Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows 7, Virenbefall nach Download HDvid-Codec, Befall mit Nav-Links, Versuch mit Spyhunter zu beheben (https://www.trojaner-board.de/142074-windows-7-virenbefall-download-hdvid-codec-befall-nav-links-versuch-spyhunter-beheben.html)

schrauber 02.10.2013 06:49
Was treibste denn? :)

MBAM updaten, QuickScan, Funde löschen lassen, Log posten.

AdwCleaner und JRT auch nochmal laufen und löschen lassen, dann ein frisches FRST log bitte.

Lady1 02.10.2013 20:04
Zitat:
Was treibste denn? :)
Nüscht :heilig:
Nur das was Du mir schreibst.

Als ich heute von der Arbeit heim kam, musste ich die EasyBox neu starten. War das Zufall oder hängt das womöglich zusammen?

Die anderen Punkte erledige ich morgen. Heute abend geht es auf die Piste :singsing:

LG
Lady

schrauber 03.10.2013 07:45
Hm, normal nicht.

Lady1 03.10.2013 15:22
Hi Schrauber,

Easybox läuft zum Glück wieder normal.

Hier die neuesten Ergebnisse:

MBAM:

Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.10.03.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Andrea :: ANDREA-HP [Administrator]

Schutz: Aktiviert

03.10.2013 12:14:33
mbam-log-2013-10-03 (12-14-33).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUM
Deaktivierte Suchlaufeinstellungen: PUP | P2P
Durchsuchte Objekte: 205268
Laufzeit: 2 Minute(n), 59 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
ADW:

Code:
# AdwCleaner v3.006 - Bericht erstellt am 03/10/2013 um 12:33:59
# Updated 01/10/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Andrea - ANDREA-HP
# Gestartet von : C:\Users\Andrea\Downloads\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16506


-\\ Mozilla Firefox v24.0 (de)

[ Datei : C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.crossrider.bic", "14174ec6abe55b85ad4f38f6f10035df");

*************************

AdwCleaner[R0].txt - [22162 octets] - [26/09/2013 20:54:55]
AdwCleaner[R1].txt - [6769 octets] - [03/10/2013 12:31:53]
AdwCleaner[S0].txt - [21293 octets] - [26/09/2013 20:57:03]
AdwCleaner[S1].txt - [6392 octets] - [03/10/2013 12:33:59]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [6452 octets] ##########
JRT:

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.3 (09.27.2013:1)
OS: Windows 7 Home Premium x64
Ran by Andrea on 03.10.2013 at 12:40:56,41
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\hdvid codec v1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{21D59046-8568-4E51-BD32-79BD751DCCE6}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{499B15AC-881F-4224-9373-E2AF2D95108B}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C2A9ED0-361D-4678-BBB6-FA668315952D}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{82FE22F6-6581-4ED3-B962-D0114CFC8F04}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A178FE10-2662-4286-93AB-0477A425A351}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\hdvid codec v1-codedownloader_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\hdvid codec v1-codedownloader_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plus-hd-2_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\plus-hd-2_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\hdvid codec v1



~~~ Files

Successfully deleted: [File] "C:\Windows\Tasks\HDvid Codec V1-codedownloader.job"
Successfully deleted: [File] "C:\Windows\Tasks\HDvid Codec V1-enabler.job"
Successfully deleted: [File] "C:\Windows\Tasks\HDvid Codec V1-updater.job"



