Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   PC Optimizer Pro (https://www.trojaner-board.de/147270-pc-optimizer-pro.html)

boti 03.01.2014 21:28
PC Optimizer Pro
 
Hallo
Ich habe mir leider auch den PC Optimizer Pro "eingefangen".
Habe danach gegoogelt und auch hier im Forum einen Thread bzgl. des Problems gefunden.
Das Forum Mitglied : cosinus , hat einem anderen Betroffenen bei der Beseitigung geholfen.
Ich benutze einen Toshiba Satellite Pro mit Windows 8.
Ich habe den ersten Schritt der Anleitung gemacht und habe das JRT - Junkware Removal Tool
installiert und einen scan damit gemacht.
Den Logfile habe ich auf meinem Desktop.

Kann mir Bitte jemand Weiterhelfen...das wäre echt Spitze.
Schon mal ein dickes : Danke Schön im voraus.

LG boti

Code:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.9 (01.01.2014:1)
OS: Windows 8 x64
Ran by dagobert on 03.01.2014 at 21:09:37,13
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services

Successfully stopped: [Service] addonshelper
Failed to delete: [Service] addonshelper
Successfully stopped: [Service] cltmngsvc
Failed to delete: [Service] cltmngsvc



~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs
Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113}
Successfully repaired: [Registry Value] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-19\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-20\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_USERS\S-1-5-21-3541415397-2149579106-852229368-1001\Software\Microsoft\Internet Explorer\Main\\Start Page
Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\searchURL\\Default



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{562B9316-C08A-444A-9482-62080DD851AE}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{D34F391D-4CB7-467F-A543-F583857C63B0}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\bonanzadealslive.exe
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{118E1BF6-6279-432F-A285-373A77B90C7A}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{14CEEA2F-3D21-46ED-A7D2-89056C520E5E}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{1CC8D970-F626-4F19-815F-890032BB6606}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{33BAF587-9647-4281-A34F-F4830CDC1B9F}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4AA46D49-459F-4358-B4D1-169048547C23}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{5B5E5D0E-7C83-4A32-ADD2-E5F488DD6783}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{6802463D-636F-41FE-9924-4CAD56906590}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{806785D0-375F-4C2C-92E3-B8EE65D28E83}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{944661E7-67B9-4DF7-BFF2-05388C166D34}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{9EA8702C-EEDB-4731-BE68-E9A167DD3597}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{A7CF66EF-4F0D-46B1-AF71-A500378D6C34}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B71934E5-6B93-448D-9D32-CBAA5150C5D8}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{C4BEF720-313C-420A-ACF6-77DD95D8F553}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{D34F391D-4CB7-467F-A543-F583857C63B0}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E970727E-0508-4BEB-8B72-BBA9D0D047C7}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{EBF1F869-D2F0-4D31-A877-386C853A9C3D}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F3CF4912-CF0A-451B-AF3B-C4F216C715E4}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\bonanzadeals
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\bonanzadealslive
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\iminent
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installcore
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\installedbrowserextensions
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\somoto
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\crossrider
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3541415397-2149579106-852229368-1001\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\bonanzadeals
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\bonanzadealslive
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\iminent
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\installcore
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\searchprotect
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealslive.oneclickctrl.9
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealslive.oneclickprocesslaunchermachine
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealslive.oneclickprocesslaunchermachine.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealslive.update3webcontrol.3
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.cocreateasync
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.cocreateasync.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.coreclass
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.coreclass.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.coremachineclass
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.coremachineclass.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.credentialdialogmachine
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.credentialdialogmachine.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.ondemandcomclassmachine
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.ondemandcomclassmachine.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.ondemandcomclassmachinefallback
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.ondemandcomclassmachinefallback.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.ondemandcomclasssvc
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.ondemandcomclasssvc.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.processlauncher
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.processlauncher.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3comclassservice
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3comclassservice.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3webmachine
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3webmachine.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3webmachinefallback
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3webmachinefallback.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3websvc
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bonanzadealsliveupdate.update3websvc.1.0
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C4BEF720-313C-420A-ACF6-77DD95D8F553}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iminent_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\iminent_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\snapdo_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\snapdo_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\bonanza deals
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\filesfrog update checker
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\searchprotect
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\searchthewebarp
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\{d85ffe92-bf14-4e9b-bccd-e5c16069e65f}_is1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0041856.BHO
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0041856.BHO.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0041856.Sandbox
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CrossriderApp0041856.Sandbox.1
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{11111111-1111-1111-1111-110411181156}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{22222222-2222-2222-2222-220422182256}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{44444444-4444-4444-4444-440444184456}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{11111111-1111-1111-1111-110411181156}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{22222222-2222-2222-2222-220422182256}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444184456}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0041856.BHO
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0041856.BHO.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0041856.Sandbox
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\CrossriderApp0041856.Sandbox.1
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\TypeLib\{44444444-4444-4444-4444-440444184456}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110411181156}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110411181156}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{55555555-5555-5555-5555-550455185556}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\Interface\{66666666-6666-6666-6666-660466186656}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Wow6432Node\TypeLib\{44444444-4444-4444-4444-440444184456}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411181156}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}



~~~ Files

Successfully deleted: [File] C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineCore.job
Successfully deleted: [File] C:\windows\Tasks\BonanzaDealsLiveUpdateTaskMachineUA.job



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\babylon"
Successfully deleted: [Folder] "C:\ProgramData\bonanzadealslive"
Successfully deleted: [Folder] "C:\ProgramData\dsearchlink"
Successfully deleted: [Folder] "C:\Users\dagobert\AppData\Roaming\babylon"
Successfully deleted: [Folder] "C:\Users\dagobert\appdata\local\bonanzadealslive"
Successfully deleted: [Folder] "C:\Users\dagobert\appdata\local\filesfrog update checker"
Successfully deleted: [Folder] "C:\Users\dagobert\appdata\local\searchprotect"
Successfully deleted: [Folder] "C:\Program Files (x86)\bonanzadeals"
Successfully deleted: [Folder] "C:\Program Files (x86)\bonanzadealslive"
Successfully deleted: [Folder] "C:\Program Files (x86)\optimizer pro"
Successfully deleted: [Folder] "C:\Program Files (x86)\searchprotect"
Successfully deleted: [Folder] "C:\Users\dagobert\AppData\Roaming\microsoft\windows\start menu\programs\bonanzadeals"
Successfully deleted: [Folder] "C:\Users\dagobert\AppData\Roaming\microsoft\windows\start menu\programs\filesfrog update checker"
Successfully deleted: [Folder] "C:\Users\dagobert\documents\optimizer pro"



~~~ FireFox

Successfully deleted: [File] C:\Users\dagobert\AppData\Roaming\mozilla\firefox\profiles\ufdk0uqw.default\invalidprefs.js
Successfully deleted: [Folder] C:\Users\dagobert\AppData\Roaming\mozilla\firefox\profiles\ufdk0uqw.default\extensions\{5ebdca98-43b3-45bb-87e0-716029fb42ab}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.bdupdater.com/bonanzadealslive update;version=3
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.bdupdater.com/bonanzadealslive update;version=9
Successfully deleted the following from C:\Users\dagobert\AppData\Roaming\mozilla\firefox\profiles\ufdk0uqw.default\prefs.js

user_pref("browser.newtab.url", "hxxp://search.conduit.com/?ctid=CT3317740&octid=EB_ORIGINAL_CTID&SearchSource=69&CUI=&SSPV=&Lay=1&UM=2&UP=SPC2563704-DD91-45AB-9F47-63B60B469F
user_pref("browser.search.defaultenginename", "Conduit Search");
user_pref("browser.search.selectedEngine", "Conduit Search");
user_pref("browser.startup.homepage", "hxxp://search.conduit.com/?ctid=CT3317740&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPC2563704-DD91-45AB-9F47-63B60B469F7A&SSP
user_pref("extensions.helperbar.SmartbarDisabled", false);
user_pref("extensions.helperbar.SmartbarStateMinimaized", false);
user_pref("extensions.helperbar.downloadprovider", "somoto");
user_pref("extensions.helperbar.publisher", "somoto");
user_pref("iminent.LayoutId", "1");
user_pref("iminent.ShowThankyouPixel", "0");
user_pref("iminent.registerToolbarEvent101", "1383250273510");
user_pref("iminent.registerToolbarEvent140", "1383260583806");
user_pref("iminent.version", "7.43.4.1");
user_pref("iminent.versioning", "{\"CurrentVersion\":\"7.43.4.1\",\"InstallEventCTime\":1383091714481,\"InstallEvent\":\"True\"}");
Emptied folder: C:\Users\dagobert\AppData\Roaming\mozilla\firefox\profiles\ufdk0uqw.default\minidumps [8 files]



~~~ Chrome

Successfully deleted: [Folder] C:\Users\dagobert\appdata\local\Google\Chrome\User Data\Default\Extensions\ieadcoanfjloocmfafkebdnfefmohngj



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.01.2014 at 21:17:12,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

aharonov 04.01.2014 01:41
Hallo,

mach bitte einen FRST-Scan:


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


boti 04.01.2014 12:58
Hi

...Super !
Danke für die schnelle Hilfe.
