E1AA76BC}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5911488E-9D1E-40EC-8CBB-06B231CC153F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{6E13D095-45C3-4271-9475-F3B48227DD9F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07B18EAB-A523-4961-B6BB-170DE4475CCA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3E720452-B472-4954-B7AA-33069EB53906}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473D294-B7BB-4F24-AE82-7E2CE94BB6A9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E79DFBCA-5697-4FBD-94E5-5B2A9C7C1612}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59C7FC09-1C83-4648-B3E6-003D2BBC7481}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68AF847F-6E91-45DD-9B68-D6A12C30E5D7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170B96C-28D4-4626-8358-27E6CAEEF907}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D1A71FA0-FF48-48DD-9B6D-7A13A3E42127}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DDB1968E-EAD6-40FD-8DAE-FF14757F60C7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F138D901-86F0-4383-99B6-9CDD406036DA}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256A51-B582-467E-B8D4-7786EDA79AE0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{07B18EA9-A523-4961-B6BB-170DE4475CCA}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{5911488E-9D1E-40EC-8CBB-06B231CC153F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{30F9B915-B755-4826-820B-08FBA6BD249D}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\Conduit
[#] Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\dealplylive
Schlüssel Gelöscht : HKCU\Software\Delta
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Fun Web Products
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\FunWebProducts
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\MyWebSearch
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Toolbar
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\Software\dealplylive
Schlüssel Gelöscht : HKLM\Software\Delta
Schlüssel Gelöscht : HKLM\Software\DeviceVM
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\Software\FocusInteractive
Schlüssel Gelöscht : HKLM\Software\Fun Web Products
Schlüssel Gelöscht : HKLM\Software\FunWebProducts
Schlüssel Gelöscht : HKLM\Software\MyWebSearch
Schlüssel Gelöscht : HKLM\Software\qvo6Software
Schlüssel Gelöscht : HKLM\Software\StartNow Toolbar
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mywebsearch bar uninstall
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\StartNow Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WSysControl
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\DeviceVM

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16686

Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Default_Page_URL]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]

*************************

AdwCleaner[R0].txt - [25775 octets] - [27/09/2013 17:01:25]
AdwCleaner[S0].txt - [23749 octets] - [27/09/2013 17:02:37]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [23810 octets] ##########
Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Home Premium x64
Ran by Iris on 27.09.2013 at 17:12:16,90
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3255027269-130910027-3791166871-1001\Software\SweetIM
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{533D741B-78C5-46F0-8D2C-55E34CDC92E3}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{EB7DB293-EF0E-1B68-3751-120934CB891A}



~~~ Files



~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0458F670-85AB-4E82-A941-1DF26EB69AEB}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{04FA2B75-A701-4845-88BA-7D2BF093E4CD}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{06319D55-2FCA-43C7-AA57-C45086943BEA}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{094BFC8F-B0BC-4291-A93B-DEE7F2C719C9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{096A6BBA-C2F0-4990-9143-2BD488F80E45}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0A49523F-EAA4-4A0A-BB1E-005800E4E9B9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0AE1D28B-BE40-4316-9316-AEE6C87D6FE1}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0B94F4D9-6ED8-4890-A4D0-0AA6F9EC233B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0CCE0EF9-7923-4085-A16E-6F3EB01E6970}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0E9C3A3E-EB8C-4A4D-91E1-0F871B6D465D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0F1E6DD2-681F-4D1B-AFAD-982898D1EE0D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{0F3BE252-73EB-4927-8814-92CB5272D39F}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{13C64B75-AA25-484B-8CCC-E61913929263}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{142E5B82-2345-403C-866B-878555C8A8FC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{14FFB91F-FBA0-441A-A477-8972095852C1}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{15586C08-FF1E-4AC9-870A-8EB8CF9CE828}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{15C2C6EA-D92F-4A11-8715-268A6C9CF8CA}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1727569B-A2BF-4607-8912-2FB15B1EBD5E}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{172F29C0-4CD5-437F-B5EE-3F258C04A376}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{17FC4192-9186-43E5-B033-117C27F7BAE0}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1881107F-A46E-435A-BAC3-61C164592897}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{188CF025-7A3D-4508-B203-74C6BF88915D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{18E720C6-DDAA-47E7-AC4D-C2F5A3B046AA}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{19A2FF4C-D9D5-4748-A58F-AB130ECFC910}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{19A539C4-1C71-43AB-AD7D-583DF75E4D91}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1A54B9D2-DDA6-48DC-B8CA-1CBC90B16487}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1BEF97EA-A8C1-46A7-B928-C7E8F2370EF5}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1C580723-3636-4B0E-804C-111E1E96A302}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1C6DCA4A-B755-49BF-B2D0-A010D04FAF1A}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1EC9F4B0-71EF-4A6C-BED7-32AA4DC66F6C}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{1FA4CFDD-E001-45D5-AC48-911DB2E1B7BC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{2053FDCC-6865-4A38-938D-9453224065F9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{20BC2B29-3C8D-42DC-B889-CD33F9FCE556}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{23C3B833-2EBF-405D-8281-4DB6B93AD5C6}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{24406E5E-4663-4C01-9015-C14A40DCF683}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{2447ABB8-A3D1-44BC-8378-03D9C3790D72}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{2B41AF85-3745-424E-B0C7-6DFFB80FEB55}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{2B6BA5C3-DF55-41FB-8A46-2247146480DA}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{2FD94F35-2CF7-461F-B979-9A5FB8095C44}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{324633E7-EB4F-48BD-8181-F332B9CBCD33}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{338DE5F2-D61C-4223-BB78-FB22EFD96D22}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{3422D02E-EE14-4E5C-B6F8-6A337EAEFCC0}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{368D22B5-A814-42F0-A62F-A032209F4F76}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{3999C152-2EEA-41FF-B55E-5830CBD35804}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{3B278B93-A326-452A-A053-9AD565154549}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{3D06EF86-7D0B-4648-81C5-623CE0961A54}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{3D538C71-ECA2-4CE6-81D8-C722D732440A}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{406E566C-406E-4262-AA81-215B1AB6154B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{40CD5772-D980-45C6-8748-E8E753D4B47C}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{40D0386C-A488-470E-876C-FD24FB4DABC2}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{4296EFBB-0EA1-4651-8A3B-90E8F77DC97D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{488EEAEA-4176-466F-9845-9184ED1AECBC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{49BEBCCD-CD15-4507-B769-8638A50025F3}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{49C33F36-CDD7-405D-90B9-9D827887B550}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{4A2315D8-B3BE-4375-BA1F-624DD7D48320}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{4C07B42B-A68F-4D11-BF5C-1C551A5C5AEB}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{4E306971-19DB-4E68-9089-C429220A0BC9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{4EF6A309-F4F2-43F1-85DB-708240569F95}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{4F898690-2D52-4D90-94F5-3F959ABA7EEC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5217428F-8CF1-406E-9AAF-8D794207B16B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{53D756A2-A685-4748-9A28-19D09587B95A}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5401DFCA-485A-4710-8D55-C496B87ED549}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{55BE8DC0-2EA1-4F7E-81C1-C934CD27A222}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{56B0DF10-BF60-47B3-B02F-70815370FF64}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{57E8587F-61E1-4797-9B23-902409B8CBB8}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{589D2324-33FB-4CED-AB84-0C63AB9EAEC6}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{59F1A97A-C74B-48A8-8C40-FB5EAF71D075}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5B2A5F7E-93EE-4792-BB80-E6E6946A6118}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5BB7ED02-980D-409E-9F25-B8CE64AAB07E}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5D6249E1-974D-47C2-B91F-717D3B476E3A}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5EE4FEDF-5C51-4C8C-85F9-55A8CD9AE8E1}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{5FA8C94F-5E82-411F-A1DE-ECD19CA25310}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{607132AD-A4AB-45BE-94A7-4F158661266A}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{6090EA2D-AA4A-4249-A6A9-E4B5955986A5}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{61BDB139-9A77-45EF-A90C-27FBF324A9EC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{64029469-FCA9-4FD5-8AD9-20248D2B579B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{656C7C74-5264-4D36-9FE9-319F4EA43A33}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{670D2A00-1F41-42EA-A14D-7B60AAED7C0F}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{6DE24F52-6531-4A3E-928D-3ADD397FC1C9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{718CA762-007E-48CA-BA42-41B8FC1E9BC5}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{729E1D2C-BEB2-4B83-867A-D2BACCDCE4AC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{730CE34C-D0FF-42C8-8F0F-CA553472CB1B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{751DA2F8-E1D6-4415-85EE-52C1E77F93C3}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{776A0F53-3523-4D25-9909-DBD65D493554}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{781020B9-D51D-4092-B41E-87BBD163918D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{78FC4742-B539-4762-BE0B-081EE047233C}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{7A517EBC-DD06-46CD-AA63-2BCADFBDDE9B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{7AC2F313-9C95-4C95-97BA-803FF7DBD1E0}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{7B303477-03F4-4DE5-9E54-3BC128BBF1B4}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{7B7A5E86-6E45-4EC2-93B6-CF9EAC7D9AA0}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{7C1FC644-670C-4716-83A7-2C91E55C2F56}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{80063D25-AC73-4EC9-A30C-DBF2CE5FEB95}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{809A5C97-C6F3-4A79-83E4-B9D8E22B0C8B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{8353A37A-780E-4C80-A5AE-B3DBB5759EB6}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{83C01E2F-1FAA-488A-9FE8-588C0CD2F663}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{83C5E0D7-DC1D-4A16-B819-B2D3B0514738}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{84800C34-7A54-41B5-82D8-940FDCF29C6D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{88D7B197-8A40-4FD2-9145-95DB2ECEF091}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{8A4229DF-FEC4-4F13-8919-D9C0EA544734}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{8AA12D14-801A-46C8-AD8B-C68A103903A2}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{8C91A659-A0C4-4517-8561-5C12A2FDA151}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{8F4050C2-F53E-49EA-959F-4312F5D48F66}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{8F9DA863-36CF-43