~~~ Folders

Successfully deleted: [Folder] "C:\Program Files (x86)\hdvid codec v1"
Successfully deleted: [Folder] "C:\Program Files (x86)\myfree codec"



~~~ FireFox

Successfully deleted: [Folder] C:\Users\Andrea\AppData\Roaming\mozilla\firefox\profiles\vs7tooal.default\extensions\763ab44b-71df-436c-906e-2ee8e1d7b302@af951efb-381e-47b2-ac45-80df41e44bc7.com



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2013 at 12:46:51,68
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
und



FRST Logfile:

FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Andrea (administrator) on ANDREA-HP on 03-10-2013 12:52:17
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU -  No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)

==================== Drivers (Whitelisted) ====================

R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-03 12:51 - 2013-10-03 12:52 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe
2013-10-03 12:50 - 2013-10-03 12:50 - 00002701 _____ C:\Users\Andrea\Desktop\JRT 03.10.2013.txt
2013-10-03 12:46 - 2013-10-03 12:46 - 00002701 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-10-03 12:40 - 2013-10-03 12:40 - 01030305 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT(1).exe
2013-10-03 12:37 - 2013-10-03 12:37 - 00006760 _____ C:\Users\Andrea\Desktop\AdwCleaner 03.10.2013.txt
2013-10-03 12:29 - 2013-10-03 12:29 - 01045226 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-10-03 11:58 - 2013-10-03 11:58 - 99014207 _____ C:\Windows\SysWOW64\衸�Ÿ
2013-10-01 18:59 - 2013-10-01 18:59 - 00055775 _____ C:\Users\Andrea\Desktop\FRST 01.10.2013.txt
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:47 - 2013-09-30 19:49 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-10-03 12:34 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-10-03 12:10 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-26 20:38 - 2013-10-03 12:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-10-03 12:36 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-10-03 12:36 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-10-03 12:36 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-10-03 12:36 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i

==================== One Month Modified Files and Folders =======

2013-10-03 12:52 - 2013-10-03 12:51 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe
2013-10-03 12:50 - 2013-10-03 12:50 - 00002701 _____ C:\Users\Andrea\Desktop\JRT 03.10.2013.txt
2013-10-03 12:46 - 2013-10-03 12:46 - 00002701 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-10-03 12:43 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-03 12:43 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-03 12:40 - 2013-10-03 12:40 - 01030305 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT(1).exe
2013-10-03 12:37 - 2013-10-03 12:37 - 00006760 _____ C:\Users\Andrea\Desktop\AdwCleaner 03.10.2013.txt
2013-10-03 12:36 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-10-03 12:36 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-10-03 12:36 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-10-03 12:36 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-10-03 12:36 - 2013-01-08 22:58 - 00000436 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-03 12:36 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-03 12:35 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-03 12:35 - 2009-07-14 06:51 - 00101775 _____ C:\Windows\setupact.log
2013-10-03 12:34 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-10-03 12:34 - 2011-09-23 01:41 - 01490827 _____ C:\Windows\WindowsUpdate.log
2013-10-03 12:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-03 12:29 - 2013-10-03 12:29 - 01045226 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-10-03 12:10 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-03 12:10 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-03 12:08 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-10-03 12:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-03 12:02 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-10-03 11:58 - 2013-10-03 11:58 - 99014207 _____ C:\Windows\SysWOW64\衸�Ÿ
2013-10-03 11:56 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-10-02 21:06 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-10-02 21:05 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-10-02 21:05 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-10-02 20:59 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-10-01 18:59 - 2013-10-01 18:59 - 00055775 _____ C:\Users\Andrea\Desktop\FRST 01.10.2013.txt
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:49 - 2013-09-30 19:47 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:47 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:41 - 2010-11-21 05:47 - 00923358 _____ C:\Windows\PFRO.log
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-09-29 08:20 - 00001068 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 23:15 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:42 - 2011-07-16 07:32 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-09-28 22:42 - 2011-07-16 07:32 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-09-28 22:42 - 2009-07-14 07:13 - 01500294 _____ C:\Windows\system32\PerfStringBackup.INI
2013-09-28 22:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:06 - 01527912 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i
2013-09-05 22:44 - 2013-08-08 22:42 - 00081112 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00132088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-09-05 22:44 - 2013-08-06 23:12 - 00105344 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-01 20:14

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

--- --- ---



Rechner läuft jetzt wieder normal und die Symptome sind verschwunden. Traue mich jetzt nur gar nicht den Rechner runterzufahren weil bisher beim nächsten Start immer alles wieder da war :wtf:

LG
Lady

Hi Schrauber,

neueste Entwicklung. Hatte den Rechner nicht runtergefahren sondern nur in den Ruhezustand gesetzt. Wollte jetzt gerade schauen wie der aktuelle Stand ist und der ganze Mist ist leider wieder da :killpc: :heulen:

Weiß nicht ob es hilfreich ist, ich habe nochmal einen neuen FRST Scan gemacht.
Habe die Log-Datei als Anhang beigefügt, anders ging es nicht.

Morgen und vermutlich auch am Samstag werde ich keine Zeit haben, irgendetwas am Rechner zu tun. Kann also sein, dass Du erst am Sonntag wieder von mir hörst, außer wir kommen heute nochmal zusammen.

LG
Lady

schrauber 04.10.2013 02:02

ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme? :)

Lady1 06.10.2013 02:05
Hi Schrauber,

hier die gewünschten Dateien:

Eset:

Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=f29de060b5e6484d9f63753bae692615
# engine=15365
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-05 02:12:47
# local_time=2013-10-05 04:12:47 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=5893 16776573 100 94 7987 132612217 0 0
# scanned=224079
# found=0
# cleaned=0
# scan_time=5807
Security Check:

Code:
Results of screen317's Security Check version 0.99.74 
 Windows 7 Service Pack 1 x64 (UAC is enabled) 
 Internet Explorer 10 
``````````````Antivirus/Firewall Check:``````````````
Avira Desktop 
 Antivirus up to date! 