Hier die Beiden Scan Files :

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by dagobert (administrator) on PC on 04-01-2014 12:54:21
Running from C:\Users\dagobert\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(ArtistScope Pty Ltd) C:\Program Files\Common Files\ArtistScope\CSHelper64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
() C:\Users\dagobert\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
() C:\Program Files (x86)\BatBrowse\bin\utilBatBrowse.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe
() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
() C:\Program Files (x86)\BatBrowse\updateBatBrowse.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
() C:\Program Files (x86)\HiSuite\HiSuite.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
() C:\Users\dagobert\AppData\Local\HiSuite\userdata\hwtools\hwtransport.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
() C:\Program Files (x86)\The Geek\AGT Pro - Betfair\AGT Pro.exe
(Maxthon International ltd.) C:\Program Files (x86)\Maxthon\Bin\Maxthon.exe
(Binteko Software) C:\Program Files (x86)\FairBot\FairBot.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2611112 2012-09-04] ()
HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()
HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223242 2012-08-20] ()
HKLM\...\Run: [Ocs_SM] - C:\Users\dagobert\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [106496 2013-10-30] (OCS)
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)
HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7148032 2012-10-31] (Pegatron Corporation)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-12-08] (AVAST Software)
HKLM-x32\...\Run: [mobilegeni daemon] - C:\Program Files (x86)\Mobogenie\DaemonProcess.exe
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Mobile Partner] - C:\Program Files (x86)\HiSuite\HiSuite.exe [583488 2013-07-11] ()
MountPoints2: {7a08f65c-248b-11e3-be78-2cd05a211b8c} - "E:\SETUP.EXE"
MountPoints2: {b0225b53-6424-11e3-be8c-2cd05a211b8c} - "F:\autorun.exe"
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [ ] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKLM - DefaultScope {92A50442-8429-4206-B4B5-D839300467D8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM - {92A50442-8429-4206-B4B5-D839300467D8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM-x32 - DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL =
SearchScopes: HKCU - DefaultScope {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://www.bing.com/search?q={searchTerms}
BHO: LyriXeeker-1 - {11111111-1111-1111-1111-110411181156} - C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-bho64.dll (Lyrics)
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll ()
BHO-x32: BatBrowse - {b67b3dbb-c1c9-49d2-b016-2748b0b5017e} - C:\Program Files (x86)\BatBrowse\BatBrowseBHO.dll (BatBrowse)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)
BHO-x32: BonanzaDeals - {fe063412-bea4-4d76-8ed3-183be6220d17} - C:\Program Files (x86)\BonanzaDeals\BonanzaDealsIE.dll No File
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default
FF Keyword.URL: hxxp://www.google.com/search?rls=org.mozilla:en-US:official&client=firefox-a&q=
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @artistscope.com/DRMPlugin - C:\Program Files (x86)\CopySafe PDF Reader\npArtistScopeDRM.dll ()
FF Plugin-x32: @artistscope.com/PDFReaderWeb - C:\Program Files (x86)\CopySafe PDF Reader\npPDFReaderWeb.dll (ArtistScope Pty Ltd)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @artistscope.com/PDFReaderWeb - C:\Program Files (x86)\CopySafe PDF Reader\npPDFReaderWeb.dll (ArtistScope Pty Ltd)
FF SearchPlugin: C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: FireJump - C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\Extensions\firejump@firejump.net
FF Extension: ProxTube - Unblock YouTube - C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\Extensions\ich@maltegoetz.de
FF Extension: BatBrowse - C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\Extensions\firefox@batbrowse.com.xpi
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF HKLM-x32\...\Firefox\Extensions: [dnshelp@dnshelp.com] - C:\Users\dagobert\AppData\Roaming\Helper
FF Extension: Helper - C:\Users\dagobert\AppData\Roaming\Helper
FF HKCU\...\Firefox\Extensions: [firejump@firejump.net] - C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\extensions\firejump@firejump.net
FF Extension: FireJump - C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\extensions\firejump@firejump.net

Chrome:
=======
CHR HomePage: http:\/\/search.conduit.com\/?ctid=CT3317740&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPC2563704-DD91-45AB-9F47-63B60B469F7A&SSPV=
CHR RestoreOnStartup: "http:\/\/search.conduit.com\/?ctid=CT3317740&octid=EB_ORIGINAL_CTID&SearchSource=55&CUI=&UM=2&UP=SPC2563704-DD91-45AB-9F47-63B60B469F7A&SSPV="
CHR DefaultSearchURL: http:\/\/search.conduit.com\/Results.aspx?ctid=CT3317740&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SPC2563704-DD91-45AB-9F47-63B60B469F7A&q={searchTerms}&SSPV=
CHR Extension: (ProxTube) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_0
CHR Extension: (Google Docs) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (BatBrowse) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccncljhbalbbkkfgopogabimepmfkmff\1.0.0_0
CHR Extension: (Google Search) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (LyriXeeker-1) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig\1.24.10_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\dagobert\AppData\LocalLow\proxtube\CHROME\proxtube.crx
CHR HKLM-x32\...\Chrome\Extension: [ccncljhbalbbkkfgopogabimepmfkmff] - C:\Program Files (x86)\BatBrowse\ccncljhbalbbkkfgopogabimepmfkmff.crx

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-08] (AVAST Software)
R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-06-29] (IvoSoft)
R2 CSHelper; C:\Program Files\Common Files\ArtistScope\CSHelper64.exe [361552 2013-12-12] (ArtistScope Pty Ltd)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()
R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] ()
R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] ()
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
R3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-08-31] (Realtek Semiconductor)
R2 SearchAnonymizer; C:\Users\dagobert\AppData\Roaming\OCS\SM\SearchAnonymizerHelper.exe [40960 2013-10-30] ()
R3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)
R2 Update BatBrowse; C:\Program Files (x86)\BatBrowse\updateBatBrowse.exe [66336 2013-11-07] ()
R2 Util BatBrowse; C:\Program Files (x86)\BatBrowse\bin\utilBatBrowse.exe [66336 2013-11-07] ()
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)
S2 bonanzadealslive; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /svc [x]
S3 bonanzadealslivem; C:\Program Files (x86)\BonanzaDealsLive\Update\BonanzaDealsLive.exe /medsvc [x]

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\windows\system32\drivers\aswFsBlk.sys [38984 2013-12-08] (AVAST Software)
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [84328 2013-12-08] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2013-12-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-08] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1032416 2013-12-08] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [409832 2013-12-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-12-08] ()
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 CSDriver; C:\Program Files\Common Files\ArtistScope\CSDriver64.sys [61424 2013-12-12] ()
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                          )
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                          )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2011-10-24] (Huawei Technologies Co., Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-04 12:53 - 2014-01-04 12:54 - 00029416 _____ C:\Users\dagobert\Desktop\Addition.txt
2014-01-04 12:51 - 2014-01-04 12:54 - 00020415 _____ C:\Users\dagobert\Desktop\FRST.txt
2014-01-04 12:51 - 2014-01-04 12:51 - 00000000 ____D C:\FRST
2014-01-04 12:50 - 2014-01-04 12:50 - 01931368 _____ (Farbar) C:\Users\dagobert\Desktop\FRST64.exe
2014-01-03 21:39 - 2014-01-03 21:39 - 01233962 _____ C:\Users\dagobert\Desktop\adwcleaner.exe
2014-01-03 21:17 - 2014-01-03 21:17 - 00017071 _____ C:\Users\dagobert\Desktop\JRT.txt
2014-01-03 21:08 - 2014-01-03 21:08 - 00000000 ____D C:\windows\ERUNT
2014-01-03 21:02 - 2014-01-03 21:02 - 01036305 _____ (Thisisu) C:\Users\dagobert\Desktop\JRT.exe
2014-01-03 20:54 - 2014-01-03 21:29 - 106000000 _____ C:\Users\dagobert\Downloads\BRRTB_DENUADH_PG.part1.rar
2014-01-02 21:22 - 2014-01-02 21:38 - 48281764 _____ C:\Users\dagobert\Downloads\RTB_M_PG.rar
2014-01-02 17:46 - 2014-01-02 17:46 - 05629632 _____ (IvoSoft) C:\Users\dagobert\Downloads\ClassicShellSetup_4_0_2.exe
2014-01-02 12:01 - 2014-01-02 12:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-02 11:18 - 2014-01-02 11:18 - 00000000 ____D C:\Users\dagobert\Desktop\MyPhoneExplorer portable
2014-01-02 11:15 - 2014-01-02 11:15 - 07080248 _____ C:\Users\dagobert\Downloads\MyPhoneExplorer_1.8.5.exe
2014-01-02 10:51 - 2014-01-02 10:51 - 00001173 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-02 10:51 - 2014-01-02 10:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-01 22:29 - 2014-01-03 21:07 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKennitt - Troubadours On The Rhine (2012)
2014-01-01 22:26 - 2014-01-01 22:26 - 00001732 _____ C:\Users\dagobert\Desktop\dee8bf01883ccfcc31d20370e4879aac.dlc
2014-01-01 21:55 - 2014-01-01 21:55 - 102703242 _____ C:\Users\dagobert\Desktop\Rhein.rar
2013-12-30 18:56 - 2013-12-30 18:56 - 00001171 _____ C:\Users\dagobert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2013-12-30 12:54 - 2013-12-30 12:54 - 00189714 _____ C:\Users\dagobert\Desktop\1by1_181.exe
2013-12-30 12:52 - 2013-12-30 13:07 - 00000000 ____D C:\Users\dagobert\AppData\Local\Mobogenie
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\Documents\Mobogenie
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\cache
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 _____ C:\Users\dagobert\daemonprocess.txt
2013-12-30 12:51 - 2013-12-30 18:54 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-12-30 12:51 - 2013-12-30 12:51 - 00003248 _____ C:\windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-30 12:43 - 2013-12-30 12:43 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKenitt
2013-12-29 21:05 - 2013-12-29 21:05 - 00001873 _____ C:\Users\Public\Desktop\FLAC Frontend.lnk
2013-12-29 21:05 - 2013-12-29 21:05 - 00000000 ____D C:\Program Files (x86)\FLAC
2013-12-27 20:51 - 2013-12-27 20:51 - 02744087 _____ C:\Users\dagobert\Desktop\flac-1.2.1b.exe
2013-12-27 20:47 - 2013-07-13 19:55 - 47718685 ____R C:\Users\dagobert\Downloads\07. Loreena McKennitt - God Rest Ye Merry, Gentlemen (Abdelli Version).flac
2013-12-27 20:47 - 2013-07-13 19:55 - 24117606 ____R C:\Users\dagobert\Downloads\05. Loreena McKennitt - Good King Wenceslas.flac
2013-12-27 20:47 - 2013-07-13 19:55 - 12544244 ____R C:\Users\dagobert\Downloads\06. Loreena McKennitt - Coventry Carol.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 35967651 ____R C:\Users\dagobert\Downloads\04. Loreena McKennitt - Noël Nouvelet !.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 32452407 ____R C:\Users\dagobert\Downloads\08. Loreena McKennitt - Snow.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 30110016 ____R C:\Users\dagobert\Downloads\10. Loreena McKennitt - Seeds Of Love.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 25602457 ____R C:\Users\dagobert\Downloads\12. Loreena McKennitt - Emmanuel.flac