CE-9693-699E508968EE}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{908A2158-C909-4928-A18B-48103FB25907}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{90B23834-300E-4F7E-8A65-9295812C20DF}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{920B53DD-6E75-46F3-B953-A35FEEF726A9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{92D8748E-0823-4650-84FB-41D50C9F8DE4}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{93188552-F935-4CC5-B96D-70DADB73E587}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{94FAF787-49DB-4EA9-82B8-CD666048267C}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{98D2B30F-8D50-4243-B7BC-015FAAE9F910}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{99EEDA8F-C0FE-4848-AC32-400C72377B80}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{9A6A662A-D5CE-4FF0-8420-D74A74E13505}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{9E12E932-51EF-48D9-A292-314DDB52FD4D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A0ADF9A8-8A47-4A0F-9D26-9A7C364192BE}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A107B672-4DF4-4CD9-83C9-89BD989F2C2F}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A1446A39-CB92-4172-A9B2-9BBC0C368122}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A1A760AC-383C-49FF-88AD-5E10350A6445}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A35C5EC1-2677-4718-9F3A-191EF087C46E}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A50AB48E-B136-41AC-927F-1E64BF21134C}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A72D7718-0A48-419B-9F4B-4B302298CB5F}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{A9B308B9-3966-40BB-841B-2C82D425C130}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{AD6D0FC0-8065-40FA-B309-4D392A677512}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B0ADA2D4-A70F-4A2F-BA21-05F6F8B6B481}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B36D9400-36B8-468D-8E75-2196DECE702B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B47F6F63-2870-4381-954C-78B1BB7994FA}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B4E7EA30-CAE2-4E1C-8ADB-944E4A0B9CC8}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B62A3F20-6D32-4FFF-8A46-31093CE60849}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B79441C2-5EA2-43C2-9EAD-AE4674DD7A8A}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B894A4E9-9B4D-4E9E-ACED-8185A2A26534}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B96EFF50-4F1E-470B-B23B-06DD9E0C0902}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{B9AE2158-4023-4552-8CE9-A1670DA7949F}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{BBF08C12-E475-40AE-A5A6-4EB4955E4C1D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{BCBDA619-D3BB-4FED-A572-E34375C2BD4B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{C2FCD7B1-F896-46FE-A59B-C4A94CB9CAA3}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{C366E446-51C5-4301-B874-351E9F01EEBA}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{C6688D7E-152A-47D5-BCC5-CABA6053F51C}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{C67734E1-C12C-4A52-9FBE-FF68C9F16520}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{C6DD2957-AB4A-4DAC-87BD-9DA120D8F3B0}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{CA32676F-B7AD-4404-8224-58C438355AF8}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{CD8B27AE-74A1-4E29-801D-E31D95E8FB23}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{CD8F8F85-DD2B-445D-AA38-0C81B5A65CBB}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{D36F9D3D-8B32-4BEF-990C-76FAB65AD0CD}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{D3C986E8-57CA-4BAB-84DB-6BD8E62F0141}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{D6C90AF3-12B9-4FF9-A38A-C4BE169DD76D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{D720F9A6-A877-458C-9365-885A18BF119B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{D7A058F1-1A88-4C54-8E3D-7EF487F2E273}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{DAAAE420-5BB4-4A80-9913-24E7A8748139}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{DC4C502A-F206-4FFE-BD94-808840D7E6A6}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{DEB996E4-DC5C-4ABB-AEFC-6C6F71DB03E3}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{DFC70BAB-2D0E-4B88-A6F0-3926740D112F}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E143B565-CA6D-4D61-A3B5-74B3E94CD3E5}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E22F80FC-2A44-4FF0-BA5C-1BCEF7639FF2}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E36F35DE-3E30-4728-99FF-72DAE158D227}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E3AC35FB-2E7E-49C5-A8C0-151A39591F15}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E642DD14-33F6-4575-BF5C-9BC63990935B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E666F2C5-2016-405C-BA6D-6E2D610A75EC}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E68934F8-9C8B-49E2-A1F4-BF47599D8809}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E781D18B-67A4-44F6-90A4-7F3A8D3DE31D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E8325FC2-3E2B-4259-B90D-D95D3971E927}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E88AE247-C6D0-4F0A-A067-9F2E43B37FD6}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{E98888A4-F875-4676-AB57-E78CE99AD1E0}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{ECF99E33-91A1-45BD-84CB-658BCC8DB421}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{EF6FA1F8-78D6-4893-8A13-076B5A550371}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F0D08DC1-D477-4BF0-BCE6-FDF3D2E83382}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F0D2762D-2CFF-4BB5-9C59-8127BDC218C2}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F113121A-2279-45B9-B9CA-74FD0C851601}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F1F44777-78FA-4E82-879A-AA6DDC71E9F9}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F2577FFE-4C18-40DE-BA6E-DC6A63215552}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F42806B7-1A91-4052-ADEC-0032C001EB0B}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F4E0B6AF-7B76-42BF-85A9-29E667107DB5}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F86FF2E9-BC7F-4F27-A1E7-F648458AEF5D}
Successfully deleted: [Empty Folder] C:\Users\Iris\appdata\local\{F96DB1C6-DF78-45E8-8FA4-0D10E6CA836E}



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.09.2013 at 17:18:47,22
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by Iris (administrator) on IRIS-VAIO on 27-09-2013 17:24:32
Running from C:\Users\Iris\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
() C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Utilities 14\RMTray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\Marketing Tools\MarketingTools.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-16] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-01-15] (Google Inc.)
HKCU\...\Run: [NortonUtilities] - C:\Program Files (x86)\Norton Utilities 14\RMTray.exe [279912 2009-09-14] (Symantec Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876968 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] - C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [NortonOnlineBackup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [972632 2010-03-15] (Symantec Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe [157000 2012-07-25] ()
Startup: C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {5A393B65-86DB-4383-B7E0-11A5F2CF5E14} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU -  No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
DPF: HKLM-x32 {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138
Tcpip\..\Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: [NameServer]10.0.0.138

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Skype Click to Call) - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2792280 2010-03-15] (Symantec Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe [274760 2012-07-25] ()
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
S2 LMIRescue_2573fcbc-dcd7-4e8d-9006-71e6e999152e; "C:\Users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe" -service -sid 2573fcbc-dcd7-4e8d-9006-71e6e999152e [x]

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102472 2010-02-17] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [308296 2010-02-17] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2010-02-17] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2010-02-17] (McAfee, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-11-12] ()
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-08-11] (ZTE)
S3 zte_cdc_ecm; C:\Windows\System32\DRIVERS\zte_cdc_ecm.sys [36864 2011-08-11] (ZTE)
S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [14336 2011-08-11] (ZTE)
S3 zte_ecm_enum; C:\Windows\System32\DRIVERS\zte_ecm_enum.sys [56320 2011-08-11] (ZTE)
S3 zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\zte_ecm_enum_filter.sys [56320 2011-08-11] (ZTE)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [x]
U2 wuaserv;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-27 17:23 - 2013-09-27 17:24 - 01953854 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-27 17:18 - 2013-09-27 17:18 - 00019333 _____ C:\Users\Iris\Desktop\JRT.txt
2013-09-27 17:12 - 2013-09-27 17:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-27 17:11 - 2013-09-27 17:11 - 01030305 _____ (Thisisu) C:\Users\Iris\Desktop\JRT.exe
2013-09-27 17:01 - 2013-09-27 17:02 - 00000000 ____D C:\AdwCleaner
2013-09-27 17:00 - 2013-09-27 17:01 - 01042066 _____ C:\Users\Iris\Desktop\adwcleaner.exe
2013-09-27 16:17 - 2013-09-27 16:17 - 00022063 _____ C:\ComboFix.txt
2013-09-27 15:49 - 2013-09-27 15:50 - 05129766 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-26 16:43 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 16:43 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 16:43 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 16:43 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 16:43 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 16:43 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 16:43 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-26 16:43 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-26 16:43 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 16:43 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-26 16:43 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 16:43 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-26 16:40 - 2013-09-26 16:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 11:38 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 11:38 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-26 11:38 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 11:38 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-26 11:38 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 11:38 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-26 11:38 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 11:38 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-26 11:38 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-26 11:38 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 11:38 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-26 11:38 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-26 11:38 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-26 11:38 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 11:38 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 11:38 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-26 11:38 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-26 11:38 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 11:38 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-09-26 11:38 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 11:38 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-09-26 11:38 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 11:38 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 11:38 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-09-26 11:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-09-26 11:38 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 11:38 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-26 11:01 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-26 11:01 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-26 11:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-26 11:00 - 2013-09-27 16:17 - 00000000 ____D C:\Qoobox
2013-09-26 11:00 - 2013-09-27 16:12 - 00000000 ____D C:\Windows\erdnt
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat

==================== One Month Modified Files and Folders =======

2013-09-27 17:24 - 2013-09-27 17:23 - 01953854 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-27 17:20 - 2010-08-22 13:07 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Skype