`````````Anti-malware/Other Utilities Check:`````````
 Malwarebytes Anti-Malware Version 1.75.0.1300 
 JavaFX 2.1.0   
 Java(TM) 6 Update 30 
 Java 7 Update 13 
 Java version out of Date!
 Adobe Flash Player 11.8.800.168 
 Adobe Reader 10.1.7 Adobe Reader out of Date! 
 Mozilla Firefox (24.0)
````````Process Check: objlist.exe by Laurent```````` 
 Malwarebytes Anti-Malware mbamservice.exe 
 Malwarebytes Anti-Malware mbamgui.exe 
 Avira Antivir avgnt.exe
 Avira Antivir avguard.exe
 Malwarebytes' Anti-Malware mbamscheduler.exe 
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C: 
````````````````````End of Log``````````````````````

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Andrea (administrator) on ANDREA-HP on 06-10-2013 02:54:15
Running from C:\Users\Andrea\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Enigma Software Group USA, LLC.) C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE
(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_168.exe
(Farbar) C:\Users\Andrea\Downloads\FRST64(5).exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\usrreq.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU -  No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.13.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\vs7tooal.default\Extensions\763ab44b-71df-436c-906e-2ee8e1d7b302@af951efb-381e-47b2-ac45-80df41e44bc7.com
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)

==================== Drivers (Whitelisted) ====================

R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-06 02:53 - 2013-10-06 02:53 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(5).exe
2013-10-06 02:50 - 2013-10-06 02:50 - 00891167 _____ C:\Users\Andrea\Downloads\SecurityCheck(1).exe
2013-10-06 02:48 - 2013-10-06 02:48 - 00000651 _____ C:\Users\Andrea\Desktop\eset.txt
2013-10-05 14:32 - 2013-10-05 14:32 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu(1).exe
2013-10-05 13:54 - 2013-10-05 19:54 - 99386337 _____ C:\Windows\SysWOW64\登“
2013-10-03 16:39 - 2013-10-03 16:39 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-10-03 16:38 - 2013-10-03 16:38 - 01110476 _____ C:\Users\Andrea\Downloads\7z920.exe
2013-10-03 16:28 - 2013-10-03 16:28 - 00056142 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013 2.txt
2013-10-03 16:26 - 2013-10-03 16:26 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(4).exe
2013-10-03 12:52 - 2013-10-03 12:52 - 00055087 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013.txt
2013-10-03 12:51 - 2013-10-03 12:52 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe
2013-10-03 12:50 - 2013-10-03 12:50 - 00002701 _____ C:\Users\Andrea\Desktop\JRT 03.10.2013.txt
2013-10-03 12:46 - 2013-10-03 12:46 - 00002701 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-10-03 12:40 - 2013-10-03 12:40 - 01030305 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT(1).exe
2013-10-03 12:37 - 2013-10-03 12:37 - 00006760 _____ C:\Users\Andrea\Desktop\AdwCleaner 03.10.2013.txt
2013-10-03 12:29 - 2013-10-03 12:29 - 01045226 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-10-03 11:58 - 2013-10-03 11:58 - 99014207 _____ C:\Windows\SysWOW64\衸�Ÿ
2013-10-01 18:59 - 2013-10-01 18:59 - 00055775 _____ C:\Users\Andrea\Desktop\FRST 01.10.2013.txt
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:47 - 2013-09-30 19:49 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-10-06 02:52 - 00001066 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-10-03 12:34 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-10-03 12:10 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-26 20:38 - 2013-10-03 12:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:43 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-10-05 21:36 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i

==================== One Month Modified Files and Folders =======

2013-10-06 02:53 - 2013-10-06 02:53 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(5).exe
2013-10-06 02:52 - 2013-09-29 08:20 - 00001066 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-10-06 02:50 - 2013-10-06 02:50 - 00891167 _____ C:\Users\Andrea\Downloads\SecurityCheck(1).exe
2013-10-06 02:48 - 2013-10-06 02:48 - 00000651 _____ C:\Users\Andrea\Desktop\eset.txt
2013-10-06 02:31 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-06 02:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-06 02:00 - 2011-09-23 01:41 - 01692626 _____ C:\Windows\WindowsUpdate.log
2013-10-06 00:45 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-10-05 21:51 - 2013-01-08 22:58 - 00000437 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-05 21:36 - 2013-09-24 21:31 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-10-05 21:31 - 2013-09-24 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-10-05 21:31 - 2013-09-24 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-10-05 21:31 - 2013-09-24 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-10-05 19:54 - 2013-10-05 13:54 - 99386337 _____ C:\Windows\SysWOW64\登“
2013-10-05 14:32 - 2013-10-05 14:32 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu(1).exe
2013-10-05 14:32 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-10-05 14:30 - 2011-07-16 07:32 - 00658400 _____ C:\Windows\system32\perfh007.dat
2013-10-05 14:30 - 2011-07-16 07:32 - 00131482 _____ C:\Windows\system32\perfc007.dat
2013-10-05 14:30 - 2009-07-14 07:13 - 01509054 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-05 14:00 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-05 14:00 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-05 13:55 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-10-05 13:53 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-05 13:53 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-05 13:53 - 2009-07-14 06:51 - 00101831 _____ C:\Windows\setupact.log
2013-10-03 22:08 - 2011-12-26 16:59 - 00000000 ____D C:\Users\Andrea\AppData\Local\Mozilla
2013-10-03 16:39 - 2013-10-03 16:39 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-10-03 16:38 - 2013-10-03 16:38 - 01110476 _____ C:\Users\Andrea\Downloads\7z920.exe
2013-10-03 16:28 - 2013-10-03 16:28 - 00056142 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013 2.txt
2013-10-03 16:26 - 2013-10-03 16:26 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(4).exe
2013-10-03 12:55 - 2011-12-25 17:06 - 01529464 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-03 12:52 - 2013-10-03 12:52 - 00055087 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013.txt
2013-10-03 12:52 - 2013-10-03 12:51 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe
2013-10-03 12:50 - 2013-10-03 12:50 - 00002701 _____ C:\Users\Andrea\Desktop\JRT 03.10.2013.txt
2013-10-03 12:46 - 2013-10-03 12:46 - 00002701 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-10-03 12:40 - 2013-10-03 12:40 - 01030305 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT(1).exe
2013-10-03 12:37 - 2013-10-03 12:37 - 00006760 _____ C:\Users\Andrea\Desktop\AdwCleaner 03.10.2013.txt
2013-10-03 12:34 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-10-03 12:29 - 2013-10-03 12:29 - 01045226 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-10-03 12:10 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-03 12:10 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-03 11:58 - 2013-10-03 11:58 - 99014207 _____ C:\Windows\SysWOW64\衸�Ÿ