2013-12-27 20:47 - 2013-07-13 19:53 - 16734714 ____R C:\Users\dagobert\Downloads\11. Loreena McKennitt - Gloucestershire Wassail.flac
2013-12-27 20:47 - 2013-07-13 19:52 - 29194831 ____R C:\Users\dagobert\Downloads\03. Loreena McKennitt - The Seven Rejoices Of Mary.flac
2013-12-27 20:47 - 2013-07-13 19:52 - 18437355 ____R C:\Users\dagobert\Downloads\09. Loreena McKennitt - Breton Carol.flac
2013-12-27 20:47 - 2013-07-13 19:51 - 25009882 ____R C:\Users\dagobert\Downloads\01. Loreena McKennitt - The Holly And The Ivy.flac
2013-12-27 20:47 - 2013-07-13 19:49 - 20316857 ____R C:\Users\dagobert\Downloads\02. Loreena McKennitt - Un Flambeau, Jeannette, Isabelle.flac
2013-12-27 20:47 - 2013-07-13 19:49 - 14078965 ____R C:\Users\dagobert\Downloads\13. Loreena McKennitt - In The Bleak Midwinter.flac
2013-12-27 20:47 - 2013-07-13 19:43 - 00006095 ____R C:\Users\dagobert\Downloads\Loreena McKennitt - A Midwinter Night's Dream.log
2013-12-27 20:47 - 2013-07-13 19:43 - 00002707 ____R C:\Users\dagobert\Downloads\A Midwinter Night's Dream.cue
2013-12-27 20:47 - 2013-07-13 19:43 - 00001364 ____R C:\Users\dagobert\Downloads\Loreena McKennitt - A Midwinter Night's Dream.m3u
2013-12-27 20:47 - 2013-07-13 19:43 - 00000000 ____D C:\Users\dagobert\Downloads\Scans
2013-12-27 20:45 - 2013-12-27 20:45 - 00000000 ____D C:\Program Files\7-Zip
2013-12-27 18:15 - 2014-01-02 21:21 - 338124282 _____ C:\Users\dagobert\Downloads\497834093840394.7z
2013-12-27 18:07 - 2013-12-27 18:15 - 23551482 _____ C:\Users\dagobert\Downloads\497834093840394.7z.004
2013-12-26 17:27 - 2013-12-26 18:01 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.003
2013-12-25 21:00 - 2013-12-25 21:34 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.002
2013-12-25 17:03 - 2013-12-25 17:38 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.001
2013-12-25 16:44 - 2014-01-02 22:40 - 00000000 ____D C:\Users\dagobert\Desktop\CD
2013-12-23 16:02 - 2013-12-23 16:02 - 00002786 _____ C:\Users\dagobert\AppData\Local\recently-used.xbel
2013-12-23 16:02 - 2013-12-23 16:02 - 00000000 ____D C:\Users\dagobert\AppData\Local\gtk-2.0
2013-12-23 09:19 - 2013-12-23 09:19 - 00000000 ____D C:\Users\dagobert\.android
2013-12-23 09:18 - 2014-01-02 11:13 - 00000000 ____D C:\Users\dagobert\Documents\HiSuite
2013-12-23 09:18 - 2013-12-23 09:19 - 00000000 ____D C:\Users\dagobert\AppData\Local\HiSuite
2013-12-23 09:18 - 2013-12-23 09:18 - 00001002 _____ C:\Users\Public\Desktop\HiSuite.lnk
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HiSuiteOuc
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HandSetService
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\Program Files (x86)\HiSuite
2013-12-23 09:18 - 2012-02-08 10:07 - 00281088 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\hw_quusbnet.sys
2013-12-23 09:18 - 2011-10-24 05:04 - 00223232 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\hw_quusbmdm.sys
2013-12-23 09:18 - 2011-10-24 04:51 - 00116864 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\hw_usbdev.sys
2013-12-23 09:18 - 2010-02-19 00:00 - 01533512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFUpdate_01007.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01007.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdfCoInstaller01007.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 00708168 _____ (Microsoft Corporation) C:\windows\system32\WinUSBCoInstaller.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 00708168 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WinUSBCoInstaller.dll
2013-12-23 09:15 - 2013-12-23 09:15 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-12-19 13:51 - 2012-04-05 14:44 - 00000000 ____D C:\Users\dagobert\Downloads\Secret Garden
2013-12-19 12:36 - 2013-12-19 13:51 - 451675335 _____ C:\Users\dagobert\Downloads\Secret Garden.part3.rar
2013-12-19 06:21 - 2013-12-19 07:57 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part2.rar
2013-12-19 00:22 - 2013-12-19 00:22 - 00000026 _____ C:\Users\dagobert\AppData\Roaming\WB.CFG
2013-12-18 21:12 - 2013-12-19 00:25 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part1.rar
2013-12-15 11:36 - 2013-12-15 11:36 - 110600192 _____ C:\Users\dagobert\Desktop\ebook 2.camrec
2013-12-15 11:09 - 2013-12-15 11:09 - 47251456 _____ C:\Users\dagobert\Desktop\insidertips ebook.camrec
2013-12-15 11:04 - 2013-12-15 11:04 - 167469056 _____ C:\Users\dagobert\Desktop\insidertips.at.camrec
2013-12-13 19:31 - 2013-12-13 19:31 - 555133442 _____ C:\windows\MEMORY.DMP
2013-12-13 19:31 - 2013-12-13 19:31 - 00424616 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-13 19:31 - 2013-12-13 19:31 - 00285928 _____ C:\windows\Minidump\121313-38265-01.dmp
2013-12-13 19:31 - 2013-12-13 19:31 - 00000000 ____D C:\windows\Minidump
2013-12-13 16:26 - 2013-12-13 16:26 - 08065024 _____ C:\Users\dagobert\Desktop\capture-1.camrec
2013-12-13 14:40 - 2013-12-13 14:40 - 07613196 _____ C:\Users\dagobert\Desktop\104751_Mach_dich_zum_Gewinner_2.enc
2013-12-13 12:54 - 2013-12-13 12:54 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\AVAST Software
2013-12-12 22:03 - 2013-12-12 22:03 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay(1).zip
2013-12-12 22:00 - 2013-12-12 22:00 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay.zip
2013-12-12 21:28 - 2013-12-12 21:28 - 00002022 _____ C:\Users\Public\Desktop\CopySafe PDF Reader.lnk
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\windows\CopySafe PDF Reader
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files\Common Files\ArtistScope
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files (x86)\CopySafe PDF Reader
2013-12-12 21:26 - 2013-12-12 21:26 - 06280128 _____ (ArtistScope) C:\Users\dagobert\Desktop\CopysafePDFreader.exe
2013-12-11 18:34 - 2013-12-11 18:34 - 00000000 ____D C:\Users\dagobert\.thumbnails
2013-12-11 18:30 - 2013-12-23 16:02 - 00000000 ____D C:\Users\dagobert\.gimp-2.8
2013-12-11 18:30 - 2013-12-11 18:30 - 00000000 ____D C:\Users\dagobert\AppData\Local\gegl-0.2
2013-12-11 18:27 - 2013-12-11 18:28 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-11 16:24 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-12-11 16:24 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-12-11 16:24 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2013-12-11 16:24 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-12-11 16:24 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-12-11 16:24 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-11 16:24 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-12-11 16:24 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-12-11 16:24 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-11 16:24 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\imagehlp.dll
2013-12-11 16:24 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\windows\SysWOW64\imagehlp.dll
2013-12-11 16:24 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2013-12-11 16:24 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2013-12-11 16:24 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2013-12-11 16:24 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2013-12-11 16:24 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2013-12-11 16:24 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2013-12-11 16:24 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2013-12-11 16:24 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
2013-12-11 16:24 - 2013-10-03 23:09 - 00385528 _____ C:\windows\system32\ApnDatabase.xml
2013-12-11 16:24 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2013-12-11 16:24 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2013-12-11 16:24 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2013-12-11 16:24 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2013-12-11 16:24 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\resutils.dll
2013-12-11 16:24 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
2013-12-11 16:24 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\windows\SysWOW64\resutils.dll
2013-12-11 16:24 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
2013-12-11 16:23 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-12-11 16:23 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-12-11 16:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-12-11 16:23 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2013-12-11 16:23 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msieftp.dll
2013-12-11 16:23 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\cscript.exe
2013-12-11 16:23 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrobj.dll
2013-12-11 16:23 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrrun.dll
2013-12-11 16:23 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wshom.ocx
2013-12-11 16:23 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\cscript.exe
2013-12-11 16:23 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\windows\system32\scrobj.dll
2013-12-11 16:23 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\windows\system32\scrrun.dll
2013-12-11 16:23 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys

==================== One Month Modified Files and Folders =======

2014-01-04 12:54 - 2014-01-04 12:53 - 00029416 _____ C:\Users\dagobert\Desktop\Addition.txt
2014-01-04 12:54 - 2014-01-04 12:51 - 00020415 _____ C:\Users\dagobert\Desktop\FRST.txt
2014-01-04 12:51 - 2014-01-04 12:51 - 00000000 ____D C:\FRST
2014-01-04 12:50 - 2014-01-04 12:50 - 01931368 _____ (Farbar) C:\Users\dagobert\Desktop\FRST64.exe
2014-01-04 12:45 - 2013-11-17 22:04 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2014-01-04 12:45 - 2013-09-21 03:41 - 01570532 _____ C:\windows\WindowsUpdate.log
2014-01-04 12:37 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru
2014-01-04 12:35 - 2013-09-22 21:22 - 00001308 _____ C:\windows\Tasks\LyriXeeker-1-updater.job
2014-01-04 12:35 - 2013-09-22 21:21 - 00001922 _____ C:\windows\Tasks\LyriXeeker-1-chromeinstaller.job
2014-01-04 12:35 - 2013-09-22 20:17 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-03 21:56 - 2013-09-22 20:43 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\Skype
2014-01-03 21:39 - 2014-01-03 21:39 - 01233962 _____ C:\Users\dagobert\Desktop\adwcleaner.exe
2014-01-03 21:34 - 2013-09-22 20:17 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-03 21:29 - 2014-01-03 20:54 - 106000000 _____ C:\Users\dagobert\Downloads\BRRTB_DENUADH_PG.part1.rar
2014-01-03 21:22 - 2013-10-29 23:22 - 00000306 _____ C:\windows\Tasks\FoxTab.job
2014-01-03 21:17 - 2014-01-03 21:17 - 00017071 _____ C:\Users\dagobert\Desktop\JRT.txt
2014-01-03 21:08 - 2014-01-03 21:08 - 00000000 ____D C:\windows\ERUNT
2014-01-03 21:07 - 2014-01-01 22:29 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKennitt - Troubadours On The Rhine (2012)
2014-01-03 21:02 - 2014-01-03 21:02 - 01036305 _____ (Thisisu) C:\Users\dagobert\Desktop\JRT.exe
2014-01-03 20:06 - 2013-10-05 21:58 - 00000000 ____D C:\Users\dagobert\AppData\Local\PokerStars.EU
2014-01-03 16:50 - 2013-10-09 22:35 - 00000000 ____D C:\Users\dagobert\AppData\Local\CrashDumps
2014-01-03 16:37 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent
2014-01-03 14:43 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\FxsTmp
2014-01-02 22:40 - 2013-12-25 16:44 - 00000000 ____D C:\Users\dagobert\Desktop\CD
2014-01-02 21:38 - 2014-01-02 21:22 - 48281764 _____ C:\Users\dagobert\Downloads\RTB_M_PG.rar
2014-01-02 21:21 - 2013-12-27 18:15 - 338124282 _____ C:\Users\dagobert\Downloads\497834093840394.7z
2014-01-02 17:46 - 2014-01-02 17:46 - 05629632 _____ (IvoSoft) C:\Users\dagobert\Downloads\ClassicShellSetup_4_0_2.exe