2013-09-27 17:19 - 2010-01-15 09:24 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-27 17:18 - 2013-09-27 17:18 - 00019333 _____ C:\Users\Iris\Desktop\JRT.txt
2013-09-27 17:12 - 2013-09-27 17:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-27 17:12 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-27 17:12 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-27 17:11 - 2013-09-27 17:11 - 01030305 _____ (Thisisu) C:\Users\Iris\Desktop\JRT.exe
2013-09-27 17:11 - 2012-03-31 22:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-27 17:08 - 2010-04-02 14:28 - 01175827 _____ C:\Windows\WindowsUpdate.log
2013-09-27 17:04 - 2010-01-15 09:24 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-27 17:03 - 2013-08-13 17:18 - 00008371 _____ C:\Windows\setupact.log
2013-09-27 17:03 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-27 17:02 - 2013-09-27 17:01 - 00000000 ____D C:\AdwCleaner
2013-09-27 17:02 - 2011-06-19 19:05 - 00000993 _____ C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-27 17:02 - 2010-04-02 14:31 - 00001146 _____ C:\Users\Iris\Desktop\Internet Explorer.lnk
2013-09-27 17:01 - 2013-09-27 17:00 - 01042066 _____ C:\Users\Iris\Desktop\adwcleaner.exe
2013-09-27 16:17 - 2013-09-27 16:17 - 00022063 _____ C:\ComboFix.txt
2013-09-27 16:17 - 2013-09-26 11:00 - 00000000 ____D C:\Qoobox
2013-09-27 16:12 - 2013-09-26 11:00 - 00000000 ____D C:\Windows\erdnt
2013-09-27 16:12 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-27 16:08 - 2013-08-13 17:17 - 00503266 _____ C:\Windows\PFRO.log
2013-09-27 16:08 - 2009-07-14 04:34 - 78344192 _____ C:\Windows\system32\config\software.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 20709376 _____ C:\Windows\system32\config\system.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00311296 _____ C:\Windows\system32\config\default.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00061440 _____ C:\Windows\system32\config\sam.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00028672 _____ C:\Windows\system32\config\security.bak
2013-09-27 15:50 - 2013-09-27 15:49 - 05129766 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-27 15:45 - 2010-04-02 14:32 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D1B11C91-16E4-4B70-85ED-51D8A96B0160}
2013-09-26 20:48 - 2011-04-01 05:05 - 00119424 ____H C:\Windows\SysWOW64\mlfcache.dat
2013-09-26 20:40 - 2010-04-02 14:31 - 00000000 ___RD C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-26 20:40 - 2010-04-02 14:31 - 00000000 ___RD C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-26 20:39 - 2009-12-25 22:10 - 00000000 ____D C:\Windows\Panther
2013-09-26 20:39 - 2009-07-14 06:45 - 00368840 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 16:43 - 2013-09-26 16:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 16:40 - 2010-01-15 09:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-26 16:36 - 2010-01-15 18:11 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-09-26 16:36 - 2010-01-15 18:11 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-09-26 16:36 - 2009-07-14 07:13 - 01534236 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-26 11:34 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-26 11:00 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-26 00:05 - 2010-01-15 09:21 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2013-09-25 23:27 - 2010-01-15 09:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-25 00:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-24 23:55 - 2012-03-01 19:58 - 00000000 ____D C:\Program Files (x86)\Norton 360 Premier Edition
2013-09-24 23:55 - 2010-06-20 15:53 - 00000000 ____D C:\ProgramData\Norton
2013-09-24 11:50 - 2012-03-01 19:36 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2013-09-24 11:48 - 2012-03-01 19:36 - 00001300 _____ C:\Users\Iris\Desktop\Norton-Installationsdateien.lnk
2013-09-24 00:11 - 2012-03-31 22:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-24 00:11 - 2012-03-31 22:12 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-24 00:11 - 2011-06-04 19:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-16 00:53 - 2010-12-10 03:55 - 00009968 _____ C:\Users\Iris\Documents\Filme.xlsx
2013-09-14 23:15 - 2013-08-04 20:16 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Lyax
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat
2013-09-13 01:26 - 2010-12-25 22:02 - 00000207 _____ C:\Windows\system32\sstates.sdt
2013-09-13 01:26 - 2010-12-25 22:02 - 00000040 _____ C:\Windows\system32\sstate_prev.sdt
2013-09-08 01:40 - 2011-06-08 00:23 - 00000000 ____D C:\Users\Iris\AppData\Local\CrashDumps
2013-09-05 23:45 - 2012-07-01 10:04 - 00000000 ____D C:\Users\Iris\AppData\Local\Windows Live
2013-09-01 17:08 - 2010-04-13 14:22 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Iris\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-21 15:01

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Bootsektor 27.09.2013 20:57
Hallo Akki18,
sehr gut :daumenhoc, das sieht schon wieder fast gut aus.

Schritt 1
Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
DPF: HKLM-x32 {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

Schritt 2
Downloade dir bitte Farbar's Service Scanner
  • Starte das Tool mit Doppelklick auf die FSS.exe
  • Gehe sicher, dass folgende Optionen angehakt sind.
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Klicke auf Scan.
  • Wenn das Tool fertig ist, wird es eine FSS.txt in dem Verzeichnis erstellen, wo das Tool gelaufen ist.
Poste bitte den Inhalt hier.


Schritt 3
Starte noch einmal FRST.
  • Setze den Haken bei addition.txt und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und addition.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieser Logfiles bitte hier in deinen Thread.

Akki18 28.09.2013 00:05
Hi Bootsektor,
hier wieder die angeforderten Logfiles.

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013
Ran by Iris at 2013-09-28 00:59:32 Run:2
Running from C:\Users\Iris\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
DPF: HKLM-x32 {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei-4/WebfettiInitialSetup1.0.1.1.cab
Winsock: Catalog5 01 %SystemRoot%\System32\mswsock.dll [232448] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [326144] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
       
*****************

HKLM\SOFTWARE\Wow6432Node\Microsoft\Code Store Database\Distribution Units\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} => Key not found.
Winsock: Catalog5 entry 000000000001\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll
Winsock: Catalog5-x64 entry 000000000001\\LibraryPath  was set successfully to %SystemRoot%\system32\NLAapi.dll

==== End of Fixlog ====
Code:
Farbar Service Scanner Version: 13-09-2013
Ran by Iris (administrator) on 28-09-2013 at 01:02:03
Running from "C:\Users\Iris\Desktop"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****
Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-09-2013
Ran by Iris at 2013-09-28 01:03:47
Running from C:\Users\Iris\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (x32)
Adobe AIR (x32 Version: 3.4.0.2710)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.175)
Adobe Reader X (10.1.8) - Deutsch (x32 Version: 10.1.8)
Alps Pointing-device for VAIO
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
ArcSoft Magic-i Visual Effects 2 (x32 Version: 2.0.1.85)
ArcSoft WebCam Companion 3 (x32 Version: 3.0.21.193)
ATI Catalyst Install Manager (Version: 3.0.769.0)
Bonjour (Version: 3.0.0.10)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center Graphics Full New (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center Graphics Light (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center InstallProxy (x32 Version: 2009.1215.1727.31294)
Catalyst Control Center InstallProxy (x32 Version: 2010.0920.2143.37117)
Catalyst Control Center Localization All (x32 Version: 2010.0920.2143.37117)
CCC Help Chinese Standard (x32 Version: 2010.0920.2142.37117)
CCC Help Chinese Traditional (x32 Version: 2010.0920.2142.37117)
CCC Help Turkish (x32 Version: 2010.0920.2142.37117)
ccc-utility64 (Version: 2010.0920.2143.37117)
Click to Disc MergeModules x64 (Version: 1.0.14230)
Compatibility Pack für 2007 Office System (x32 Version: 12.0.6612.1000)
D3DX10 (x32 Version: 15.4.2368.0902)
Die Sims™ 2 Deluxe (x32)
Easy PDF Reader 1.0 (x32 Version: 1.0)
EasyBits GO (HKCU)
Einstellungen für VAIO-Inhaltsüberwachung (x32 Version: 2.6.0.13120)
Free YouTube to MP3 Converter version 3.10.815 (x32)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752)
iCloud (Version: 2.1.2.8)
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Rapid Storage Technology (x32 Version: 9.5.4.1001)
Intel(R) Turbo Boost Technology Driver (x32 Version: 01.00.01.1002)
iTunes (Version: 11.0.4.4)
Java Auto Updater (x32 Version: 2.0.2.1)
Java(TM) 6 Update 20 (x32 Version: 6.0.200)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
Media Gallery (x32 Version: 1.1.1.11200)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (German) (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Suite Activation Assistant (x32 Version: 2.9)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server Compact 3.5 SP1 English (x32 Version: 3.5.5692.0)
Microsoft SQL Server Compact 3.5 SP1 x64 English (Version: 3.5.5692.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (x32 Version: 9.7.0621)
Mobile Connect (x32 Version: 1.00.0000)
MobileMe Control Panel (Version: 3.1.8.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MusicStation (x32 Version: 2.0.0.1067)
myphotobook.at (x32 Version: 1.4.10)
Norton Online Backup (x32 Version: 2.0.13939)
Norton Utilities (x32 Version: 14.5)
Orange Mobiles Internet (x32 Version: 1.0.0.1)
PMB VAIO Edition plug-in (Click to Disc) (x32 Version: 3.2.00.16060)
PMB VAIO Edition plug-in (VAIO Image Optimizer) (x32 Version: 1.2.00.15250)
PMB VAIO Edition plug-in (VAIO Movie Story) (x32 Version: 2.2.00.15250)
Quick Web Access (x32 Version: 1.4.7.0)
QuickTime (x32 Version: 7.74.80.86)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5992)
Setting Utility Series (x32 Version: 5.1.0.11200)
Setup_msm_VCMS_x64 (Version: 2.6.0.06040)
Setup_msm_VOFS_x64 (Version: 2.4.0.16010)
Setup_VEP_x64_Contain_SSDB (Version: 3.9.30.19080)
Skype Click to Call (x32 Version: 6.4.11328)
Skype™ 6.6 (x32 Version: 6.6.106)
SOHLib Merge Module (x32 Version: 2.2.0.11240)
Sony Home Network Library (x32 Version: 2.0.1.10160)
Sony Home Network Library (x32 Version: 2.2.0.13270)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VAIO - PMB VAIO Edition Guide (x32 Version: 1.5.00.03020)
VAIO Care (x32 Version: 6.4.2.11150)
VAIO Content Metadata Intelligent Analyzing Manager (Version: 3.9.20.08110)
VAIO Content Metadata Intelligent Analyzing Manager (x32 Version: 3.6.0.09250)
VAIO Content Metadata Intelligent Network Service Manager (Version: 3.9.20.08110)
VAIO Content Metadata Manager Settings (Version: 3.9.20.08110)
VAIO Content Metadata XML Interface Library (Version: 3.9.20.08110)
VAIO Control Center (x32 Version: 4.1.1.07160)
VAIO Data Restore Tool (x32 Version: 1.2.0.09150)
VAIO DVD Menu Data (x32 Version: 2.1.00.15050)
VAIO Energie Verwaltung (x32 Version: 5.0.0.11300)
VAIO Entertainment Platform (x32 Version: 3.9.30.19080)
VAIO Event Service (x32 Version: 5.1.0.12010)
VAIO Gate (x32 Version: 2.4.0.06210)
VAIO Gate Default (x32 Version: 1.0.0.10290)
VAIO Hardware Diagnostics (x32 Version: 3.9.1)
VAIO Marketing Tools (x32)
VAIO Media plus (x32 Version: 2.0.1.10160)
VAIO Media plus Opening Movie (x32 Version: 1.2.0.09100)
VAIO Movie Story MergeModules x64 (Version: 1.0.14240)
VAIO Movie Story Template Data (x32 Version: 2.0.00.09240)
VAIO Original Funktion Einstellungen (x32 Version: 2.4.0.19040)
VAIO Personalization Manager (Version: 3.0.2.05260)
VAIO Premium Partners (x32 Version: 1.0)
VAIO screensaver (x32 Version: 1.0.0.0)
VAIO Smart Network (x32 Version: 3.3.1.08110)
VAIO Update (x32 Version: 6.1.1.10250)
VAIO Wallpaper Contents (x32 Version: 2.0.0.06010)
VAIO-Support für Übertragungen (x32 Version: 1.1.2.06030)
VU5x64 (Version: 1.1.0)
VU5x86 (x32 Version: 1.0.0)
VU5x86 (x32 Version: 1.1.0)
WebM Media Foundation Components (x32 Version: 1.0.0.0)
WIDCOMM Bluetooth Software (Version: 6.2.1.500)
Windows Driver Package - Broadcom Bluetooth  (09/09/2009 6.2.0.9405) (Version: 09/09/2009 6.2.0.9405)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live Sync (x32 Version: 14.0.8117.416)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

13-08-2013 15:24:09 Windows Update
17-08-2013 17:33:36 Installiert Orange Mobiles Internet
29-08-2013 16:22:21 Geplanter Prüfpunkt
16-09-2013 21:19:22 Geplanter Prüfpunkt
25-09-2013 21:14:07 Removed 7-Zip 9.21
25-09-2013 21:25:27 Removed Google Earth Plug-in.