2013-10-03 11:56 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-10-02 21:06 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-10-02 21:05 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-10-02 21:05 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-10-01 18:59 - 2013-10-01 18:59 - 00055775 _____ C:\Users\Andrea\Desktop\FRST 01.10.2013.txt
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:49 - 2013-09-30 19:47 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-09-30 19:47 - 2013-09-30 19:47 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-09-30 19:47 - 2013-09-30 19:47 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-09-30 19:47 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:41 - 2010-11-21 05:47 - 00923358 _____ C:\Windows\PFRO.log
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 23:15 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00061001 _____ C:\Users\Andrea\Desktop\FRST.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:43 - 2013-09-24 21:41 - 00001134 _____ C:\Users\Andrea\Desktop\Continue Image Editor Installation.lnk
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:36 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 18:39 - 2013-09-21 18:39 - 00001066 _____ C:\Users\Public\Desktop\VLC media player.lnk
2013-09-21 18:38 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-01 20:14

==================== End Of Log ============================
--- --- ---


Leider hat sich nichts getan. Die Probleme sind nach wie vor da :heulen:

Grüße und gute Nacht

Lady

schrauber 06.10.2013 16:29
Java und ADobe updaten. In welchem browser?

Lady1 06.10.2013 17:34
Hi,

Update Adobe hat problemlos geklappt. Bei Java gab es Probleme. Hab es deshalb deinstalliert und die neueste Version neu installiert. Müsste jetzt also Beides auf dem neuesten Stand sein.

Broswer: Firefox

Als ich vorhin den Rechner hochgefahren habe, kam eine Meldung von Antivir. Sie ist aber in den Ereignissen und Berichten nicht mehr zu finden, nur Meldungen über blockierte Anwendungen:

Code:
Gesperrte Anwendung:
Lokale IP: 192.168.2.104
Lokaler Port: 4032
Remote IP: 208.85.150.249
Remote Port: 20480
Aktionscode: Connect
Pfad der Anwendung: C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe
Benutzer: SYSTEM.

Gesperrte Anwendung:
Lokale IP: 192.168.2.104
Lokaler Port: 4288
Remote IP: 69.16.175.10
Remote Port: 20480
Aktionscode: Connect
Pfad der Anwendung: C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe
Benutzer: SYSTEM.

Gesperrte Anwendung:
Lokale IP: 0.0.0.0
Lokaler Port: 7360
Remote IP: 127.0.0.1
Remote Port: 12460
Aktionscode: Connect
Pfad der Anwendung: C:\Windows\SysWOW64\ezSharedSvcHost.exe
Benutzer: SYSTEM.
Gruß
Lady

schrauber 07.10.2013 08:23
Firefox deinstallieren, keine Daten behalten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
2013-09-24 21:31 - 2013-10-05 21:36 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.



Firefox neu installieren. Noch Probleme?

Lady1 07.10.2013 21:19
Hi Schrauber,

hier das Ergebnis - fixlog:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
Ran by Andrea at 2013-10-07 22:02:14 Run:1
Running from C:\Users\Andrea\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
R2 SpyHunter 4 Service; C:\PROGRA~1\ENIGMA~1\SPYHUN~1\SH4SER~1.EXE [1025408 2013-07-17] (Enigma Software Group USA, LLC.)
2013-09-24 21:31 - 2013-10-05 21:36 - 00001836 _____ C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001912 _____ C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001298 _____ C:\Windows\Tasks\LyriXeeker-1-updater.job
2013-09-24 21:31 - 2013-10-05 21:31 - 00001102 _____ C:\Windows\Tasks\LyriXeeker-1-enabler.job
2013-09-24 21:31 - 2013-09-25 22:27 - 00000000 ____D C:\Program Files (x86)\LyriXeeker-1
2013-09-24 21:31 - 2013-09-24 21:36 - 00000000 ____D C:\Program Files (x86)\BonanzaDeals
2013-09-24 21:31 - 2013-09-24 21:31 - 00004328 _____ C:\Windows\System32\Tasks\LyriXeeker-1-updater
2013-09-24 21:31 - 2013-09-24 21:31 - 00004132 _____ C:\Windows\System32\Tasks\LyriXeeker-1-enabler
2013-09-24 21:31 - 2013-09-24 21:31 - 00000000 ____D C:\Program Files (x86)\Image Converter
       


*****************

SpyHunter 4 Service => Service deleted successfully.
C:\Windows\Tasks\LyriXeeker-1-firefoxinstaller.job => Moved successfully.
C:\Windows\Tasks\LyriXeeker-1-chromeinstaller.job => Moved successfully.
C:\Windows\Tasks\LyriXeeker-1-updater.job => Moved successfully.
C:\Windows\Tasks\LyriXeeker-1-enabler.job => Moved successfully.
C:\Program Files (x86)\LyriXeeker-1 => Moved successfully.
C:\Program Files (x86)\BonanzaDeals => Moved successfully.
C:\Windows\System32\Tasks\LyriXeeker-1-updater => Moved successfully.
C:\Windows\System32\Tasks\LyriXeeker-1-enabler => Moved successfully.
C:\Program Files (x86)\Image Converter => Moved successfully.


The system needs a manual reboot.

==== End of Fixlog ====
Firefox ist neu installiert, die Probleme sind - auch nach einem Neustart - weg :singsing: Ich hoffe das war jetzt der Durchbruch.

Folgende Programme finden sich jetzt noch auf dem Rechner:
- Spyunter
- LyriXeeker-1 von Lyrics
- VCC media-player 2.0.7 von VideoLAN

Auf dem Desktop habe ich noch: Continue Image Editor Installation - Keine Ahnung, worum es sich hier handelt.

Beim Internet Explorer bin ich mir nicht sicher, ob der richtig läuft. An sich arbeite ich nur mit Firefox, die Neuinstallation von Firefox lief aber über den IE und der Seitenaufbau sah etwas komisch aus.

Du hattest mir auf diese Fragen schon in Deinem Eintrag vom 01.10. um 17:07 geantwortet. Bevor ich zur Umsetzung kam, traten leider die Ursprungsprobleme wieder auf. Soll ich jetzt so vorgehen, wie von Dir damals geschrieben?

LG
Lady

schrauber 08.10.2013 08:57
Genau.

Revo Uninstaller - Download - Filepony
damit von Dir genannte Programme deinstallieren, Reste entfernen lassen.
Das Teil auf dem desktop löschen, dann ein frisches FRST log.

Lady1 08.10.2013 19:04
Hi Schrauber,

ich konnte alle Programme mit Revo Uninstaller entfernen, außer dem SpyHunter.
Dieser war im Uninstaller nicht zu finden, findet sich aber nach wie vor in der Systemsteuerung und auch auf dem Desktop.

Ich habe dann noch die Einstellungen des Internet Explorer wie von Dir schon beschrieben zurückgesetzt. Sieht jetzt auch deutlich besser aus.

Hier das neue FRST:


FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
Ran by Andrea (administrator) on ANDREA-HP on 08-10-2013 20:26:25
Running from C:\Users\Andrea\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe
() C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_YATIHTU.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
(ACD Systems) C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\EPSON Software\Event Manager\EEventManager.exe
(Apple Computer, Inc.) C:\Program Files (x86)\QuickTime\qttask.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Microsoft Corporation) C:\Windows\System32\alg.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_8_800_175_ActiveX.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Farbar) C:\Users\Andrea\Desktop\FRST64(6).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-10] (Synaptics Incorporated)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2011-06-08] (IDT, Inc.)
HKLM\...\Run: [SetDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKCU\...\Run: [Wisdom-soft ScreenHunter 6.0 Free] - 0