2014-01-02 17:46 - 2013-09-23 14:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-02 12:01 - 2014-01-02 12:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-02 11:18 - 2014-01-02 11:18 - 00000000 ____D C:\Users\dagobert\Desktop\MyPhoneExplorer portable
2014-01-02 11:15 - 2014-01-02 11:15 - 07080248 _____ C:\Users\dagobert\Downloads\MyPhoneExplorer_1.8.5.exe
2014-01-02 11:13 - 2013-12-23 09:18 - 00000000 ____D C:\Users\dagobert\Documents\HiSuite
2014-01-02 11:12 - 2012-08-01 17:55 - 00780976 _____ C:\windows\system32\perfh010.dat
2014-01-02 11:12 - 2012-08-01 17:55 - 00152608 _____ C:\windows\system32\perfc010.dat
2014-01-02 11:12 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat
2014-01-02 11:12 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat
2014-01-02 11:12 - 2012-07-26 08:28 - 02679026 _____ C:\windows\system32\PerfStringBackup.INI
2014-01-02 11:02 - 2013-10-21 11:21 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\TeamViewer
2014-01-02 11:00 - 2012-07-26 08:21 - 00030044 _____ C:\windows\setupact.log
2014-01-02 10:51 - 2014-01-02 10:51 - 00001173 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-02 10:51 - 2014-01-02 10:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-01 22:26 - 2014-01-01 22:26 - 00001732 _____ C:\Users\dagobert\Desktop\dee8bf01883ccfcc31d20370e4879aac.dlc
2014-01-01 21:55 - 2014-01-01 21:55 - 102703242 _____ C:\Users\dagobert\Desktop\Rhein.rar
2013-12-30 18:56 - 2013-12-30 18:56 - 00001171 _____ C:\Users\dagobert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2013-12-30 18:54 - 2013-12-30 12:51 - 00000000 ____D C:\Program Files (x86)\Mobogenie
2013-12-30 13:07 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\Mobogenie
2013-12-30 12:54 - 2013-12-30 12:54 - 00189714 _____ C:\Users\dagobert\Desktop\1by1_181.exe
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\Documents\Mobogenie
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\cache
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 _____ C:\Users\dagobert\daemonprocess.txt
2013-12-30 12:52 - 2013-09-21 03:43 - 00000000 ____D C:\Users\dagobert
2013-12-30 12:51 - 2013-12-30 12:51 - 00003248 _____ C:\windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-30 12:43 - 2013-12-30 12:43 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKenitt
2013-12-29 21:05 - 2013-12-29 21:05 - 00001873 _____ C:\Users\Public\Desktop\FLAC Frontend.lnk
2013-12-29 21:05 - 2013-12-29 21:05 - 00000000 ____D C:\Program Files (x86)\FLAC
2013-12-27 20:51 - 2013-12-27 20:51 - 02744087 _____ C:\Users\dagobert\Desktop\flac-1.2.1b.exe
2013-12-27 20:45 - 2013-12-27 20:45 - 00000000 ____D C:\Program Files\7-Zip
2013-12-27 20:41 - 2013-10-29 23:23 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-12-27 18:15 - 2013-12-27 18:07 - 23551482 _____ C:\Users\dagobert\Downloads\497834093840394.7z.004
2013-12-26 21:14 - 2013-10-08 18:13 - 00000000 ____D C:\Users\dagobert\Desktop\Neuer Ordner
2013-12-26 18:01 - 2013-12-26 17:27 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.003
2013-12-25 21:34 - 2013-12-25 21:00 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.002
2013-12-25 17:38 - 2013-12-25 17:03 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.001
2013-12-25 16:46 - 2013-10-04 10:28 - 00000000 ____D C:\Users\dagobert\Desktop\Facebook Bilder
2013-12-25 16:45 - 2013-10-09 10:07 - 00000000 ____D C:\Users\dagobert\Desktop\Arturas
2013-12-23 17:00 - 2013-10-19 19:59 - 00001002 _____ C:\Users\dagobert\Desktop\FairBot.lnk
2013-12-23 17:00 - 2013-10-19 19:59 - 00000000 ____D C:\Program Files (x86)\FairBot
2013-12-23 16:02 - 2013-12-23 16:02 - 00002786 _____ C:\Users\dagobert\AppData\Local\recently-used.xbel
2013-12-23 16:02 - 2013-12-23 16:02 - 00000000 ____D C:\Users\dagobert\AppData\Local\gtk-2.0
2013-12-23 16:02 - 2013-12-11 18:30 - 00000000 ____D C:\Users\dagobert\.gimp-2.8
2013-12-23 09:19 - 2013-12-23 09:19 - 00000000 ____D C:\Users\dagobert\.android
2013-12-23 09:19 - 2013-12-23 09:18 - 00000000 ____D C:\Users\dagobert\AppData\Local\HiSuite
2013-12-23 09:18 - 2013-12-23 09:18 - 00001002 _____ C:\Users\Public\Desktop\HiSuite.lnk
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HiSuiteOuc
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HandSetService
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\Program Files (x86)\HiSuite
2013-12-23 09:15 - 2013-12-23 09:15 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-12-22 21:46 - 2013-11-06 21:46 - 00000000 ____D C:\Users\dagobert\Desktop\Fussi Trades
2013-12-22 21:46 - 2013-10-01 13:03 - 00000000 ____D C:\Users\dagobert\Desktop\tex
2013-12-19 13:51 - 2013-12-19 12:36 - 451675335 _____ C:\Users\dagobert\Downloads\Secret Garden.part3.rar
2013-12-19 12:41 - 2013-09-22 20:43 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-19 12:41 - 2013-09-22 20:42 - 00000000 ____D C:\ProgramData\Skype
2013-12-19 07:57 - 2013-12-19 06:21 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part2.rar
2013-12-19 00:25 - 2013-12-18 21:12 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part1.rar
2013-12-19 00:22 - 2013-12-19 00:22 - 00000026 _____ C:\Users\dagobert\AppData\Roaming\WB.CFG
2013-12-15 18:29 - 2013-10-05 21:58 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2013-12-15 11:36 - 2013-12-15 11:36 - 110600192 _____ C:\Users\dagobert\Desktop\ebook 2.camrec
2013-12-15 11:35 - 2013-10-09 15:12 - 00004096 _____ C:\Users\dagobert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-15 11:09 - 2013-12-15 11:09 - 47251456 _____ C:\Users\dagobert\Desktop\insidertips ebook.camrec
2013-12-15 11:04 - 2013-12-15 11:04 - 167469056 _____ C:\Users\dagobert\Desktop\insidertips.at.camrec
2013-12-14 22:11 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache
2013-12-14 22:00 - 2013-09-22 22:09 - 00000000 ____D C:\windows\system32\MRT
2013-12-14 21:58 - 2013-09-22 22:09 - 90708896 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-12-14 21:23 - 2013-09-23 17:36 - 00004182 _____ C:\windows\System32\Tasks\avast! Emergency Update
2013-12-13 19:31 - 2013-12-13 19:31 - 555133442 _____ C:\windows\MEMORY.DMP
2013-12-13 19:31 - 2013-12-13 19:31 - 00424616 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-13 19:31 - 2013-12-13 19:31 - 00285928 _____ C:\windows\Minidump\121313-38265-01.dmp
2013-12-13 19:31 - 2013-12-13 19:31 - 00000000 ____D C:\windows\Minidump
2013-12-13 19:31 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-12-13 16:26 - 2013-12-13 16:26 - 08065024 _____ C:\Users\dagobert\Desktop\capture-1.camrec
2013-12-13 14:40 - 2013-12-13 14:40 - 07613196 _____ C:\Users\dagobert\Desktop\104751_Mach_dich_zum_Gewinner_2.enc
2013-12-13 12:54 - 2013-12-13 12:54 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\AVAST Software
2013-12-13 12:51 - 2012-11-14 03:05 - 00060180 _____ C:\windows\PFRO.log
2013-12-12 23:16 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI
2013-12-12 23:14 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\SecureBootUpdates
2013-12-12 22:03 - 2013-12-12 22:03 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay(1).zip
2013-12-12 22:00 - 2013-12-12 22:00 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay.zip
2013-12-12 21:28 - 2013-12-12 21:28 - 00002022 _____ C:\Users\Public\Desktop\CopySafe PDF Reader.lnk
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\windows\CopySafe PDF Reader
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files\Common Files\ArtistScope
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files (x86)\CopySafe PDF Reader
2013-12-12 21:26 - 2013-12-12 21:26 - 06280128 _____ (ArtistScope) C:\Users\dagobert\Desktop\CopysafePDFreader.exe
2013-12-11 18:34 - 2013-12-11 18:34 - 00000000 ____D C:\Users\dagobert\.thumbnails
2013-12-11 18:30 - 2013-12-11 18:30 - 00000000 ____D C:\Users\dagobert\AppData\Local\gegl-0.2
2013-12-11 18:28 - 2013-12-11 18:27 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-11 16:29 - 2013-09-23 21:14 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 16:27 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\oobe
2013-12-10 19:45 - 2013-11-17 22:04 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-12-09 10:46 - 2013-09-21 03:50 - 00003598 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3541415397-2149579106-852229368-1001
2013-12-08 19:54 - 2013-09-23 17:36 - 01032416 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00409832 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00334648 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2013-12-08 19:54 - 2013-09-23 17:36 - 00205320 _____ C:\windows\system32\Drivers\aswVmm.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00092544 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00084328 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00065776 _____ C:\windows\system32\Drivers\aswRvrt.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00038984 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys
2013-12-08 19:54 - 2013-09-23 17:34 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2013-12-08 19:52 - 2013-09-23 17:34 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-08 19:51 - 2013-09-23 17:36 - 00000000 _____ C:\windows\SysWOW64\config.nt
2013-12-06 09:16 - 2013-09-24 14:49 - 00000000 ____D C:\Users\dagobert\Desktop\MAG
2013-12-06 07:40 - 2013-09-23 21:14 - 00000000 ____D C:\Users\dagobert\AppData\Local\Microsoft Help
2013-12-06 06:36 - 2013-09-22 20:17 - 00002186 _____ C:\Users\Public\Desktop\Google Chrome.lnk

Some content of TEMP:
====================
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll
C:\Users\dagobert\AppData\Local\Temp\biclient.exe
C:\Users\dagobert\AppData\Local\Temp\fairbot.exe
C:\Users\dagobert\AppData\Local\Temp\flac-1.2.1b.exe
C:\Users\dagobert\AppData\Local\Temp\ICReinstall_ImageEditorSetup.exe
C:\Users\dagobert\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\dagobert\AppData\Local\Temp\Installer_new.exe
C:\Users\dagobert\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\dagobert\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe
C:\Users\dagobert\AppData\Local\Temp\nsfB739.exe
C:\Users\dagobert\AppData\Local\Temp\nslB9DA.exe
C:\Users\dagobert\AppData\Local\Temp\nsoB295.exe
C:\Users\dagobert\AppData\Local\Temp\nsr7B07.exe
C:\Users\dagobert\AppData\Local\Temp\nsx7DE6.exe
C:\Users\dagobert\AppData\Local\Temp\nsz822D.exe
C:\Users\dagobert\AppData\Local\Temp\OptimizerPro.exe
C:\Users\dagobert\AppData\Local\Temp\ose00000.exe
C:\Users\dagobert\AppData\Local\Temp\PokerStarsInstallEU.exe
C:\Users\dagobert\AppData\Local\Temp\SearchProtectINT.exe
C:\Users\dagobert\AppData\Local\Temp\SplashLite_downloader.exe
C:\Users\dagobert\AppData\Local\Temp\splash_lite_setup.exe
C:\Users\dagobert\AppData\Local\Temp\TeamViewer_Setup_de_9.0.24951.exe
C:\Users\dagobert\AppData\Local\Temp\uninst1.exe
C:\Users\dagobert\AppData\Local\Temp\UpdateCheckerSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-28 17:28

==================== End Of Log ============================
--- --- ---


Code:
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-01-2014
Ran by dagobert at 2014-01-04 12:55:02
Running from C:\Users\dagobert\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

==================== Installed Programs ======================

7-Zip 9.20 (x64 edition) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.05) - Deutsch (x32 Version: 11.0.05 - Adobe Systems Incorporated)
AGT Pro - Betfair (x32 Version: 1.2.14 - The Geek)
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
avast! Free Antivirus (x32 Version: 9.0.2008 - Avast Software)
BatBrowse 1.0.0 (Version: 1.0.0 - BatBrowse) <==== ATTENTION
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Betsender (x32 Version:  - Betsender Ltd.)