25-09-2013 21:28:14 Removed Java(TM) 6 Update 20
25-09-2013 22:02:58 Removed Safari
26-09-2013 09:31:08 Windows Update
26-09-2013 14:29:41 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-09-27 16:12 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1      localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0D7DCF11-23EC-4892-AA18-71BA59EE08BC} - System32\Tasks\Sony Corporation\VAIO Care\VAIO Care => C:\Program Files\Sony\VAIO Care\VCsystray.exe [2011-02-16] (Sony Corporation)
Task: {0F48E6AE-6012-49C7-8E25-8BEE88963E8F} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {14BFC5DE-7773-4B9A-8999-2067390C03FD} - System32\Tasks\Microsoft\Windows\Windows Activation Technologies\ValidationTask => C:\Windows\system32\Wat\WatAdminSvc.exe [2010-06-28] (Microsoft Corporation)
Task: {1A3EC1F6-CA56-4A7E-9D0D-F74DBF4F8AB5} - System32\Tasks\SONY\VAIO Power Management\VPM Session Change => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {1B332E5E-F4A0-4249-987F-BD4315D2F540} - \Dealply No Task File
Task: {25371F45-30A2-4A3F-AA61-DB5F25CCA2F3} - System32\Tasks\User_Feed_Synchronization-{D1B11C91-16E4-4B70-85ED-51D8A96B0160} => C:\Windows\system32\msfeedssync.exe [2013-05-25] (Microsoft Corporation)
Task: {4AF3B760-26D9-4F7F-84B3-4E5FC8D97FD5} - System32\Tasks\SONY\VAIO Gate\VAIO Gate Restart => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-06-21] (Sony Corporation)
Task: {5ECF3E13-3954-406C-9977-27971DBC4664} - System32\Tasks\SONY\VAIO Power Management\VPM Unlock => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {61FE04E7-6B4C-41D6-8897-14E534AC62E3} - System32\Tasks\{88C7F537-A95D-419D-9E2C-24DA55770449} => C:\Program Files (x86)\iTunes\iTunes.exe [2013-05-31] (Apple Inc.)
Task: {62D4A441-C9BC-4FC9-8DE9-25091E6D1999} - System32\Tasks\SONY\SUS-BCF\Level4Daily => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {679C1BFF-E4E8-4725-83A0-824F72BA2A74} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {7818EC3B-E31C-4817-AACC-B8456A11AB41} - System32\Tasks\Sony Corporation\VAIO Care\VCOneClick => C:\Program Files\Sony\VAIO Care\VCOneClick.exe [2011-02-16] (Sony Corporation)
Task: {808E70AB-BDA6-449E-9ADF-4BCAA3D5947E} - System32\Tasks\Sony Corporation\VAIO Gate\VAIO Gate => C:\Program Files\Sony\VAIO Gate\VAIO Gate.exe [2011-06-21] (Sony Corporation)
Task: {8238B025-63CA-4B78-8996-18754229AEEE} - System32\Tasks\SONY\SUS-BCF\Level4Month => C:\Program Files (x86)\Sony\Setting Utility Series\WBCBatteryCare.exe [2009-11-20] (Sony Corporation)
Task: {90C2F4FA-C825-4152-8F17-353269389837} - System32\Tasks\{4222CE9D-D353-49B0-9299-3FF3950FA0C0} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-06-21] (Skype Technologies S.A.)
Task: {9D1CD8ED-B6E9-42AA-9C45-2001D7467094} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-15] (Google Inc.)
Task: {9EF3E76A-8F6F-460C-96E5-C6B2AC3D9505} - System32\Tasks\Sony Corporation\VAIO Gate\StartExecuteProxy => C:\Program Files\Sony\VAIO Gate\ExecutionProxy.exe [2011-06-21] (Sony Corporation)
Task: {A0DEC7B6-076F-45BC-AA3A-149E6FE07C1A} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-09-24] (Adobe Systems Incorporated)
Task: {A482198B-A7AB-44BC-8C6B-203C5F244161} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update Self Repair => C:\Program Files\Sony\VAIO Update\VUSR.exe [2012-10-26] (Sony Corporation)
Task: {AA7BE4D9-0814-487F-A79D-11FB55CDC068} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-01-15] (Google Inc.)
Task: {B319546C-C6BB-4045-B4AA-503B74AC7C68} - System32\Tasks\SONY\VAIO Power Management\VPM Logon Start => C:\Program Files\Sony\VAIO Power Management\SPMgr.exe [2009-11-30] (Sony Corporation)
Task: {BF6F4A11-4EAC-4827-A331-BE46674118EA} - System32\Tasks\Sony Corporation\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe [2012-10-26] (Sony Corporation)
Task: {DCDA5C12-2507-4B2B-B7D6-82AD918AB82F} - System32\Tasks\User_Feed_Synchronization-{0E626F3C-8A24-4FFB-84FD-07195C3D7244} => C:\Windows\system32\msfeedssync.exe [2013-05-25] (Microsoft Corporation)
Task: {FF84841B-5F7F-4496-A443-9506C5C4A28B} - System32\Tasks\{65B22495-A991-4EF5-B418-5A59B7B53CF0} => C:\Program Files (x86)\iTunes\iTunes.exe [2013-05-31] (Apple Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-04-05 12:58 - 2013-04-05 12:58 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2010-01-15 10:00 - 2009-12-01 23:03 - 00010752 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESBasePS.dll
2010-01-15 10:00 - 2009-12-01 23:03 - 00009728 _____ () C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSubPS.dll
2009-12-25 23:59 - 2009-11-21 01:19 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:D287FACF

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MpfService => ""="Service"

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (09/28/2013 01:01:14 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 01:01:02 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 01:01:01 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 01:00:57 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 01:00:56 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 00:55:47 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 00:55:46 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 00:55:46 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 00:55:43 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.

Error: (09/28/2013 00:55:39 AM) (Source: Schannel) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung generiert: 70. Der interne Fehlerstatus lautet: 105.


Microsoft Office Sessions:
=========================
Error: (03/11/2013 05:20:46 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1057 seconds with 60 seconds of active time.  This session ended with a crash.

Error: (03/29/2011 07:29:12 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 10 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (01/13/2011 01:11:15 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2013-09-27 16:06:45.290
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-27 16:06:45.087
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-27 16:06:44.884
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-27 16:06:44.681
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-26 11:11:01.556
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2013-09-26 11:11:01.400
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume3\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info ===========================

Percentage of memory in use: 40%
Total physical RAM: 3950.1 MB
Available physical RAM: 2333.23 MB
Total Pagefile: 7898.38 MB
Available Pagefile: 6042.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:455.13 GB) (Free:256.1 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 164B6E36)
Partition 1: (Not Active) - (Size=11 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=455 GB) - (Type=07 NTFS)

==================== End Of Log ============================

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by Iris (administrator) on IRIS-VAIO on 28-09-2013 01:03:15
Running from C:\Users\Iris\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
() C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Utilities 14\RMTray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\Marketing Tools\MarketingTools.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-16] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-01-15] (Google Inc.)