HKCU\...\Run: [EPLTarget\P0000000000000000] - C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIHTU.EXE [241280 2013-08-10] (SEIKO EPSON CORPORATION)
HKCU\...\Run: [Avira Secure Backup] - "C:\Program Files\Avira Secure Backup\Avira Secure Backup.exe" /delayed
HKCU\...\Policies\system: [DisableLockWorkstation] 0
HKCU\...\Policies\system: [DisableChangePassword] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-05-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-04-30] (Intel Corporation)
HKLM-x32\...\Run: [HPQuickWebProxy] - C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [168504 2011-06-28] (Hewlett-Packard Company)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [ACPW05DE] - C:\Program Files (x86)\ACD Systems\ACDSee Pro\5.0\ACDSeeProInTouch2.exe [822384 2011-11-17] (ACD Systems)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [979328 2010-10-12] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\qttask.exe [77824 2013-03-14] (Apple Computer, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPNOT/4
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPNOT/4
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {42218EA0-A1A3-4FAE-BBF7-7482498E8022} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de2-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://www.google.com/search?q={sear
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-3/4?mpre=hxxp://shop.ebay.com/?_nkw={searchTerms}
BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM-x32 -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Toolbar: HKCU -  No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
Toolbar: HKCU -  No Name - {41564952-412D-5637-00A7-7A786E7484D7} -  No File
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Andrea\AppData\Roaming\Mozilla\Firefox\Profiles\6re3rvs6.default
FF Homepage: https://www.google.de/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll ()
FF Plugin: @java.com/DTPlugin,version=10.40.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\3\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\Nation Search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (LyriXeeker-1) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Iminent Chrome Toolbar) - C:\Users\Andrea\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkhojieggfgllhllcegoffdcnmdeojgb\2.0_0
CHR HKLM-x32\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\ProgramData\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
CHR HKLM-x32\...\Chrome\Extension: [dnllcmllkjofnojidnaknldfehfhehoo] - C:\Program Files (x86)\HDvidCodec.com\HDvidCodec10.crx
CHR HKLM-x32\...\Chrome\Extension: [hdhihajbmafmgilcciomnamcjfkdhikl] - C:\Program Files (x86)\HP SimplePass 2011\tschrome.crx
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AntiVirFirewallService; C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [655928 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [622648 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-05] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Program Files (x86)\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 Avira Secure Backup Crawler; C:\Program Files\Avira Secure Backup\Avira Secure BackupCrawler.exe [4121960 2013-06-24] ()
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

==================== Drivers (Whitelisted) ====================

R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [114608 2013-08-06] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [141376 2013-08-06] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105344 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132088 2013-09-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-06] (Avira Operations GmbH & Co. KG)
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 cdrbsdrv; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-08 20:24 - 2013-10-08 20:24 - 00001405 _____ C:\Users\Andrea\Desktop\Internet Explorer (64-bit).lnk
2013-10-08 20:05 - 2013-10-08 20:05 - 00003266 _____ C:\Windows\System32\Tasks\{C61DF3E7-4D2E-472A-BC2A-ECC3AE238493}
2013-10-08 20:00 - 2013-10-08 20:00 - 00059051 _____ C:\Users\Andrea\Desktop\FRST 08.10.2013.txt
2013-10-08 19:48 - 2013-10-08 19:48 - 00001264 _____ C:\Users\Andrea\Desktop\Revo Uninstaller.lnk
2013-10-08 19:48 - 2013-10-08 19:48 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-10-08 19:47 - 2013-10-08 19:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Andrea\Downloads\revosetup95.exe
2013-10-07 22:12 - 2013-10-07 22:13 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-10-07 22:12 - 2013-10-07 22:12 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-07 22:12 - 2013-10-07 22:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-07 21:57 - 2013-10-07 21:57 - 01954124 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64(6).exe
2013-10-06 19:01 - 2013-10-06 19:00 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-06 19:00 - 2013-10-06 19:00 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-06 19:00 - 2013-10-06 19:00 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-06 19:00 - 2013-10-06 19:00 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-06 19:00 - 2013-10-06 19:00 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-06 18:59 - 2013-10-06 18:59 - 00913832 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jxpiinstall(2).exe
2013-10-06 18:52 - 2013-10-06 18:52 - 01095080 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-10-06 18:52 - 2013-10-06 18:52 - 00973736 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-10-06 18:51 - 2013-10-06 18:52 - 30669224 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jre-7u40-windows-x64.exe
2013-10-06 18:49 - 2013-10-06 19:01 - 00000000 ____D C:\ProgramData\Oracle
2013-10-06 18:44 - 2013-10-06 18:44 - 00913832 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jxpiinstall.exe
2013-10-06 18:44 - 2013-10-06 18:44 - 00913832 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jxpiinstall(1).exe
2013-10-06 18:32 - 2013-10-06 18:32 - 00000774 _____ C:\Users\Andrea\Desktop\Ereignisse 06.10.2013
2013-10-06 18:32 - 2013-10-06 18:32 - 00000738 _____ C:\Users\Andrea\Desktop\Ereignisse 06.10.2013 II
2013-10-06 18:32 - 2013-10-06 18:32 - 00000678 _____ C:\Users\Andrea\Desktop\Ereignisse 06.10.2013 III
2013-10-06 02:55 - 2013-10-06 02:55 - 00057208 _____ C:\Users\Andrea\Desktop\FRST 06.10.2013.txt
2013-10-06 02:54 - 2013-10-06 02:54 - 00057208 _____ C:\Users\Andrea\Downloads\FRST.txt
2013-10-06 02:53 - 2013-10-06 02:53 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(5).exe
2013-10-06 02:50 - 2013-10-06 02:50 - 00891167 _____ C:\Users\Andrea\Downloads\SecurityCheck(1).exe
2013-10-05 14:32 - 2013-10-05 14:32 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu(1).exe
2013-10-03 16:39 - 2013-10-03 16:39 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-10-03 16:38 - 2013-10-03 16:38 - 01110476 _____ C:\Users\Andrea\Downloads\7z920.exe
2013-10-03 16:28 - 2013-10-03 16:28 - 00056142 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013 2.txt
2013-10-03 16:26 - 2013-10-03 16:26 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(4).exe
2013-10-03 12:52 - 2013-10-03 12:52 - 00055087 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013.txt
2013-10-03 12:51 - 2013-10-03 12:52 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe
2013-10-03 12:50 - 2013-10-03 12:50 - 00002701 _____ C:\Users\Andrea\Desktop\JRT 03.10.2013.txt
2013-10-03 12:46 - 2013-10-03 12:46 - 00002701 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-10-03 12:40 - 2013-10-03 12:40 - 01030305 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT(1).exe
2013-10-03 12:37 - 2013-10-03 12:37 - 00006760 _____ C:\Users\Andrea\Desktop\AdwCleaner 03.10.2013.txt
2013-10-03 12:29 - 2013-10-03 12:29 - 01045226 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-10-03 11:58 - 2013-10-03 11:58 - 99014207 _____ C:\Windows\SysWOW64\衸�Ÿ
2013-10-01 18:59 - 2013-10-01 18:59 - 00055775 _____ C:\Users\Andrea\Desktop\FRST 01.10.2013.txt
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:20 - 2013-10-06 02:52 - 00001066 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:54 - 2013-10-03 12:34 - 00000000 ____D C:\AdwCleaner
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-10-03 12:10 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-09-26 20:38 - 2013-10-03 12:10 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:38 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-09-26 20:35 - 2013-09-26 20:36 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 21:58 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-25 21:58 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-25 21:58 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-25 21:58 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-25 21:56 - 2013-09-25 23:11 - 00000000 ____D C:\Qoobox
2013-09-25 21:53 - 2013-09-25 22:28 - 00000000 ____D C:\Windows\erdnt
2013-09-25 21:52 - 2013-09-25 21:50 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:53 - 2013-10-07 22:02 - 00000000 ____D C:\FRST
2013-09-24 21:53 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-23 11:29 - 2013-09-24 19:46 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-21 18:52 - 2013-09-22 22:13 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:39 - 2013-08-13 08:38 - 00032328 _____ C:\Windows\Launcher.exe
2013-09-21 18:38 - 2013-10-08 19:53 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-09-13 21:44 - 2013-07-31 16:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-13 21:44 - 2013-07-31 15:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-13 21:44 - 2013-07-31 15:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-13 21:44 - 2013-07-31 15:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-13 21:44 - 2013-07-31 15:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-13 21:44 - 2013-07-31 15:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 15:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-09-13 21:44 - 2013-07-31 15:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 15:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 15:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-13 21:44 - 2013-07-31 15:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-13 21:44 - 2013-07-31 15:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 15:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 15:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 15:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-13 21:44 - 2013-07-31 12:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-09-13 21:44 - 2013-07-31 12:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-09-13 21:44 - 2013-07-31 12:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-09-13 21:44 - 2013-07-31 11:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-09-13 21:44 - 2013-07-31 11:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-09-13 21:44 - 2013-07-31 11:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-09-13 21:44 - 2013-07-31 11:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-09-13 21:44 - 2013-07-31 11:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-09-13 21:44 - 2013-07-31 11:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-09-13 21:44 - 2013-07-31 11:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-09-13 21:44 - 2013-07-31 11:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-09-13 21:44 - 2013-07-31 11:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-09-13 21:44 - 2013-07-31 11:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-09-13 21:44 - 2013-07-31 11:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-09-12 10:55 - 2013-08-08 03:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-09-12 10:55 - 2013-08-05 04:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
2013-09-12 10:55 - 2013-08-02 04:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 04:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-12 10:55 - 2013-08-02 04:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2013-09-12 10:55 - 2013-08-02 04:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2013-09-12 10:55 - 2013-08-02 04:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 04:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-12 10:55 - 2013-08-02 03:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-12 10:55 - 2013-08-02 03:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2013-09-12 10:55 - 2013-08-02 03:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 03:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
2013-09-12 10:55 - 2013-08-02 02:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-12 10:55 - 2013-08-02 02:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-12 10:55 - 2013-08-02 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-12 10:55 - 2013-08-02 02:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2013-09-12 10:55 - 2013-08-02 02:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2013-09-12 10:55 - 2013-07-26 04:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2013-09-12 10:55 - 2013-07-26 03:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
2013-09-08 18:12 - 2013-09-12 10:49 - 97171315 _____ C:\Windows\SysWOW64\灤౼i

==================== One Month Modified Files and Folders =======

2013-10-08 20:24 - 2013-10-08 20:24 - 00001405 _____ C:\Users\Andrea\Desktop\Internet Explorer (64-bit).lnk
2013-10-08 20:24 - 2011-12-24 18:13 - 00003938 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{5717C4F9-34CC-4C33-A5BA-AE8FA455B99B}
2013-10-08 20:22 - 2013-01-08 22:58 - 00000436 _____ C:\Windows\system32\Drivers\etc\hosts.ics
2013-10-08 20:22 - 2012-04-09 19:24 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-10-08 20:21 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-08 20:21 - 2009-07-14 06:51 - 00102447 _____ C:\Windows\setupact.log
2013-10-08 20:20 - 2011-09-23 01:41 - 01573044 _____ C:\Windows\WindowsUpdate.log
2013-10-08 20:20 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-08 20:20 - 2009-07-14 06:45 - 00031856 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-08 20:05 - 2013-10-08 20:05 - 00003266 _____ C:\Windows\System32\Tasks\{C61DF3E7-4D2E-472A-BC2A-ECC3AE238493}
2013-10-08 20:05 - 2012-05-02 20:07 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-10-08 20:00 - 2013-10-08 20:00 - 00059051 _____ C:\Users\Andrea\Desktop\FRST 08.10.2013.txt
2013-10-08 19:53 - 2013-09-21 18:38 - 00000000 ____D C:\Program Files (x86)\VideoLAN
2013-10-08 19:48 - 2013-10-08 19:48 - 00001264 _____ C:\Users\Andrea\Desktop\Revo Uninstaller.lnk
2013-10-08 19:48 - 2013-10-08 19:48 - 00000000 ____D C:\Program Files (x86)\VS Revo Group