Bf Bot Manager v2 (x32 Version: 2.0.0 - bfbotmanager.com)
Camtasia Studio 8 (x32 Version: 8.1.2.1327 - TechSmith Corporation)
Canon My Printer (x32 Version: 3.1.0 - Canon Inc.)
CD-LabelPrint (x32 Version:  - )
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Classic Shell (Version: 3.6.8 - IvoSoft)
CopySafe PDF Reader (x32 Version: 3.0.5.3 - ArtistScope)
Desktop Icon für Amazon (Version: 1.0.1 (de) - )
Empress of the Deep - The Darkest Secret (x32 Version: 2.2.0.98 - WildTangent) Hidden
FairBot (x32 Version: 3.4 - Binteko Software)
FLAC 1.2.1b (remove only) (x32 Version: 1.2.1b - Xiph.org)
FlvPlayer (x32 Version: ${VERSION} - )
Foxtab (x32 Version:  - FoxTab) <==== ATTENTION
GIMP 2.8.10 (Version: 2.8.10 - The GIMP Team)
Google Chrome (x32 Version: 31.0.1650.63 - Google Inc.)
Google Earth (x32 Version: 7.1.2.2019 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
HiSuite (x32 Version: 32.610.20.00.06 - Huawei Technologies Co.,Ltd)
Intel AppUp(SM) center (x32 Version: 3.6.1.33268.15 - Intel)
Intel(R) Management Engine Components (x32 Version: 8.1.0.1252 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 9.17.10.3040 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 11.5.2.1001 - Intel Corporation)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (x32 Version: 2.0.0.37149 - Intel Corporation)
Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) Hidden
Island Tribe (x32 Version: 2.2.0.98 - WildTangent) Hidden
Java 7 Update 45 (x32 Version: 7.0.450 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
JDownloader 0.9 (x32 Version: 0.9 - AppWork GmbH)
Jewel Quest Solitaire 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
LyriXeeker-1 (x32 Version: 1.28.153.3 - Lyrics) <==== ATTENTION
Magic Academy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Maxthon Cloud Browser (x32 Version: 4.1.2.4000 - Maxthon International Limited)
McAfee Security Scan Plus (Version: 3.8.130.10 - McAfee, Inc.)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Mozilla Firefox 26.0 (x86 de) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
Nero 12 Essentials Toshiba (x32 Version: 12.0.00600 - Nero AG)
Nero BackItUp (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero BackItUp Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero Blu-ray Player (x32 Version: 12.0.17500 - Nero AG) Hidden
Nero Blu-ray Player Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden
Nero BurnRights (x32 Version: 12.0.5000 - Nero AG) Hidden
Nero BurnRights Help (CHM) (x32 Version: 12.0.5000 - Nero AG) Hidden
Nero ControlCenter (x32 Version: 11.0.15300 - Nero AG) Hidden
Nero ControlCenter Help (CHM) (x32 Version: 12.0.5000 - Nero AG) Hidden
Nero Core Components (x32 Version: 11.0.18200 - Nero AG) Hidden
Nero Express (x32 Version: 12.0.20000 - Nero AG) Hidden
Nero Express Help (CHM) (x32 Version: 12.0.5000 - Nero AG) Hidden
Nero Kwik Media (x32 Version: 1.18.18900 - Nero AG) Hidden
Nero Kwik Media Help (CHM) (x32 Version: 12.0.4000 - Nero AG) Hidden
Nero Kwik Themes Basic (x32 Version: 12.0.11500 - Nero AG) Hidden
Nero Launcher (x32 Version: 12.2.6000 - Nero AG) Hidden
Nero RescueAgent (x32 Version: 12.0.9000 - Nero AG) Hidden
Nero RescueAgent Help (CHM) (x32 Version: 12.0.3000 - Nero AG) Hidden
Nero SharedVideoCodecs (x32 Version: 1.0.12100.2.0 - Nero AG) Hidden
Nero Update (x32 Version: 11.0.11800.31.0 - Nero AG) Hidden
PDF24 Creator 5.7.0 (x32 Version:  - PDF24.org)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
PICkit 2 v2.61 (x32 Version: 2.61.00 - Microchip)
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PokerStars.eu (x32 Version:  - PokerStars.eu)
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Premium Sound HD (Version: 1.12.5000 - SRS Labs, Inc.)
Prerequisite installer (x32 Version: 12.0.0002 - Nero AG) Hidden
Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp)
Realtek Bluetooth Filter Driver Package (x32 Version: 12.24.2012.0802 - REALTEK Semiconductor Corp) Hidden
Realtek Ethernet Controller Driver (x32 Version: 8.3.730.2012 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6738 - Realtek Semiconductor Corp.)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.8400.30136 - Realtek Semiconductor Corp.)
Realtek WLAN Driver (x32 Version: 2.00.0020 - REALTEK Semiconductor Corp.)
SearchAnonymizer (Version: 1.0.1 (de) - )
Secure Eraser (x32 Version: 4.2.0.1 - ASCOMP Software GmbH)
Shared C Run-time for x64 (Version: 10.0.0 - McAfee)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
SopCast 3.8.3 (x32 Version: 3.8.3 - www.sopcast.com)
Synaptics Pointing Device Driver (Version: 16.2.10.5 - Synaptics Incorporated)
TeamViewer 9 (x32 Version: 9.0.24951 - TeamViewer)
TOSHIBA Desktop Assist (Version: 1.00.08.6402 - Toshiba Corporation)
TOSHIBA eco Utility (Version: 2.0.0.6415 - Toshiba Corporation)
TOSHIBA Function Key (Version: 1.00.6626.6406 - Toshiba Corporation)
TOSHIBA Manuals (x32 Version: 10.10 - TOSHIBA)
Toshiba Password Utility (x32 Version: 2.00.972 - Toshiba Corporation)
Toshiba Password Utility (x32 Version: 2.00.972 - Toshiba Corporation) Hidden
TOSHIBA PC Health Monitor (Version: 1.8.17.640104 - Toshiba Corporation)
TOSHIBA Recovery Media Creator (x32 Version: 2.2.1.54043006 - Toshiba Corporation)
TOSHIBA Resolution+ Plug-in for Windows Media Player (x32 Version: 1.2.2.00 - TOSHIBA Corporation)
TOSHIBA Service Station (Version: 2.4.4 - TOSHIBA)
TOSHIBA System Driver (x32 Version: 1.00.0015 - Toshiba Corporation)
TOSHIBA System Settings (x32 Version: 1.00.0002.32002 - Toshiba Corporation)
Toshiba TEMPRO (x32 Version: 4.5.0 - Toshiba Europe GmbH)
TOSHIBA VIDEO PLAYER (Version: 5.1.0.12-A - Toshiba Corporation)
TrueCrypt (x32 Version: 7.1a - TrueCrypt Foundation)
Update for 2007 Microsoft Office System (KB967642) (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office Access 2007 Help (KB963663) (x32 Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (x32 Version:  - Microsoft)
Update for Microsoft Office Infopath 2007 Help (KB963662) (x32 Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (x32 Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (x32 Version:  - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2850085) 32-Bit Edition (x32 Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32 Version:  - Microsoft)
Update for Microsoft Office Publisher 2007 Help (KB963667) (x32 Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (x32 Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (x32 Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
VirtualCloneDrive (x32 Version:  - Elaborate Bytes)
Welcome App (Start-up experience) (x32 Version: 12.0.14000 - Nero AG) Hidden
WildTangent Games (x32 Version: 1.0.3.0 - WildTangent)
WildTangent Games App (Toshiba Games) (x32 Version: 4.0.9.7 - WildTangent) Hidden
Windows Driver Package - Realtek Semiconductor Corp. RtkBtFilter Bluetooth  (07/11/2012 2.3.13.3) (Version: 07/11/2012 2.3.13.3 - Realtek Semiconductor Corp.)
WinRAR 5.00 (64-Bit) (Version: 5.00.0 - win.rar GmbH)

==================== Restore Points  =========================

15-12-2013 18:00:07 Windows-Sicherung
24-12-2013 08:17:46 Geplanter Prüfpunkt
27-12-2013 19:44:14 Installed 7-Zip 9.20 (x64 edition)

==================== Hosts content: ==========================

2012-07-26 06:26 - 2013-10-08 22:26 - 00000917 ____A C:\windows\system32\Drivers\etc\hosts
127.0.0.1          oscount.techsmith.com
127.0.0.1          activation.cloud.techsmith.com


==================== Scheduled Tasks (whitelisted) =============

Task: {03522D2F-BE96-4AB4-897D-387A752D6899} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {04BA285E-61D8-4346-B84B-B42336F63FE5} - System32\Tasks\FoxTab => C:\Users\dagobert\AppData\Roaming\FoxTab\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTION
Task: {0DF7A06C-B0F2-43AC-AA38-2DD225212285} - System32\Tasks\{57BAE7B9-E2AB-4B8B-A0BE-8DDCA21E9AE9} => Iexplore.exe hxxp://ui.skype.com/ui/0/6.7.0.102/de/abandoninstall?page=tsProgressBar
Task: {14B45408-6182-4665-9D9F-EAAB05CB20AE} - System32\Tasks\TOSHIBA\Service Station => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [2012-07-27] (TOSHIBA Corporation)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {291F9454-E408-4132-952D-FEED6647EAAE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-22] (Google Inc.)