HKCU\...\Run: [NortonUtilities] - C:\Program Files (x86)\Norton Utilities 14\RMTray.exe [279912 2009-09-14] (Symantec Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876968 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] - C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [NortonOnlineBackup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [972632 2010-03-15] (Symantec Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe [157000 2012-07-25] ()
Startup: C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {5A393B65-86DB-4383-B7E0-11A5F2CF5E14} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU -  No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138
Tcpip\..\Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: [NameServer]10.0.0.138

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Skype Click to Call) - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2792280 2010-03-15] (Symantec Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe [274760 2012-07-25] ()
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
S2 LMIRescue_2573fcbc-dcd7-4e8d-9006-71e6e999152e; "C:\Users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe" -service -sid 2573fcbc-dcd7-4e8d-9006-71e6e999152e [x]

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102472 2010-02-17] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [308296 2010-02-17] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2010-02-17] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2010-02-17] (McAfee, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-11-12] ()
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-08-11] (ZTE)
S3 zte_cdc_ecm; C:\Windows\System32\DRIVERS\zte_cdc_ecm.sys [36864 2011-08-11] (ZTE)
S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [14336 2011-08-11] (ZTE)
S3 zte_ecm_enum; C:\Windows\System32\DRIVERS\zte_ecm_enum.sys [56320 2011-08-11] (ZTE)
S3 zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\zte_ecm_enum_filter.sys [56320 2011-08-11] (ZTE)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [x]
U2 wuaserv;

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-28 01:02 - 2013-09-28 01:02 - 00002080 _____ C:\Users\Iris\Desktop\FSS.txt
2013-09-28 01:01 - 2013-09-28 01:01 - 00358923 _____ (Farbar) C:\Users\Iris\Desktop\FSS.exe
2013-09-27 17:23 - 2013-09-27 17:24 - 01953854 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-27 17:12 - 2013-09-27 17:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-27 17:11 - 2013-09-27 17:11 - 01030305 _____ (Thisisu) C:\Users\Iris\Desktop\JRT.exe
2013-09-27 17:01 - 2013-09-27 17:02 - 00000000 ____D C:\AdwCleaner
2013-09-27 17:00 - 2013-09-27 17:01 - 01042066 _____ C:\Users\Iris\Desktop\adwcleaner.exe
2013-09-27 16:17 - 2013-09-27 16:17 - 00022063 _____ C:\ComboFix.txt
2013-09-27 15:49 - 2013-09-27 15:50 - 05129766 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-26 16:43 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 16:43 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 16:43 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 16:43 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 16:43 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 16:43 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 16:43 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-26 16:43 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-26 16:43 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 16:43 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-26 16:43 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 16:43 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-26 16:40 - 2013-09-26 16:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 11:38 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 11:38 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-26 11:38 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 11:38 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-26 11:38 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 11:38 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-26 11:38 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 11:38 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-26 11:38 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-26 11:38 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 11:38 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-26 11:38 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-26 11:38 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-26 11:38 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 11:38 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 11:38 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-26 11:38 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-26 11:38 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 11:38 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-09-26 11:38 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 11:38 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-09-26 11:38 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 11:38 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 11:38 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-09-26 11:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-09-26 11:38 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 11:38 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-26 11:01 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-26 11:01 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-26 11:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-26 11:00 - 2013-09-27 16:17 - 00000000 ____D C:\Qoobox
2013-09-26 11:00 - 2013-09-27 16:12 - 00000000 ____D C:\Windows\erdnt
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat

==================== One Month Modified Files and Folders =======

2013-09-28 01:02 - 2013-09-28 01:02 - 00002080 _____ C:\Users\Iris\Desktop\FSS.txt
2013-09-28 01:01 - 2013-09-28 01:01 - 00358923 _____ (Farbar) C:\Users\Iris\Desktop\FSS.exe
2013-09-28 00:58 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-28 00:58 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-28 00:54 - 2010-04-02 14:28 - 01184462 _____ C:\Windows\WindowsUpdate.log
2013-09-28 00:51 - 2010-08-22 13:07 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Skype
2013-09-28 00:50 - 2010-01-15 09:24 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-28 00:49 - 2013-08-13 17:18 - 00008427 _____ C:\Windows\setupact.log
2013-09-28 00:49 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-27 17:24 - 2013-09-27 17:23 - 01953854 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-27 17:19 - 2010-01-15 09:24 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-27 17:12 - 2013-09-27 17:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-27 17:11 - 2013-09-27 17:11 - 01030305 _____ (Thisisu) C:\Users\Iris\Desktop\JRT.exe
2013-09-27 17:11 - 2012-03-31 22:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-27 17:02 - 2013-09-27 17:01 - 00000000 ____D C:\AdwCleaner
2013-09-27 17:02 - 2011-06-19 19:05 - 00000993 _____ C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-27 17:02 - 2010-04-02 14:31 - 00001146 _____ C:\Users\Iris\Desktop\Internet Explorer.lnk
2013-09-27 17:01 - 2013-09-27 17:00 - 01042066 _____ C:\Users\Iris\Desktop\adwcleaner.exe
2013-09-27 16:17 - 2013-09-27 16:17 - 00022063 _____ C:\ComboFix.txt
2013-09-27 16:17 - 2013-09-26 11:00 - 00000000 ____D C:\Qoobox
2013-09-27 16:12 - 2013-09-26 11:00 - 00000000 ____D C:\Windows\erdnt
2013-09-27 16:12 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-27 16:08 - 2013-08-13 17:17 - 00503266 _____ C:\Windows\PFRO.log
2013-09-27 16:08 - 2009-07-14 04:34 - 78344192 _____ C:\Windows\system32\config\software.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 20709376 _____ C:\Windows\system32\config\system.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00311296 _____ C:\Windows\system32\config\default.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00061440 _____ C:\Windows\system32\config\sam.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00028672 _____ C:\Windows\system32\config\security.bak
2013-09-27 15:50 - 2013-09-27 15:49 - 05129766 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-27 15:45 - 2010-04-02 14:32 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D1B11C91-16E4-4B70-85ED-51D8A96B0160}
2013-09-26 20:48 - 2011-04-01 05:05 - 00119424 ____H C:\Windows\SysWOW64\mlfcache.dat
2013-09-26 20:40 - 2010-04-02 14:31 - 00000000 ___RD C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-26 20:40 - 2010-04-02 14:31 - 00000000 ___RD C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-26 20:39 - 2009-12-25 22:10 - 00000000 ____D C:\Windows\Panther
2013-09-26 20:39 - 2009-07-14 06:45 - 00368840 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 16:43 - 2013-09-26 16:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 16:40 - 2010-01-15 09:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-26 16:36 - 2010-01-15 18:11 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-09-26 16:36 - 2010-01-15 18:11 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-09-26 16:36 - 2009-07-14 07:13 - 01534236 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-26 11:34 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-26 11:00 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-26 00:05 - 2010-01-15 09:21 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2013-09-25 23:27 - 2010-01-15 09:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-25 00:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-24 23:55 - 2012-03-01 19:58 - 00000000 ____D C:\Program Files (x86)\Norton 360 Premier Edition
2013-09-24 23:55 - 2010-06-20 15:53 - 00000000 ____D C:\ProgramData\Norton
2013-09-24 11:50 - 2012-03-01 19:36 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2013-09-24 11:48 - 2012-03-01 19:36 - 00001300 _____ C:\Users\Iris\Desktop\Norton-Installationsdateien.lnk
2013-09-24 00:11 - 2012-03-31 22:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-24 00:11 - 2012-03-31 22:12 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-24 00:11 - 2011-06-04 19:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-16 00:53 - 2010-12-10 03:55 - 00009968 _____ C:\Users\Iris\Documents\Filme.xlsx
2013-09-14 23:15 - 2013-08-04 20:16 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Lyax
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat
2013-09-13 01:26 - 2010-12-25 22:02 - 00000207 _____ C:\Windows\system32\sstates.sdt
2013-09-13 01:26 - 2010-12-25 22:02 - 00000040 _____ C:\Windows\system32\sstate_prev.sdt
2013-09-08 01:40 - 2011-06-08 00:23 - 00000000 ____D C:\Users\Iris\AppData\Local\CrashDumps
2013-09-05 23:45 - 2012-07-01 10:04 - 00000000 ____D C:\Users\Iris\AppData\Local\Windows Live
2013-09-01 17:08 - 2010-04-13 14:22 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Iris\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-21 15:01

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Bootsektor 28.09.2013 20:59
Hallo Akki18,
das sieht sehr gut aus. Jetzt noch ein paar Reste fixen und dann Kontrollscans.

Schritt 1
Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
U2 wuaserv;
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt 3
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern :kaffee:

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 4
Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Akki18 29.09.2013 09:00
Hi Bootsektor,
hier einmal die erste angeforderte Logfile.

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013
Ran by Iris at 2013-09-28 22:40:33 Run:3
Running from C:\Users\Iris\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
U2 wuaserv;
       
*****************

HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs => Value deleted successfully.
wuaserv => Service deleted successfully.