2013-10-08 19:47 - 2013-10-08 19:47 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Andrea\Downloads\revosetup95.exe
2013-10-08 19:36 - 2012-04-09 19:24 - 00001110 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-10-07 22:31 - 2012-04-09 19:24 - 00004106 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-10-07 22:31 - 2012-04-09 19:24 - 00003854 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-10-07 22:19 - 2012-01-16 21:58 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-10-07 22:13 - 2013-10-07 22:12 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Mozilla
2013-10-07 22:13 - 2012-01-17 22:53 - 00000000 ____D C:\Users\Andrea\Documents\Outlook-Dateien
2013-10-07 22:12 - 2013-10-07 22:12 - 00001147 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-10-07 22:12 - 2013-10-07 22:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-10-07 22:12 - 2013-08-17 23:31 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-10-07 22:05 - 2012-09-24 22:53 - 00000424 _____ C:\Users\Andrea\Sti_Trace.log
2013-10-07 22:04 - 2010-11-21 05:47 - 00924502 _____ C:\Windows\PFRO.log
2013-10-07 22:02 - 2013-09-24 21:53 - 00000000 ____D C:\FRST
2013-10-07 22:00 - 2011-07-16 07:32 - 00658400 _____ C:\Windows\system32\perfh007.dat
2013-10-07 22:00 - 2011-07-16 07:32 - 00131482 _____ C:\Windows\system32\perfc007.dat
2013-10-07 22:00 - 2009-07-14 07:13 - 01509054 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-07 21:57 - 2013-10-07 21:57 - 01954124 _____ (Farbar) C:\Users\Andrea\Desktop\FRST64(6).exe
2013-10-07 21:36 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-10-06 19:01 - 2013-10-06 18:49 - 00000000 ____D C:\ProgramData\Oracle
2013-10-06 19:00 - 2013-10-06 19:01 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-10-06 19:00 - 2013-10-06 19:00 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-10-06 19:00 - 2013-10-06 19:00 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-10-06 19:00 - 2013-10-06 19:00 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-10-06 19:00 - 2013-10-06 19:00 - 00000000 ____D C:\Program Files (x86)\Java
2013-10-06 19:00 - 2012-05-12 23:44 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-10-06 19:00 - 2012-01-02 20:43 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-10-06 18:59 - 2013-10-06 18:59 - 00913832 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jxpiinstall(2).exe
2013-10-06 18:52 - 2013-10-06 18:52 - 01095080 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-10-06 18:52 - 2013-10-06 18:52 - 00973736 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-10-06 18:52 - 2013-10-06 18:51 - 30669224 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jre-7u40-windows-x64.exe
2013-10-06 18:44 - 2013-10-06 18:44 - 00913832 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jxpiinstall.exe
2013-10-06 18:44 - 2013-10-06 18:44 - 00913832 _____ (Oracle Corporation) C:\Users\Andrea\Downloads\jxpiinstall(1).exe
2013-10-06 18:32 - 2013-10-06 18:32 - 00000774 _____ C:\Users\Andrea\Desktop\Ereignisse 06.10.2013
2013-10-06 18:32 - 2013-10-06 18:32 - 00000738 _____ C:\Users\Andrea\Desktop\Ereignisse 06.10.2013 II
2013-10-06 18:32 - 2013-10-06 18:32 - 00000678 _____ C:\Users\Andrea\Desktop\Ereignisse 06.10.2013 III
2013-10-06 18:12 - 2012-01-02 23:19 - 00002019 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2013-10-06 02:55 - 2013-10-06 02:55 - 00057208 _____ C:\Users\Andrea\Desktop\FRST 06.10.2013.txt
2013-10-06 02:54 - 2013-10-06 02:54 - 00057208 _____ C:\Users\Andrea\Downloads\FRST.txt
2013-10-06 02:53 - 2013-10-06 02:53 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(5).exe
2013-10-06 02:52 - 2013-09-29 08:20 - 00001066 _____ C:\Users\Andrea\Desktop\checkup.txt
2013-10-06 02:50 - 2013-10-06 02:50 - 00891167 _____ C:\Users\Andrea\Downloads\SecurityCheck(1).exe
2013-10-05 14:32 - 2013-10-05 14:32 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu(1).exe
2013-10-03 22:08 - 2011-12-26 16:59 - 00000000 ____D C:\Users\Andrea\AppData\Local\Mozilla
2013-10-03 16:39 - 2013-10-03 16:39 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-10-03 16:38 - 2013-10-03 16:38 - 01110476 _____ C:\Users\Andrea\Downloads\7z920.exe
2013-10-03 16:28 - 2013-10-03 16:28 - 00056142 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013 2.txt
2013-10-03 16:26 - 2013-10-03 16:26 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(4).exe
2013-10-03 12:55 - 2011-12-25 17:06 - 01529464 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2013-10-03 12:52 - 2013-10-03 12:52 - 00055087 _____ C:\Users\Andrea\Desktop\FRST 03.10.2013.txt
2013-10-03 12:52 - 2013-10-03 12:51 - 01954124 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(3).exe
2013-10-03 12:50 - 2013-10-03 12:50 - 00002701 _____ C:\Users\Andrea\Desktop\JRT 03.10.2013.txt
2013-10-03 12:46 - 2013-10-03 12:46 - 00002701 _____ C:\Users\Andrea\Desktop\JRT.txt
2013-10-03 12:40 - 2013-10-03 12:40 - 01030305 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT(1).exe
2013-10-03 12:37 - 2013-10-03 12:37 - 00006760 _____ C:\Users\Andrea\Desktop\AdwCleaner 03.10.2013.txt
2013-10-03 12:34 - 2013-09-26 20:54 - 00000000 ____D C:\AdwCleaner
2013-10-03 12:29 - 2013-10-03 12:29 - 01045226 _____ C:\Users\Andrea\Downloads\adwcleaner.exe
2013-10-03 12:10 - 2013-09-26 20:38 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-10-03 12:10 - 2013-09-26 20:38 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-10-03 11:58 - 2013-10-03 11:58 - 99014207 _____ C:\Windows\SysWOW64\衸�Ÿ
2013-10-03 11:56 - 2012-12-19 20:57 - 00000336 _____ C:\Windows\Tasks\HPCeeScheduleForAndrea.job
2013-10-02 21:06 - 2012-12-19 20:57 - 00003192 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAndrea
2013-10-02 21:05 - 2012-01-09 21:30 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-10-01 18:59 - 2013-10-01 18:59 - 00055775 _____ C:\Users\Andrea\Desktop\FRST 01.10.2013.txt
2013-09-30 19:54 - 2013-09-30 19:54 - 00055104 _____ C:\Users\Andrea\Desktop\FRST 30.09.2013.txt
2013-09-30 19:53 - 2013-09-30 19:53 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(2).exe
2013-09-30 19:46 - 2013-09-30 19:46 - 00281896 _____ (Mozilla) C:\Users\Andrea\Downloads\Firefox Setup Stub 24.0.exe
2013-09-30 19:38 - 2013-09-30 19:38 - 00001103 _____ C:\Users\Andrea\Desktop\TFC - Verknüpfung.lnk
2013-09-30 19:36 - 2013-09-30 19:36 - 00448512 _____ (OldTimer Tools) C:\Users\Andrea\Downloads\TFC.exe
2013-09-29 19:22 - 2013-09-29 19:22 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse4.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse3.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse2.txt
2013-09-29 19:21 - 2013-09-29 19:21 - 00000624 _____ C:\Users\Andrea\Documents\Ereignisse1.txt
2013-09-29 10:23 - 2013-09-29 10:23 - 00000624 _____ C:\Users\Andrea\Desktop\Ereignisse.txt
2013-09-29 08:26 - 2013-09-29 08:26 - 00054444 _____ C:\Users\Andrea\Desktop\FRST 29.09.2013.txt
2013-09-29 08:24 - 2013-09-29 08:24 - 01953880 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64(1).exe
2013-09-29 08:17 - 2013-09-29 08:17 - 00891144 _____ C:\Users\Andrea\Downloads\SecurityCheck.exe
2013-09-28 23:15 - 2012-01-21 20:05 - 00000000 ____D C:\Users\Andrea\AppData\Local\CrashDumps
2013-09-28 22:43 - 2013-09-28 22:43 - 02347384 _____ (ESET) C:\Users\Andrea\Downloads\esetsmartinstaller_enu.exe