Task: {2DDADEF9-69BA-4D50-96C9-8DA5F885FD0D} - System32\Tasks\LyriXeeker-1-updater => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe [2013-09-22] (Lyrics)
Task: {3D73AD2D-83BE-49D1-9973-8D3EEF53349B} - System32\Tasks\SomotoUpdateCheckerAutoStart => C:\Users\dagobert\AppData\Local\FilesFrog Update Checker\update_checker.exe <==== ATTENTION
Task: {46E26CCC-05F8-4763-A8B9-56EE51AAC852} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-08-16] (Synaptics Incorporated)
Task: {476553E5-CB3D-458F-94C3-7D518D8F79D5} - System32\Tasks\Toshiba\CommonNotifier => C:\Program Files (x86)\Toshiba TEMPRO\Toshiba.Tempro.UI.CommonNotifier.exe [2013-07-18] (Toshiba Europe GmbH)
Task: {4F621189-DCEB-43E2-8E7D-9DFE6D4FE739} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-10] (Adobe Systems Incorporated)
Task: {59987F29-E682-49AA-A8C1-60F0E07D6FCD} - System32\Tasks\Maxthon Update => C:\Program Files (x86)\Maxthon\Bin\MxUp.exe [2013-10-09] (Maxthon International ltd.)
Task: {5ABCC407-5950-46C5-8D25-7CF502B3EEA5} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-08] (AVAST Software)
Task: {7D9D22FC-8FDC-4581-AA20-50712F35A489} - System32\Tasks\Microsoft\Windows\Setup\Windows Upgrade Notification Task => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {842E735E-7839-435A-892C-27DB673BFF02} - System32\Tasks\BonanzaDealsUpdate => C:\Program <==== ATTENTION
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AE95DF8B-F1E5-4FC2-BCD6-7BBD0546C99B} - System32\Tasks\LyriXeeker-1-chromeinstaller => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe [2013-09-22] (Lyrics)
Task: {B182B692-DDD6-429E-B324-FC887608E144} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\System32\NotificationUI.exe [2013-08-16] (Microsoft Corporation)
Task: {BF33B041-E4CB-4F76-9FB8-42C4679D738B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-09-22] (Google Inc.)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FoxTab.job => C:\Users\dagobert\AppData\Roaming\FoxTab\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\LyriXeeker-1-chromeinstaller.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-chromeinstaller.exe
Task: C:\windows\Tasks\LyriXeeker-1-updater.job => C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-updater.exe

==================== Loaded Modules (whitelisted) =============

2013-09-29 23:55 - 2012-09-07 15:57 - 00559424 _____ () C:\Program Files (x86)\ASCOMP Software\Secure Eraser\SecEraser64.dll
2012-07-19 03:38 - 2012-07-19 03:38 - 00020904 _____ () C:\Program Files\TOSHIBA\Hotkey\SmoothView.dll
2012-07-19 03:38 - 2012-07-19 03:38 - 00049064 _____ () C:\Program Files\TOSHIBA\Hotkey\Hotkey\FnZ.dll
2012-08-14 04:13 - 2012-08-14 04:13 - 00018344 _____ () C:\Program Files\TOSHIBA\Teco\TecoMUI.dll
2012-08-06 06:36 - 2012-08-06 06:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-01-03 21:18 - 2014-01-03 19:28 - 02152960 _____ () C:\Program Files\AVAST Software\Avast\defs\14010300\algo.dll
2013-10-30 23:56 - 2013-10-30 23:56 - 00337920 _____ () C:\Program Files (x86)\BatBrowse\bin\sqlite3.DLL
2013-02-02 00:40 - 2012-06-25 19:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00634176 _____ () C:\Program Files (x86)\HiSuite\core.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00302912 _____ () C:\Program Files (x86)\HiSuite\sdk.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00017832 _____ () C:\Program Files (x86)\HiSuite\mingwm10.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00049472 _____ () C:\Program Files (x86)\HiSuite\libgcc_s_dw2-1.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 02421568 _____ () C:\Program Files (x86)\HiSuite\QtCore4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 07723328 _____ () C:\Program Files (x86)\HiSuite\QtGui4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 12326208 _____ () C:\Program Files (x86)\HiSuite\QtWebKit4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00911168 _____ () C:\Program Files (x86)\HiSuite\QtNetwork4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00262464 _____ () C:\Program Files (x86)\HiSuite\phonon4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00855872 _____ () C:\Program Files (x86)\HiSuite\Proxy.DLL
2013-07-11 15:47 - 2013-07-11 15:47 - 00764224 _____ () C:\Program Files (x86)\HiSuite\Common.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00535360 _____ () C:\Program Files (x86)\HiSuite\Trace.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00596288 _____ () C:\Program Files (x86)\HiSuite\PluginContainer.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 01475392 _____ () C:\Program Files (x86)\HiSuite\AtComm.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00759616 _____ () C:\Program Files (x86)\HiSuite\AddrBookSrvPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00586560 _____ () C:\Program Files (x86)\HiSuite\CalendarPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00105792 _____ () C:\Program Files (x86)\HiSuite\CryptPlugin.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00751424 _____ () C:\Program Files (x86)\HiSuite\vCardvCalPlugin.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00558400 _____ () C:\Program Files (x86)\HiSuite\XCodec.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00953664 _____ () C:\Program Files (x86)\HiSuite\DeviceAppPlugin.dll
2013-07-11 15:46 - 2013-07-11 15:46 - 00635200 _____ () C:\Program Files (x86)\HiSuite\ADB.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00504640 _____ () C:\Program Files (x86)\HiSuite\OSPowerMgr.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00768832 _____ () C:\Program Files (x86)\HiSuite\XObex.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00070976 _____ () C:\Program Files (x86)\HiSuite\obex.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00613184 _____ () C:\Program Files (x86)\HiSuite\ADBAdapt.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00637760 _____ () C:\Program Files (x86)\HiSuite\OSAdapt.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00108864 _____ () C:\Program Files (x86)\HiSuite\SmsSrvPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00687936 _____ () C:\Program Files (x86)\HiSuite\SmsAppPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00844608 _____ () C:\Program Files (x86)\HiSuite\SyncPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00540480 _____ () C:\Program Files (x86)\HiSuite\APKManagerPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00572736 _____ () C:\Program Files (x86)\HiSuite\MusicPlaySrvPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00551744 _____ () C:\Program Files (x86)\HiSuite\ImageMgrSrvPlugin.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00089408 _____ () C:\Program Files (x86)\HiSuite\plugins\imageformats\qgif4.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00088384 _____ () C:\Program Files (x86)\HiSuite\plugins\imageformats\qico4.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00198464 _____ () C:\Program Files (x86)\HiSuite\plugins\imageformats\qjpeg4.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00357184 _____ () C:\Program Files (x86)\HiSuite\plugins\imageformats\qmng4.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00078656 _____ () C:\Program Files (x86)\HiSuite\plugins\imageformats\qsvg4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00305984 _____ () C:\Program Files (x86)\HiSuite\QtSvg4.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00376640 _____ () C:\Program Files (x86)\HiSuite\plugins\imageformats\qtiff4.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00253248 _____ () C:\Program Files (x86)\HiSuite\XFramePlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00332096 _____ () C:\Program Files (x86)\HiSuite\QtXml4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00222016 _____ () C:\Program Files (x86)\HiSuite\QtSql4.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00147264 _____ () C:\Program Files (x86)\HiSuite\StatusBarMgrPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 01233216 _____ () C:\Program Files (x86)\HiSuite\AddrBookUIPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00208704 _____ () C:\Program Files (x86)\HiSuite\SettingUIPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00170304 _____ () C:\Program Files (x86)\HiSuite\RelationPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 01483072 _____ () C:\Program Files (x86)\HiSuite\SMSUIPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00598336 _____ () C:\Program Files (x86)\HiSuite\CalendarUIPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00273216 _____ () C:\Program Files (x86)\HiSuite\TaskUIPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00222528 _____ () C:\Program Files (x86)\HiSuite\DownLoadPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00106816 _____ () C:\Program Files (x86)\HiSuite\NotifyServicePlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 01455936 _____ () C:\Program Files (x86)\HiSuite\ImExportUIPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00159040 _____ () C:\Program Files (x86)\HiSuite\GmailOperation.DLL
2013-07-11 15:48 - 2013-07-11 15:48 - 00993600 _____ () C:\Program Files (x86)\HiSuite\libxml2.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00084288 _____ () C:\Program Files (x86)\HiSuite\zlib1.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00211264 _____ () C:\Program Files (x86)\HiSuite\Outlook.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00137536 _____ () C:\Program Files (x86)\HiSuite\OutlookExpress.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00119616 _____ () C:\Program Files (x86)\HiSuite\LayoutPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00227136 _____ () C:\Program Files (x86)\HiSuite\ModuleTreePlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00274752 _____ () C:\Program Files (x86)\HiSuite\HomeUIPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00897344 _____ () C:\Program Files (x86)\HiSuite\AppManagerUIPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 01560896 _____ () C:\Program Files (x86)\HiSuite\QtScript4.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 01182528 _____ () C:\Program Files (x86)\HiSuite\MusicMgrUIPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00713024 _____ () C:\Program Files (x86)\HiSuite\ImageMgrUIPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00239424 _____ () C:\Program Files (x86)\HiSuite\ScreenShotUIPlugin.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 02308928 _____ () C:\Program Files (x86)\HiSuite\UpdateUIPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00087360 _____ () C:\Program Files (x86)\HiSuite\HWEMUIEditToolsUIPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00083264 _____ () C:\Program Files (x86)\HiSuite\LogoPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 00916288 _____ () C:\Program Files (x86)\HiSuite\DeviceMgrUIPlugin.dll
2013-07-11 15:49 - 2013-07-11 15:49 - 00552768 _____ () C:\Program Files (x86)\HiSuite\SyncUIPlugin.dll
2013-07-11 15:47 - 2013-07-11 15:47 - 02282304 _____ () C:\Program Files (x86)\HiSuite\BackUpUIPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00203584 _____ () C:\Program Files (x86)\HiSuite\MenuMgrPlugin.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00364864 _____ () C:\Program Files (x86)\HiSuite\WebKitUIPlugin.dll
2013-07-11 15:48 - 2013-07-11 15:48 - 00171328 _____ () C:\Program Files (x86)\HiSuite\KuwoWebUIPlugin.dll
2013-07-11 15:50 - 2013-07-11 15:50 - 00832320 _____ () C:\Program Files (x86)\HiSuite\UpdateSrvPlugin.dll
2013-12-08 19:54 - 2013-12-08 19:54 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2013-09-23 16:30 - 2013-07-12 01:30 - 00258944 _____ () C:\Program Files (x86)\Maxthon\bin\Maxzlib.dll
2013-09-23 16:30 - 2013-07-12 01:30 - 00258944 _____ () C:\Program Files (x86)\Maxthon\Bin\maxzlib.dll
2013-09-23 16:30 - 2013-08-01 10:18 - 00232760 _____ () C:\Program Files (x86)\Maxthon\Addons\Mobile\MxMobile.dll
2013-09-23 16:30 - 2013-08-09 01:36 - 00755000 _____ () C:\Program Files (x86)\Maxthon\Core\Webkit\libglesv2.dll
2013-09-23 16:30 - 2013-08-09 01:36 - 00149304 _____ () C:\Program Files (x86)\Maxthon\Core\Webkit\libegl.dll
2013-09-23 16:30 - 2013-08-13 10:15 - 14586736 _____ () C:\Program Files (x86)\Maxthon\Core\Webkit\Npplugins\NPSWF32.dll
2013-09-21 12:00 - 2013-09-21 12:00 - 00295424 _____ () C:\Program Files (x86)\The Geek\AGT Pro - Betfair\Charts.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcpltsvc => ""=""
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mcpltsvc => ""=""

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-12-15 21:12:20.153
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\Common Files\ArtistScope\CSInstru64.dll because the set of per-page image hashes could not be found on the system.