==== End of Fixlog ====
Nummer 2 hat keinen Treffer gelandet:

Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.09.28.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16686
Iris :: IRIS-VAIO [Administrator]

Schutz: Aktiviert

28.09.2013 22:44:25
mbam-log-2013-09-28 (22-44-25).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 217260
Laufzeit: 5 Minute(n), 52 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=7fddba0a2364ed44a69f32633442763c
# engine=15293
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-29 07:27:23
# local_time=2013-09-29 09:27:23 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 144168 132069493 0 0
# scanned=243815
# found=38
# cleaned=0
# scan_time=37863
sh=15E235705B82EA010B243E19AA5D1C5ED0C7C507 ft=1 fh=020ba2eaae91d7a8 vn="a variant of Win32/Kryptik.BKXK trojan" ac=I fn="C:\FRST\Quarantine\XUSRRQSdG\E7ZTh0coB.dll"
sh=B0BE591B5FF70D5E6A5AC19148C1894504BBB8D6 ft=1 fh=020ba2ea181a0f54 vn="a variant of Win32/Kryptik.BKXK trojan" ac=I fn="C:\FRST\Quarantine\XUSRRQSdG\E7ZTh0coB.exe"
sh=588109669EEAA082627928DC02CBA622DD2C3ED4 ft=0 fh=0000000000000000 vn="HTML/Ransom.B trojan" ac=I fn="C:\ProgramData\qpcvedwwrgnkyzo\main.html"
sh=2CCE302AC64C06BA0BB798F3AA6A500050203CC7 ft=1 fh=83087ebc966da3f9 vn="a variant of Win32/Kryptik.BJCM trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\GoogleUpdate.exe.vir"
sh=46C1319EE38510C365A4226621DE30BDF7E462FF ft=1 fh=662930a683ab766b vn="Win64/Conedex.C trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@.vir"
sh=A065922E48E274F827BC8A04091A44632D498373 ft=1 fh=f3684398a5f5cf1b vn="Win64/Conedex.I trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@.vir"
sh=810E28D4E7B28D658DC48A82F0C65B46149AAE89 ft=1 fh=120d32a29875bbd8 vn="Win64/Conedex.B trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@.vir"
sh=061A3739739904F13A5B9ADCBF4AC2E8A3157B18 ft=1 fh=3f70b78fb0084ee4 vn="Win64/Sirefef.AW trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@.vir"
sh=5990725A42AD64216F1972D4B63329153BCB67A6 ft=1 fh=bfba3bf48881cf05 vn="Win32/Sirefef.FV trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@.vir"
sh=41B04AF4D42E5B2335FE0F3B44726E8EB8811663 ft=1 fh=99da0fa2872471ab vn="Win64/Sirefef.AY trojan" ac=I fn="C:\Qoobox\Quarantine\C\Program Files (x86)\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\9519~1\A535~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@.vir"
sh=6F684FD1C80E1693B2B294AFD48CF4D5485D2C44 ft=0 fh=0000000000000000 vn="JS/Agent.NID trojan" ac=I fn="C:\Qoobox\Quarantine\C\ProgramData\8692036.js.vir"
sh=2CCE302AC64C06BA0BB798F3AA6A500050203CC7 ft=1 fh=83087ebc966da3f9 vn="a variant of Win32/Kryptik.BJCM trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\GoogleUpdate.exe.vir"
sh=46C1319EE38510C365A4226621DE30BDF7E462FF ft=1 fh=662930a683ab766b vn="Win64/Conedex.C trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000004.@.vir"
sh=A065922E48E274F827BC8A04091A44632D498373 ft=1 fh=f3684398a5f5cf1b vn="Win64/Conedex.I trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\00000008.@.vir"
sh=810E28D4E7B28D658DC48A82F0C65B46149AAE89 ft=1 fh=120d32a29875bbd8 vn="Win64/Conedex.B trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\000000cb.@.vir"
sh=5D413FFF6607C7FF153C8B089977347417E1E088 ft=1 fh=0112fb9bc29fd834 vn="a variant of Win64/Sirefef.AW trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000000.@.vir"
sh=9A7235464EF4BB502B9BAF16C086048A17CAE81D ft=1 fh=62f2664392d1062d vn="probably a variant of Win32/Sirefef.FV trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000032.@.vir"
sh=D287D2C02A83CA181B73D29CCAE6E540B51106AB ft=1 fh=ec9b7c3f30d836dd vn="a variant of Win64/Sirefef.AZ trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Local\Google\Desktop\Install\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\2E2F~1\28F0~1\E628~1\{f0e42b80-285c-1dac-54c5-ac5607bfcd51}\U\80000064.@.vir"
sh=A68967FDDF5BCE31F1EC0713D64E5A46B04D781F ft=1 fh=ffbe822e3160f8e8 vn="Win32/Spy.Zbot.AAO trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\Iris\AppData\Roaming\Ezuf\lado.exe.vir"
sh=588109669EEAA082627928DC02CBA622DD2C3ED4 ft=0 fh=0000000000000000 vn="HTML/Ransom.B trojan" ac=I fn="C:\Users\All Users\qpcvedwwrgnkyzo\main.html"
sh=0B05EF00BA7CEEADEDF617E5A72A7CACAF08FE1A ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\2f84494a-2f3098fb"
sh=591FF427C836067615AAA8532CA999B9D389D960 ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\10\7c88068a-2873ce00"
sh=49C1BEE804C24609B3DA5CA31D500FEF0AAEF94C ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\12\788b50c-355a1704"
sh=591FF427C836067615AAA8532CA999B9D389D960 ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\15\51660c8f-71c67b34"
sh=5BC8FC902AC06B2E27A1D8DF625411682D31E7EF ft=0 fh=0000000000000000 vn="probably a variant of Java/Agent.BR trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\2\8ec9882-5b9a09ee"
sh=B0BE591B5FF70D5E6A5AC19148C1894504BBB8D6 ft=1 fh=020ba2ea181a0f54 vn="a variant of Win32/Kryptik.BKXK trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\29\69f01edd-52bd59a5"
sh=3745AD46E191139864CB461D3265F004BBC4E854 ft=1 fh=5aea159884fb48d6 vn="a variant of Win32/Kryptik.BHYD trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\3\3963d543-126657be"
sh=F4EB611376FA14014E4DF34F4B8ADF5EAD4BF27B ft=0 fh=0000000000000000 vn="probably a variant of Java/Agent.BR trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\2c7c219e-21c2b65e"
sh=591FF427C836067615AAA8532CA999B9D389D960 ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\31\2f31845f-6bfc425f"
sh=D4C0704C8CECDEA5949146228F1D37D2A2938449 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.PFT trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\38\1c7ac7e6-1723bb37"
sh=B070BD6C29D50C1ED6EB9DDBA90D3D2D733AFB99 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.NRB trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\41\cb37ca9-768e0abb"
sh=618BAE93F06718D5CC115FB464136B184F50C910 ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\38e63bec-7fa4cbf7"
sh=618BAE93F06718D5CC115FB464136B184F50C910 ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\d81016d-1a2979df"
sh=F0423823531BA4F320BF39A0BB3DD6D75158159A ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.NJV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\48\c4dd030-5c26dadd"
sh=8265730B8AD1C3C2080D4D75C1B91BA6D8DEB37B ft=0 fh=0000000000000000 vn="a variant of Java/Agent.AF trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\5\23b920c5-1da6a924"
sh=AE295385D4F268E7FFDC7FA0845F23C512DD76EB ft=0 fh=0000000000000000 vn="a variant of Java/Agent.BR trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\54\677e1f36-4ac02985"
sh=0B05EF00BA7CEEADEDF617E5A72A7CACAF08FE1A ft=0 fh=0000000000000000 vn="Java/Agent.BV trojan" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\5ad4b738-591f4106"
sh=FCED2B0D0B9B68676F0C48685B0EF6884C241206 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Iris\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\8\14523508-3dee0b13"

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-09-2013
Ran by Iris (administrator) on IRIS-VAIO on 29-09-2013 09:59:28
Running from C:\Users\Iris\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
() C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files (x86)\SONY\VAIO Event Service\VESMgrSub.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Utilities 14\RMTray.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Sony Corporation) C:\Program Files (x86)\SONY\ISB Utility\ISBMgr.exe
(Sony Corporation) C:\Program Files (x86)\SONY\Marketing Tools\MarketingTools.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update\VUAgent.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCPerfService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCAgent.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\Admload.exe
(Sony of America Corporation) C:\Program Files\Sony\VAIO Care\listener.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9636896 2009-12-16] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [208384 2009-11-04] (Alps Electric Co., Ltd.)
HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-01-15] (Google Inc.)
HKCU\...\Run: [NortonUtilities] - C:\Program Files (x86)\Norton Utilities 14\RMTray.exe [279912 2009-09-14] (Symantec Corporation)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19876968 2013-06-21] (Skype Technologies S.A.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284696 2009-11-21] (Intel Corporation)
HKLM-x32\...\Run: [ISBMgr.exe] - C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe [320880 2009-08-26] (Sony Corporation)
HKLM-x32\...\Run: [MarketingTools] - C:\Program Files (x86)\Sony\Marketing Tools\MarketingTools.exe [26624 2010-01-15] (Sony Corporation)
HKLM-x32\...\Run: [NortonOnlineBackup] - C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [972632 2010-03-15] (Symantec Corporation)
HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [59240 2011-09-27] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKLM-x32\...\Run: [UIExec] - C:\Program Files (x86)\Orange Mobiles Internet\UIExec.exe [157000 2012-07-25] ()
Startup: C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKCU - {5A393B65-86DB-4383-B7E0-11A5F2CF5E14} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU -  No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab
DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: HKLM-x32 {8100D56A-5661-482C-BEE8-AFECE305D968} hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} hxxp://images3.pnimedia.com/ProductAssets/costcous/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab
DPF: HKLM-x32 {C345E174-3E87-4F41-A01C-B066A90A49B4} hxxp://trial.trymicrosoftoffice.com/trialoaa/buymsoffice_assets/framework/microsoft/wrc32.ocx
DPF: HKLM-x32 {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 10.0.0.138
Tcpip\..\Interfaces\{EB67E911-867D-4C13-AE00-E3C7ECA0A89B}: [NameServer]10.0.0.138

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (Skype Click to Call) - C:\Users\Iris\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

==================== Services (Whitelisted) =================

S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2792280 2010-03-15] (Symantec Corporation)
R2 SampleCollector; C:\Program Files\Sony\VAIO Care\VCPerfService.exe [259192 2011-01-29] (Sony Corporation)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
R2 UI Assistant Service; C:\Program Files (x86)\Orange Mobiles Internet\AssistantServices.exe [274760 2012-07-25] ()
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [74496 2010-09-27] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [887000 2011-01-20] (Sony Corporation)
R3 VUAgent; C:\Program Files\Sony\VAIO Update\VUAgent.exe [1286784 2012-10-26] (Sony Corporation)
S2 LMIRescue_2573fcbc-dcd7-4e8d-9006-71e6e999152e; "C:\Users\Iris\AppData\Local\Temp\LMID115.tmp\LMI_Rescue_srv.exe" -service -sid 2573fcbc-dcd7-4e8d-9006-71e6e999152e [x]

==================== Drivers (Whitelisted) ====================

R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [102472 2010-02-17] (McAfee, Inc.)
R1 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [308296 2010-02-17] (McAfee, Inc.)
S3 mferkdk; C:\Windows\System32\drivers\mferkdk.sys [40904 2010-02-17] (McAfee, Inc.)