2013-09-28 22:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-09-26 21:19 - 2013-09-26 21:19 - 00053776 _____ C:\Users\Andrea\Desktop\FRST neu.txt
2013-09-26 21:17 - 2013-09-26 21:17 - 01956432 _____ (Farbar) C:\Users\Andrea\Downloads\FRST64.exe
2013-09-26 21:04 - 2013-09-26 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-09-26 21:03 - 2013-09-26 21:03 - 01030038 _____ (Thisisu) C:\Users\Andrea\Downloads\JRT.exe
2013-09-26 21:00 - 2013-09-26 21:00 - 00021293 _____ C:\Users\Andrea\Desktop\AdwCleaner[S0].txt
2013-09-26 20:39 - 2013-09-26 20:39 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Malwarebytes
2013-09-26 20:38 - 2013-09-26 20:38 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-09-26 20:36 - 2013-09-26 20:35 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Andrea\Downloads\mbam-setup-1.75.0.1300.exe
2013-09-25 23:12 - 2013-09-25 23:12 - 00056916 _____ C:\Users\Andrea\Desktop\combofix.txt
2013-09-25 23:11 - 2013-09-25 23:11 - 00056916 _____ C:\ComboFix.txt
2013-09-25 23:11 - 2013-09-25 21:56 - 00000000 ____D C:\Qoobox
2013-09-25 22:57 - 2009-07-14 04:34 - 00000285 _____ C:\Windows\system.ini
2013-09-25 22:28 - 2013-09-25 21:53 - 00000000 ____D C:\Windows\erdnt
2013-09-25 22:27 - 2013-08-22 22:18 - 00000000 ____D C:\Program Files\Avira Secure Backup
2013-09-25 21:50 - 2013-09-25 21:52 - 05130004 ____R (Swearware) C:\Users\Andrea\Desktop\ComboFix.exe
2013-09-25 21:50 - 2013-09-25 21:50 - 05130004 _____ (Swearware) C:\Users\Andrea\Downloads\ComboFix.exe
2013-09-25 21:46 - 2013-09-25 21:46 - 97858179 _____ C:\Windows\SysWOW64\尢뺘
2013-09-24 22:52 - 2013-09-24 22:52 - 00046119 _____ C:\Users\Andrea\Desktop\Addition.txt
2013-09-24 22:52 - 2013-09-24 21:53 - 00046119 _____ C:\Users\Andrea\Downloads\Addition.txt
2013-09-24 22:34 - 2013-09-24 22:34 - 00003804 _____ C:\Users\Andrea\Desktop\Avira.txt
2013-09-24 22:27 - 2013-09-24 22:27 - 00000476 _____ C:\Users\Andrea\Desktop\defogger_disable.txt
2013-09-24 22:14 - 2013-09-24 22:14 - 00001567 _____ C:\Users\Andrea\Desktop\gmer.txt
2013-09-24 21:55 - 2013-09-24 21:55 - 00377856 _____ C:\Users\Andrea\Downloads\gmer_2.1.19163.exe
2013-09-24 21:50 - 2013-09-24 21:50 - 00000474 _____ C:\Users\Andrea\Downloads\defogger_disable.log
2013-09-24 21:49 - 2013-09-24 21:49 - 00000000 _____ C:\Users\Andrea\defogger_reenable
2013-09-24 21:49 - 2011-12-24 18:04 - 00000000 ____D C:\Users\Andrea
2013-09-24 21:45 - 2013-09-24 21:45 - 00050477 _____ C:\Users\Andrea\Downloads\Defogger.exe
2013-09-24 21:41 - 2013-09-24 21:41 - 00029642 _____ C:\Users\Andrea\Scan Avira 24.09.2013 II.txt
2013-09-24 21:37 - 2013-09-24 21:37 - 00003150 _____ C:\Windows\System32\Tasks\{E00E7B9E-E754-46DC-B1E6-C1E48371511B}
2013-09-24 21:33 - 2013-09-24 21:33 - 00028314 _____ C:\Users\Andrea\Scan Avira 24.09.2013.txt
2013-09-24 21:22 - 2012-01-28 13:06 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\MAGIX
2013-09-24 21:22 - 2012-01-28 13:04 - 00000000 ____D C:\ProgramData\MAGIX
2013-09-24 19:46 - 2013-09-23 11:29 - 97540783 _____ C:\Windows\SysWOW64\釤蔳œ
2013-09-24 08:45 - 2013-09-24 08:45 - 00030044 _____ C:\Users\Andrea\Scan Avira 23.09.2013.txt
2013-09-22 22:30 - 2013-09-22 22:30 - 00000000 _____ C:\autoexec.bat
2013-09-22 22:30 - 2013-09-22 22:29 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:16 - 2013-07-08 22:36 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Dropbox
2013-09-22 22:15 - 2013-09-22 22:15 - 00000000 ____D C:\Users\Andrea\AppData\Local\AskPartnerNetwork
2013-09-22 22:13 - 2013-09-21 18:52 - 00000898 _____ C:\Windows\SysWOW64\InstallUtil.InstallLog
2013-09-21 18:52 - 2011-12-24 18:37 - 00000000 ____D C:\Users\Andrea\AppData\Local\Google
2013-09-21 01:05 - 2012-05-02 20:07 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-09-21 01:05 - 2012-05-02 20:07 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-09-21 01:05 - 2011-07-15 22:03 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-09-20 11:46 - 2011-12-31 19:15 - 00018432 _____ C:\Users\Andrea\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-09-20 11:34 - 2013-07-08 23:42 - 00000000 ___RD C:\Users\Andrea\Dropbox
2013-09-16 23:25 - 2012-01-17 23:14 - 00000000 ____D C:\Users\Andrea\Documents\Kreditkarte
2013-09-16 22:45 - 2012-12-02 21:20 - 00003220 _____ C:\Windows\System32\Tasks\HPCeeScheduleForANDREA-HP$
2013-09-16 22:45 - 2012-12-02 21:20 - 00000344 _____ C:\Windows\Tasks\HPCeeScheduleForANDREA-HP$.job
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2013-09-13 18:28 - 2011-12-24 18:13 - 00000000 ___RD C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2013-09-13 13:57 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-09-13 13:19 - 2009-07-14 06:45 - 00430360 _____ C:\Windows\system32\FNTCACHE.DAT
2013-09-13 09:43 - 2011-12-25 17:05 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-09-13 09:42 - 2013-08-19 21:58 - 00000000 ____D C:\Windows\system32\MRT
2013-09-13 09:40 - 2012-01-03 20:37 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 09:40 - 2011-12-31 02:16 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-09-12 10:49 - 2013-09-08 18:12 - 97171315 _____ C:\Windows\SysWOW64\灤౼i

Some content of TEMP:
====================
C:\Users\Andrea\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-10-01 20:14

==================== End Of Log ============================
--- --- ---


Bleibt eigentlich nur noch der SpyHunter, den ich noch nicht losgeworden bin, ansonsten läuft der Rechner wieder gut und der ganze lästige Müll ist verschwunden :-)

Grüße
Lady

schrauber 09.10.2013 08:32
Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.


Lady1 10.10.2013 21:35
Hallo Schrauber,

hier die Fixlog-Datei:

Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
Ran by Andrea at 2013-10-10 22:33:26 Run:2
Running from C:\Users\Andrea\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
S3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [13088 2011-03-02] ()
S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] ()
2013-09-22 22:29 - 2013-09-22 22:30 - 00000000 ____D C:\sh4ldr
2013-09-22 22:29 - 2013-09-22 22:29 - 00002256 _____ C:\Users\Andrea\Desktop\SpyHunter.lnk
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
2013-09-22 22:29 - 2013-09-22 22:29 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-22 22:29 - 2012-06-22 12:01 - 00022704 _____ C:\Windows\system32\Drivers\EsgScanner.sys
       
*****************

esgiguard => Service deleted successfully.
EsgScanner => Service deleted successfully.
C:\sh4ldr => Moved successfully.
C:\Users\Andrea\Desktop\SpyHunter.lnk => Moved successfully.
C:\Users\Andrea\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter => Moved successfully.
C:\Program Files\Enigma Software Group => Moved successfully.
C:\Windows\system32\Drivers\EsgScanner.sys => Moved successfully.

==== End of Fixlog ====
Auf dem Desktop ist der SpyHunter verschwunden, in der Systemsteuerung ist er noch zu finden.
Ansonsten läuft der Rechner auch nach mehrmaligem Hochfahren normal, die ganzen Werbeeinblendungen, Fehlermeldungen etc. sind verschwunden :-)

Gruß
Lady

schrauber 11.10.2013 08:54
Was pasiert wenn du in der sys-steuerung auf deinstallieren klickst?


Alle Zeitangaben in WEZ +1. Es ist jetzt 06:58 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2024, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129