  Date: 2013-12-15 20:57:59.545
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Program Files\Common Files\ArtistScope\CSInstru64.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Percentage of memory in use: 79%
Total physical RAM: 3979.21 MB
Available physical RAM: 806.57 MB
Total Pagefile: 8075.21 MB
Available Pagefile: 3737.12 MB
Total Virtual: 8192 MB
Available Virtual: 8191.76 MB

==================== Drives ================================

Drive c: (TI31018700A) (Fixed) (Total:287.24 GB) (Free:216.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 00000000)

Partition: GPT Partition Type
==================== End Of Log ============================

aharonov 04.01.2014 14:25
Ok.


Schritt 1
  • Gehe in die Systemsteuerung und öffne Programme und Funktionen.
  • Suche und deinstalliere dort der Reihe nach folgende Einträge:
    BatBrowse 1.0.0
    Foxtab
    LyriXeeker-1
    SearchAnonymizer
  • Schliesse das Fenster wieder und führe einen Neustart durch, wenn das gefordert wurde.



Schritt 2

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



Schritt 3

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.



Bitte poste in deiner nächsten Antwort:
  • Log von AdwCleaner
  • Log von FRST

boti 04.01.2014 19:10
Hallo Leo

ich habe soweit deine Anleitung befolgt, habe alles Deinstalliert ausser : LyriXeeker-1
Das lässt sich nicht Deinstallieren?

Danke Dir für deine Hilfe.

LG boti


FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-01-2014
Ran by dagobert (administrator) on PC on 04-01-2014 18:23:37
Running from C:\Users\dagobert\Desktop
Windows 8 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(IvoSoft) C:\Program Files\Classic Shell\ClassicShellService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(IvoSoft) C:\Program Files\Classic Shell\ClassicStartMenu.exe
() C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(ArtistScope Pty Ltd) C:\Program Files\Common Files\ArtistScope\CSHelper64.exe
() C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe
() C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
() C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Teco\TecoResident.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdcBase.exe
() C:\Program Files (x86)\HiSuite\HiSuite.exe
(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
() C:\Users\dagobert\AppData\Local\HiSuite\userdata\hwtools\hwtransport.exe
(Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.2.9200.16683_none_62280e15510f8e79\TiWorker.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] - [x]
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13196432 2012-09-25] (Realtek Semiconductor)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2611112 2012-09-04] ()
HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-05] ()
HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe [169896 2012-08-14] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [356776 2012-07-11] (TOSHIBA Corporation)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRS_Premium_Sound_HD.zip [223242 2012-08-20] ()
HKLM\...\Run: [Windows Mobile-based device management] - C:\Windows\WindowsMobile\wmdcBase.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [Intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-08-01] (Intel Corporation)
HKLM-x32\...\Run: [TPUReg] - C:\Program Files (x86)\TOSHIBA\Password Utility\TosPU.exe [7148032 2012-10-31] (Pegatron Corporation)
HKLM-x32\...\Run: [VirtualCloneDrive] - C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [PDFPrint] - C:\Program Files (x86)\PDF24\pdf24.exe [162856 2013-07-22] (Geek Software GmbH)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-09-05] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3568312 2013-12-08] (AVAST Software)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [Mobile Partner] - C:\Program Files (x86)\HiSuite\HiSuite.exe [583488 2013-07-11] ()
MountPoints2: {7a08f65c-248b-11e3-be78-2cd05a211b8c} - "E:\SETUP.EXE"
MountPoints2: {b0225b53-6424-11e3-be8c-2cd05a211b8c} - "F:\autorun.exe"
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [ ] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.bing.com/search?q={searchTerms}
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.bing.com/search?q={searchTerms}
SearchScopes: HKLM - DefaultScope {92A50442-8429-4206-B4B5-D839300467D8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
SearchScopes: HKLM - {92A50442-8429-4206-B4B5-D839300467D8} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATMJS
BHO: LyriXeeker-1 - {11111111-1111-1111-1111-110411181156} - C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-bho64.dll No File
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
BHO: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_64.dll (IvoSoft)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: ExplorerBHO Class - {449D0D6E-2412-4E61-B68F-1CB625CD9E52} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: DNS Error Helper - {9B6B03F1-16CF-4491-BBBB-E872802DD717} - C:\ProgramData\DNSErrorHelper\bho.dll No File
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: ClassicIE9BHO Class - {EA801577-E6AD-4BD5-8F71-4BE0154331A4} - C:\Program Files\Classic Shell\ClassicIE9DLL_32.dll (IvoSoft)
Toolbar: HKLM - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer64.dll (IvoSoft)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Classic Explorer Bar - {553891B7-A0D5-4526-BE18-D3CE461D6310} - C:\Program Files\Classic Shell\ClassicExplorer32.dll (IvoSoft)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @artistscope.com/DRMPlugin - C:\Program Files (x86)\CopySafe PDF Reader\npArtistScopeDRM.dll ()
FF Plugin-x32: @artistscope.com/PDFReaderWeb - C:\Program Files (x86)\CopySafe PDF Reader\npPDFReaderWeb.dll (ArtistScope Pty Ltd)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.45.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @Nero.com/KM - C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @artistscope.com/PDFReaderWeb - C:\Program Files (x86)\CopySafe PDF Reader\npPDFReaderWeb.dll (ArtistScope Pty Ltd)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: ProxTube - Unblock YouTube - C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\Extensions\ich@maltegoetz.de
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF

Chrome:
=======
CHR Extension: (ProxTube) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aakchaleigkohafkfjfjbblobjifikek\1.1.0_0
CHR Extension: (Google Docs) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (Gmail) - C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [aakchaleigkohafkfjfjbblobjifikek] - C:\Users\dagobert\AppData\LocalLow\proxtube\CHROME\proxtube.crx

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-08] (AVAST Software)
R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-06-29] (IvoSoft)
R2 CSHelper; C:\Program Files\Common Files\ArtistScope\CSHelper64.exe [361552 2013-12-12] (ArtistScope Pty Ltd)
R2 GFNEXSrv; C:\Program Files (x86)\TOSHIBA\Password Utility\GFNEXSrv.exe [156672 2011-10-13] ()
R2 HiSuiteOuc64.exe; C:\ProgramData\HiSuiteOuc\HiSuiteOuc64.exe [137024 2013-07-11] ()
R2 HuaweiHiSuiteService64.exe; C:\ProgramData\HandSetService\HuaweiHiSuiteService64.exe [197632 2013-05-02] ()
S2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [288776 2013-09-06] (McAfee, Inc.)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [201360 2012-08-31] (Realtek Semiconductor)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [116088 2013-07-18] (Toshiba Europe GmbH)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-07-02] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 aswFsBlk; C:\windows\system32\drivers\aswFsBlk.sys [38984 2013-12-08] (AVAST Software)
R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [84328 2013-12-08] (AVAST Software)
R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2013-12-08] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2013-12-08] ()
R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1032416 2013-12-08] (AVAST Software)
R1 aswSP; C:\windows\system32\drivers\aswSP.sys [409832 2013-12-08] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [205320 2013-12-08] ()
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R1 CSDriver; C:\Program Files\Common Files\ArtistScope\CSDriver64.sys [61424 2013-12-12] ()
R2 PEGAGFN; C:\Program Files (x86)\TOSHIBA\Password Utility\PEGAGFN.sys [14344 2009-09-11] (PEGATRON)
R3 RtkBtFilter; C:\Windows\system32\DRIVERS\RtkBtfilter.sys [24208 2012-07-11] (Realtek Microelectronics)
S3 RTL8192Ce; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                          )
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [1498256 2012-08-29] (Realtek Semiconductor Corporation                          )
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [43832 2012-08-16] (Synaptics Incorporated)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [28632 2012-07-31] (Windows (R) Win 7 DDK provider)
U5 hw_usbdev; C:\Windows\System32\Drivers\hw_usbdev.sys [116864 2011-10-24] (Huawei Technologies Co., Ltd.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-01-04 18:23 - 2014-01-04 18:23 - 00015848 _____ C:\Users\dagobert\Desktop\FRST.txt
2014-01-04 18:11 - 2014-01-04 18:18 - 00000000 ____D C:\AdwCleaner
2014-01-04 16:50 - 2014-01-04 16:50 - 00000000 ____D C:\windows\system32\IO