S3 mfesmfk; C:\Windows\System32\drivers\mfesmfk.sys [49480 2010-02-17] (McAfee, Inc.)
R3 yukonw7; C:\Windows\System32\DRIVERS\yk62x64.sys [395264 2009-11-12] ()
S3 zte_cdc_acm; C:\Windows\System32\DRIVERS\zte_cdc_acm.sys [79872 2011-08-11] (ZTE)
S3 zte_cdc_ecm; C:\Windows\System32\DRIVERS\zte_cdc_ecm.sys [36864 2011-08-11] (ZTE)
S3 zte_cpo; C:\Windows\System32\DRIVERS\zte_cpo.sys [14336 2011-08-11] (ZTE)
S3 zte_ecm_enum; C:\Windows\System32\DRIVERS\zte_ecm_enum.sys [56320 2011-08-11] (ZTE)
S3 zte_ecm_enum_filter; C:\Windows\System32\DRIVERS\zte_ecm_enum_filter.sys [56320 2011-08-11] (ZTE)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 RTHDMIAzAudService; system32\drivers\RtHDMIVX.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-09-28 22:54 - 2013-09-28 22:54 - 02347384 _____ (ESET) C:\Users\Iris\Desktop\esetsmartinstaller_enu.exe
2013-09-28 22:54 - 2013-09-28 22:54 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-28 22:43 - 2013-09-28 22:43 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-28 22:43 - 2013-09-28 22:43 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Malwarebytes
2013-09-28 22:43 - 2013-09-28 22:43 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-28 22:43 - 2013-09-28 22:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-28 22:43 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-28 22:42 - 2013-09-28 22:42 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Iris\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-28 01:01 - 2013-09-28 01:01 - 00358923 _____ (Farbar) C:\Users\Iris\Desktop\FSS.exe
2013-09-27 17:23 - 2013-09-27 17:24 - 01953854 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-27 17:12 - 2013-09-27 17:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-27 17:11 - 2013-09-27 17:11 - 01030305 _____ (Thisisu) C:\Users\Iris\Desktop\JRT.exe
2013-09-27 17:01 - 2013-09-27 17:02 - 00000000 ____D C:\AdwCleaner
2013-09-27 17:00 - 2013-09-27 17:01 - 01042066 _____ C:\Users\Iris\Desktop\adwcleaner.exe
2013-09-27 16:17 - 2013-09-27 16:17 - 00022063 _____ C:\ComboFix.txt
2013-09-27 15:49 - 2013-09-27 15:50 - 05129766 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-26 16:43 - 2013-08-10 07:22 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-26 16:43 - 2013-08-10 07:22 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-26 16:43 - 2013-08-10 07:22 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-26 16:43 - 2013-08-10 07:21 - 19246592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-26 16:43 - 2013-08-10 07:21 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-26 16:43 - 2013-08-10 07:21 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-26 16:43 - 2013-08-10 07:20 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-26 16:43 - 2013-08-10 05:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-26 16:43 - 2013-08-10 05:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-26 16:43 - 2013-08-10 05:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-09-26 16:43 - 2013-08-10 05:17 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-26 16:43 - 2013-08-10 05:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-26 16:43 - 2013-08-10 04:27 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-09-26 16:43 - 2013-08-10 04:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-09-26 16:40 - 2013-09-26 16:43 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 11:38 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-26 11:38 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-26 11:38 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-26 11:38 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-26 11:38 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-26 11:38 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-26 11:38 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-26 11:38 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-26 11:38 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-26 11:38 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-26 11:38 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-26 11:38 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-26 11:38 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-26 11:38 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-26 11:38 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-26 11:38 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-26 11:38 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-26 11:38 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-26 11:38 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-26 11:38 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-26 11:38 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-26 11:38 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-09-26 11:38 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-09-26 11:38 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-09-26 11:38 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-09-26 11:38 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-09-26 11:38 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-09-26 11:38 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-09-26 11:38 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-09-26 11:38 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-09-26 11:38 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-09-26 11:38 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-09-26 11:38 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-09-26 11:01 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-26 11:01 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-26 11:01 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-26 11:01 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-26 11:00 - 2013-09-27 16:17 - 00000000 ____D C:\Qoobox
2013-09-26 11:00 - 2013-09-27 16:12 - 00000000 ____D C:\Windows\erdnt
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat

==================== One Month Modified Files and Folders =======

2013-09-29 09:53 - 2010-08-22 13:07 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Skype
2013-09-29 09:20 - 2012-03-31 22:12 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-29 09:20 - 2010-01-15 09:24 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-29 00:11 - 2010-04-02 14:28 - 01214421 _____ C:\Windows\WindowsUpdate.log
2013-09-28 23:19 - 2010-01-15 09:24 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-28 22:54 - 2013-09-28 22:54 - 02347384 _____ (ESET) C:\Users\Iris\Desktop\esetsmartinstaller_enu.exe
2013-09-28 22:54 - 2013-09-28 22:54 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-28 22:45 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-28 22:45 - 2009-07-14 06:45 - 00013872 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-28 22:43 - 2013-09-28 22:43 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-28 22:43 - 2013-09-28 22:43 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Malwarebytes
2013-09-28 22:43 - 2013-09-28 22:43 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-28 22:43 - 2013-09-28 22:43 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-28 22:42 - 2013-09-28 22:42 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Iris\Desktop\mbam-setup-1.75.0.1300.exe
2013-09-28 22:40 - 2010-04-02 14:32 - 00003930 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{D1B11C91-16E4-4B70-85ED-51D8A96B0160}
2013-09-28 22:36 - 2013-08-13 17:18 - 00008483 _____ C:\Windows\setupact.log
2013-09-28 22:36 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-28 01:01 - 2013-09-28 01:01 - 00358923 _____ (Farbar) C:\Users\Iris\Desktop\FSS.exe
2013-09-27 17:24 - 2013-09-27 17:23 - 01953854 _____ (Farbar) C:\Users\Iris\Desktop\FRST64.exe
2013-09-27 17:12 - 2013-09-27 17:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-27 17:11 - 2013-09-27 17:11 - 01030305 _____ (Thisisu) C:\Users\Iris\Desktop\JRT.exe
2013-09-27 17:02 - 2013-09-27 17:01 - 00000000 ____D C:\AdwCleaner
2013-09-27 17:02 - 2011-06-19 19:05 - 00000993 _____ C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2013-09-27 17:02 - 2010-04-02 14:31 - 00001146 _____ C:\Users\Iris\Desktop\Internet Explorer.lnk
2013-09-27 17:01 - 2013-09-27 17:00 - 01042066 _____ C:\Users\Iris\Desktop\adwcleaner.exe
2013-09-27 16:17 - 2013-09-27 16:17 - 00022063 _____ C:\ComboFix.txt
2013-09-27 16:17 - 2013-09-26 11:00 - 00000000 ____D C:\Qoobox
2013-09-27 16:12 - 2013-09-26 11:00 - 00000000 ____D C:\Windows\erdnt
2013-09-27 16:12 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-27 16:08 - 2013-08-13 17:17 - 00503266 _____ C:\Windows\PFRO.log
2013-09-27 16:08 - 2009-07-14 04:34 - 78344192 _____ C:\Windows\system32\config\software.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 20709376 _____ C:\Windows\system32\config\system.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00311296 _____ C:\Windows\system32\config\default.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00061440 _____ C:\Windows\system32\config\sam.bak
2013-09-27 16:08 - 2009-07-14 04:34 - 00028672 _____ C:\Windows\system32\config\security.bak
2013-09-27 15:50 - 2013-09-27 15:49 - 05129766 ____R (Swearware) C:\Users\Iris\Desktop\ComboFix.exe
2013-09-26 20:48 - 2011-04-01 05:05 - 00119424 ____H C:\Windows\SysWOW64\mlfcache.dat
2013-09-26 20:40 - 2010-04-02 14:31 - 00000000 ___RD C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-26 20:40 - 2010-04-02 14:31 - 00000000 ___RD C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-26 20:39 - 2009-12-25 22:10 - 00000000 ____D C:\Windows\Panther
2013-09-26 20:39 - 2009-07-14 06:45 - 00368840 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-26 16:43 - 2013-09-26 16:40 - 00000000 ____D C:\Windows\system32\MRT
2013-09-26 16:40 - 2010-01-15 09:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-26 16:36 - 2010-01-15 18:11 - 00659238 _____ C:\Windows\system32\perfh007.dat
2013-09-26 16:36 - 2010-01-15 18:11 - 00132776 _____ C:\Windows\system32\perfc007.dat
2013-09-26 16:36 - 2009-07-14 07:13 - 01534236 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-26 11:34 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-26 11:00 - 2009-07-14 07:08 - 00032640 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 00:05 - 2013-09-26 00:05 - 00017108 _____ C:\Windows\SysWOW64\CCCInstall_201309260005220400.log
2013-09-26 00:05 - 2010-01-15 09:21 - 00000000 ____D C:\Program Files (x86)\ATI Technologies
2013-09-25 23:27 - 2010-01-15 09:24 - 00000000 ____D C:\Program Files (x86)\Google
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\searchplugins
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Windows\SysWOW64\Extensions
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Users\Iris\AppData\Local\avgchrome
2013-09-25 00:13 - 2013-09-25 00:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-25 00:12 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-09-24 23:55 - 2012-03-01 19:58 - 00000000 ____D C:\Program Files (x86)\Norton 360 Premier Edition
2013-09-24 23:55 - 2010-06-20 15:53 - 00000000 ____D C:\ProgramData\Norton
2013-09-24 11:50 - 2012-03-01 19:36 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Norton
2013-09-24 11:48 - 2012-03-01 19:36 - 00001300 _____ C:\Users\Iris\Desktop\Norton-Installationsdateien.lnk
2013-09-24 00:11 - 2012-03-31 22:12 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-24 00:11 - 2012-03-31 22:12 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-24 00:11 - 2011-06-04 19:45 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-23 00:19 - 2013-09-23 00:19 - 00000000 ____D C:\FRST
2013-09-16 00:53 - 2010-12-10 03:55 - 00009968 _____ C:\Users\Iris\Documents\Filme.xlsx
2013-09-14 23:15 - 2013-08-04 20:16 - 00000000 ____D C:\Users\Iris\AppData\Roaming\Lyax
2013-09-13 01:26 - 2013-09-13 01:26 - 00016496 _____ C:\Windows\system32\s000002.dat
2013-09-13 01:26 - 2010-12-25 22:02 - 00000207 _____ C:\Windows\system32\sstates.sdt
2013-09-13 01:26 - 2010-12-25 22:02 - 00000040 _____ C:\Windows\system32\sstate_prev.sdt
2013-09-08 01:40 - 2011-06-08 00:23 - 00000000 ____D C:\Users\Iris\AppData\Local\CrashDumps
2013-09-05 23:45 - 2012-07-01 10:04 - 00000000 ____D C:\Users\Iris\AppData\Local\Windows Live
2013-09-01 17:08 - 2010-04-13 14:22 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:
====================
C:\Users\Iris\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-09-21 15:01

==================== End Of Log ============================
--- --- ---

--- --- ---
[CODE]

Bootsektor 29.09.2013 15:22
Hallo Akki18,
wir müssen nochmal etwas fixen. Die anderen Funde sind in der Quarantäne und im Cache von Java, die entfernen wir noch nachher.

Schritt 1
Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
C:\Users\All Users\qpcvedwwrgnkyzo
C:\ProgramData\qpcvedwwrgnkyzo
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

Akki18 29.09.2013 21:20
Hi Bootsektor,
hier wieder die angeforderte Logfile. Kommen wir dem Ziel schon näher?

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-09-2013
Ran by Iris at 2013-09-29 22:20:00 Run:4
Running from C:\Users\Iris\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
C:\Users\All Users\qpcvedwwrgnkyzo
C:\ProgramData\qpcvedwwrgnkyzo
*****************

C:\Users\All Users\qpcvedwwrgnkyzo => Moved successfully.
"C:\ProgramData\qpcvedwwrgnkyzo" => File/Directory not found.

==== End of Fixlog ====

Bootsektor 30.09.2013 10:07
Hallo Akki18,
Ja, wir sind fertig. :)

OK
So wie ich es sehe, haben wir damit alles schadhafte entfernt. Deine Logs sind sauber.
Abschließend räumen wir noch etwas auf, führen Updates durch und dann bekommst du noch etwas Lesestoff von mir.

Schritt 1
Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.

Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK.
Code:
Combofix /Uninstall
http://larusso.trojaner-board.de/Images/CFuninstall.jpg

Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden.

Nun die eben deaktivierten Programme wieder aktivieren.

Schritt 2
Lade dir TFC (TempFileCleaner von Oldtimer) herunter und speichere es auf den Desktop.
  • Öffne die TFC.exe.
    Vista und Win 7 User mit Rechtsklick "als Administrator starten".
  • Schließe alle anderen Programme.
  • Drücke auf den Button Start.
  • Falls du zu einem Neustart aufgefordert wirst, bestätige diesen.



Schritt 3
Falls Du Malwarebytes-Antimalware und den ESET-Onlinescan nicht mehr benötigst, kannst Du beide Programme einfach über die Programmdeinstallation deinstallieren.

Schritt 4
Downloade dir bitte delfix auf deinen Desktop.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.
  • DelFix entfernt u. a. alle verwendeten Programme und löscht sich abschließend selbst.

Schritt 5
Updates / Programme aktualisieren
Deinstalliere den Adobe Reader
Dazu gehe auf:
den Windowsbutton in der Taskleiste --> Systemsteuerung --> Programme (Unterpunkt Programme deinstallieren) --> Programm auswählen --> entfernen
Lade ihn Dir von hier neu herunter. Entferne den Haken bei McAfee Security Plus

Deinstalliere Deinen GoogleChrome Browser, verfahre zum Deinstallieren nach der oben beschriebenen Anleitung und lade ihn Dir von
hier neu herunter.

Deinstalliere unbedingt Java und installiere es neu, einige Funde von ESET befinden sich im Cache von Java, dieser wird mit einer erneuten Installation natürlich gelöscht und wieder neu angelegt.
Dein Java ist nicht mehr aktuell. Älter Versionen enthalten Sicherheitslücken, die von Malware missbraucht werden können.
  • Downloade dir bitte die neueste Java-Version von hier
  • Speichere die jxpiinstall.exe
  • Schließe alle laufenden Programme. Speziell deinen Browser.
  • Starte die jxpiinstall.exe. Diese wird den Installer für die neueste Java Version ( Java 7 Update 25 ) herunter laden.
  • Entferne den Haken bei "Installieren Sie die Ask-Toolbar ..." während der Installation.
  • Wenn die Installation beendet wurde
    Start --> Systemsteuerung --> Programme und deinstalliere alle älteren Java Versionen.
  • Starte deinen Rechner neu sobald alle älteren Versionen deinstalliert wurden.
Nach dem Neustart
  • Öffne erneut die Systemsteuerung --> Programme und klicke auf das Java Symbol.
  • Im Reiter Allgemein, klicke unter Temporäre Internetdateien auf Einstellungen.
  • Klicke auf Dateien löschen....
  • Gehe sicher das überall ein Haken gesetzt ist und klicke OK.
  • Klicke erneut OK.
schneller Plugin-Test: PluginCheck



Nun zum Schluss noch ein paar Tipps zur Absicherung deines Systems.

Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
  • Bitte überprüfe, ob dein System Windows Updates automatisch herunter lädt
  • Windows Updates
    • Windows XP: Start --> Systemsteuerung --> Doppelklick auf Automatische Updates
    • Windows Vista / 7: Start --> Systemsteuerung --> System und Sicherheit --> Automatische Updates aktivieren oder deaktivieren
  • Gehe sicher das die automatischen Updates aktiviert sind.
  • Software Updates
    Installierte Software kann ebenfalls Sicherheitslücken haben, welche Malware nutzen kann, um dein System zu infizieren.
    Um deine installierte Software up to date zu halten, empfehle ich dir Secunia Online Software.


Antiviren Software
  • Gehe sicher immer eine Antiviren Software installiert zu haben und das diese auch up to date ist. Es ist nämlich nutzlos wenn diese out of date ist.


Zusätzlicher Schutz
  • MalwareBytes Anti-Malware
    Dies ist eines der besten Anti-Malware Tools auf dem Markt. Es ist ein On- Demand Scan Tool welches viele aktuelle Malware erkennt und auch entfernt.
    Update das Tool und lass es einmal in der Woche laufen. Die Kaufversion biete zudem noch einen Hintergrundwächter.
    Ein Tutorial zur Verwendung findest Du hier.
  • WinPatrol
    Diese Software macht einen Snapshot deines Systems und warnt dich vor eventuellen Änderungen. Downloade dir die Freeware Version von hier.


Sicheres Browsen
  • SpywareBlaster
    Eine kurze Einführung findest du Hier
  • MVPs hosts file
    Ein Tutorial findest Du hier. Leider habe ich bis jetzt kein deutschsprachiges gefunden.
  • WOT (Web of trust)
    Dieses AddOn warnt Dich bevor Du eine als schädlich gemeldete Seite besuchst.


Alternative Browser

Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
  • Opera
  • Mozilla Firefox.
    • Hinweis: Für diesen Browser habe ich hier ein paar nützliche Add Ons
    • NoScript
      Dieses AddOn blockt JavaScript, Java and Flash und andere Plugins. Sie werden nur dann ausgeführt wenn Du es bestätigst.
    • AdblockPlus
      Dieses AddOn blockt die meisten Werbung von selbst. Ein Rechtsklick auf den Banner um diesen zu AdBlockPlus hinzu zu fügen reicht und dieser wird nicht mehr geladen.
      Es spart ausserdem Downloadkapazität.

Performance
Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC
Halte dich fern von jedlichen Registry Cleanern.
Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links
Miekemoes Blogspot ( MVP )
Bill Castner ( MVP )



Don'ts
  • Klicke nicht auf alles nur weil es Dich dazu auffordert und schön bunt ist.
  • verwende keine peer to peer oder Filesharing Software (Emule, uTorrent,..)
  • Lass die Finger von Cracks, Keygens, Serials oder anderer illegaler Software.
  • Öffne keine Anhänge von Dir nicht bekannten Emails. Achte vor allem auf die Dateiendung wie zb deinFoto.jpg.exe
Nun bleibt mir nur noch dir viel Spass beim sicheren Surfen zu wünschen.

Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.

Falls Du Lob oder Kritik abgeben möchtest, kannst Du das hier tun.

Wenn Du etwas für das Forum und unsere Arbeit spenden möchtest, so kannst Du das hier tun
----------------------------

Hallo Akki18,
das sieht sehr gut aus. Jetzt noch ein paar Reste fixen und dann Kontrollscans.

Schritt 1
Fix mit FRST
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument
Code:
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
U2 wuaserv;
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Fix Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.

Schritt 2
Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.



Schritt 3
Da der Scan mit Eset sehr gründlich ist, kann er unter Umständen mehrere Stunden dauern :kaffee:

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset



Schritt 4
Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, wird ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.

Akki18 30.09.2013 11:50
Hi Bootsektor,

ich habe soweit alles erledigt und möchte mich zum Abschluss ganz herzlich bei dir bedanken :)

Liebe Grüße Akki18

Bootsektor 30.09.2013 19:23
Sehr gerne! Es freut mich, dass ich Dir helfen könnte.

Dieses Thema scheint erledigt und wird aus meinen Abonnements gelöscht, somit bekomme ich keine Benachrichtigungen mehr über neue Antworten.
Solltest Du noch Fragen oder Probleme haben, so schicke mir bitte eine PM


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:40 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20