2014-01-04 16:49 - 2014-01-04 16:49 - 00003136 _____ C:\windows\System32\Tasks\{F8D0D227-1CE3-4729-880C-88C727E51CB3}
2014-01-04 16:43 - 2014-01-04 16:43 - 01233962 _____ C:\Users\dagobert\Desktop\adwcleaner(1).exe
2014-01-04 12:51 - 2014-01-04 12:51 - 00000000 ____D C:\FRST
2014-01-04 12:50 - 2014-01-04 12:50 - 01931368 _____ (Farbar) C:\Users\dagobert\Desktop\FRST64.exe
2014-01-03 21:39 - 2014-01-03 21:39 - 01233962 _____ C:\Users\dagobert\Desktop\adwcleaner.exe
2014-01-03 21:17 - 2014-01-03 21:17 - 00017071 _____ C:\Users\dagobert\Desktop\JRT.txt
2014-01-03 21:08 - 2014-01-03 21:08 - 00000000 ____D C:\windows\ERUNT
2014-01-03 21:02 - 2014-01-03 21:02 - 01036305 _____ (Thisisu) C:\Users\dagobert\Desktop\JRT.exe
2014-01-03 20:54 - 2014-01-03 21:29 - 106000000 _____ C:\Users\dagobert\Downloads\BRRTB_DENUADH_PG.part1.rar
2014-01-02 21:22 - 2014-01-02 21:38 - 48281764 _____ C:\Users\dagobert\Downloads\RTB_M_PG.rar
2014-01-02 17:46 - 2014-01-02 17:46 - 05629632 _____ (IvoSoft) C:\Users\dagobert\Downloads\ClassicShellSetup_4_0_2.exe
2014-01-02 12:01 - 2014-01-02 12:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-02 11:18 - 2014-01-02 11:18 - 00000000 ____D C:\Users\dagobert\Desktop\MyPhoneExplorer portable
2014-01-02 11:15 - 2014-01-02 11:15 - 07080248 _____ C:\Users\dagobert\Downloads\MyPhoneExplorer_1.8.5.exe
2014-01-02 10:51 - 2014-01-02 10:51 - 00001173 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-02 10:51 - 2014-01-02 10:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-01 22:29 - 2014-01-03 21:07 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKennitt - Troubadours On The Rhine (2012)
2014-01-01 22:26 - 2014-01-01 22:26 - 00001732 _____ C:\Users\dagobert\Desktop\dee8bf01883ccfcc31d20370e4879aac.dlc
2014-01-01 21:55 - 2014-01-01 21:55 - 102703242 _____ C:\Users\dagobert\Desktop\Rhein.rar
2013-12-30 18:56 - 2013-12-30 18:56 - 00001171 _____ C:\Users\dagobert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2013-12-30 12:54 - 2013-12-30 12:54 - 00189714 _____ C:\Users\dagobert\Desktop\1by1_181.exe
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\cache
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 _____ C:\Users\dagobert\daemonprocess.txt
2013-12-30 12:51 - 2013-12-30 12:51 - 00003248 _____ C:\windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-30 12:43 - 2013-12-30 12:43 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKenitt
2013-12-29 21:05 - 2013-12-29 21:05 - 00001873 _____ C:\Users\Public\Desktop\FLAC Frontend.lnk
2013-12-29 21:05 - 2013-12-29 21:05 - 00000000 ____D C:\Program Files (x86)\FLAC
2013-12-27 20:51 - 2013-12-27 20:51 - 02744087 _____ C:\Users\dagobert\Desktop\flac-1.2.1b.exe
2013-12-27 20:47 - 2013-07-13 19:55 - 47718685 ____R C:\Users\dagobert\Downloads\07. Loreena McKennitt - God Rest Ye Merry, Gentlemen (Abdelli Version).flac
2013-12-27 20:47 - 2013-07-13 19:55 - 24117606 ____R C:\Users\dagobert\Downloads\05. Loreena McKennitt - Good King Wenceslas.flac
2013-12-27 20:47 - 2013-07-13 19:55 - 12544244 ____R C:\Users\dagobert\Downloads\06. Loreena McKennitt - Coventry Carol.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 35967651 ____R C:\Users\dagobert\Downloads\04. Loreena McKennitt - Noël Nouvelet !.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 32452407 ____R C:\Users\dagobert\Downloads\08. Loreena McKennitt - Snow.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 30110016 ____R C:\Users\dagobert\Downloads\10. Loreena McKennitt - Seeds Of Love.flac
2013-12-27 20:47 - 2013-07-13 19:54 - 25602457 ____R C:\Users\dagobert\Downloads\12. Loreena McKennitt - Emmanuel.flac
2013-12-27 20:47 - 2013-07-13 19:53 - 16734714 ____R C:\Users\dagobert\Downloads\11. Loreena McKennitt - Gloucestershire Wassail.flac
2013-12-27 20:47 - 2013-07-13 19:52 - 29194831 ____R C:\Users\dagobert\Downloads\03. Loreena McKennitt - The Seven Rejoices Of Mary.flac
2013-12-27 20:47 - 2013-07-13 19:52 - 18437355 ____R C:\Users\dagobert\Downloads\09. Loreena McKennitt - Breton Carol.flac
2013-12-27 20:47 - 2013-07-13 19:51 - 25009882 ____R C:\Users\dagobert\Downloads\01. Loreena McKennitt - The Holly And The Ivy.flac
2013-12-27 20:47 - 2013-07-13 19:49 - 20316857 ____R C:\Users\dagobert\Downloads\02. Loreena McKennitt - Un Flambeau, Jeannette, Isabelle.flac
2013-12-27 20:47 - 2013-07-13 19:49 - 14078965 ____R C:\Users\dagobert\Downloads\13. Loreena McKennitt - In The Bleak Midwinter.flac
2013-12-27 20:47 - 2013-07-13 19:43 - 00006095 ____R C:\Users\dagobert\Downloads\Loreena McKennitt - A Midwinter Night's Dream.log
2013-12-27 20:47 - 2013-07-13 19:43 - 00002707 ____R C:\Users\dagobert\Downloads\A Midwinter Night's Dream.cue
2013-12-27 20:47 - 2013-07-13 19:43 - 00001364 ____R C:\Users\dagobert\Downloads\Loreena McKennitt - A Midwinter Night's Dream.m3u
2013-12-27 20:47 - 2013-07-13 19:43 - 00000000 ____D C:\Users\dagobert\Downloads\Scans
2013-12-27 20:45 - 2013-12-27 20:45 - 00000000 ____D C:\Program Files\7-Zip
2013-12-27 18:15 - 2014-01-02 21:21 - 338124282 _____ C:\Users\dagobert\Downloads\497834093840394.7z
2013-12-27 18:07 - 2013-12-27 18:15 - 23551482 _____ C:\Users\dagobert\Downloads\497834093840394.7z.004
2013-12-26 17:27 - 2013-12-26 18:01 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.003
2013-12-25 21:00 - 2013-12-25 21:34 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.002
2013-12-25 17:03 - 2013-12-25 17:38 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.001
2013-12-25 16:44 - 2014-01-02 22:40 - 00000000 ____D C:\Users\dagobert\Desktop\CD
2013-12-23 16:02 - 2013-12-23 16:02 - 00002786 _____ C:\Users\dagobert\AppData\Local\recently-used.xbel
2013-12-23 16:02 - 2013-12-23 16:02 - 00000000 ____D C:\Users\dagobert\AppData\Local\gtk-2.0
2013-12-23 09:19 - 2013-12-23 09:19 - 00000000 ____D C:\Users\dagobert\.android
2013-12-23 09:18 - 2014-01-02 11:13 - 00000000 ____D C:\Users\dagobert\Documents\HiSuite
2013-12-23 09:18 - 2013-12-23 09:19 - 00000000 ____D C:\Users\dagobert\AppData\Local\HiSuite
2013-12-23 09:18 - 2013-12-23 09:18 - 00001002 _____ C:\Users\Public\Desktop\HiSuite.lnk
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HiSuiteOuc
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HandSetService
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\Program Files (x86)\HiSuite
2013-12-23 09:18 - 2012-02-08 10:07 - 00281088 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\hw_quusbnet.sys
2013-12-23 09:18 - 2011-10-24 05:04 - 00223232 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\hw_quusbmdm.sys
2013-12-23 09:18 - 2011-10-24 04:51 - 00116864 _____ (Huawei Technologies Co., Ltd.) C:\windows\system32\Drivers\hw_usbdev.sys
2013-12-23 09:18 - 2010-02-19 00:00 - 01533512 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WUDFUpdate_01007.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\WdfCoInstaller01007.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 01490656 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WdfCoInstaller01007.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 00708168 _____ (Microsoft Corporation) C:\windows\system32\WinUSBCoInstaller.dll
2013-12-23 09:18 - 2010-02-19 00:00 - 00708168 _____ (Microsoft Corporation) C:\windows\system32\Drivers\WinUSBCoInstaller.dll
2013-12-23 09:15 - 2013-12-23 09:15 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-12-19 13:51 - 2012-04-05 14:44 - 00000000 ____D C:\Users\dagobert\Downloads\Secret Garden
2013-12-19 12:36 - 2013-12-19 13:51 - 451675335 _____ C:\Users\dagobert\Downloads\Secret Garden.part3.rar
2013-12-19 06:21 - 2013-12-19 07:57 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part2.rar
2013-12-19 00:22 - 2014-01-04 13:22 - 00000072 _____ C:\Users\dagobert\AppData\Roaming\WB.CFG
2013-12-18 21:12 - 2013-12-19 00:25 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part1.rar
2013-12-15 11:36 - 2013-12-15 11:36 - 110600192 _____ C:\Users\dagobert\Desktop\ebook 2.camrec
2013-12-15 11:09 - 2013-12-15 11:09 - 47251456 _____ C:\Users\dagobert\Desktop\insidertips ebook.camrec
2013-12-15 11:04 - 2013-12-15 11:04 - 167469056 _____ C:\Users\dagobert\Desktop\insidertips.at.camrec
2013-12-13 19:31 - 2014-01-04 18:20 - 00424640 _____ C:\windows\system32\FNTCACHE.DAT
2013-12-13 19:31 - 2013-12-13 19:31 - 555133442 _____ C:\windows\MEMORY.DMP
2013-12-13 19:31 - 2013-12-13 19:31 - 00285928 _____ C:\windows\Minidump\121313-38265-01.dmp
2013-12-13 19:31 - 2013-12-13 19:31 - 00000000 ____D C:\windows\Minidump
2013-12-13 16:26 - 2013-12-13 16:26 - 08065024 _____ C:\Users\dagobert\Desktop\capture-1.camrec
2013-12-13 14:40 - 2013-12-13 14:40 - 07613196 _____ C:\Users\dagobert\Desktop\104751_Mach_dich_zum_Gewinner_2.enc
2013-12-13 12:54 - 2013-12-13 12:54 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\AVAST Software
2013-12-12 22:03 - 2013-12-12 22:03 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay(1).zip
2013-12-12 22:00 - 2013-12-12 22:00 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay.zip
2013-12-12 21:28 - 2013-12-12 21:28 - 00002022 _____ C:\Users\Public\Desktop\CopySafe PDF Reader.lnk
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\windows\CopySafe PDF Reader
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files\Common Files\ArtistScope
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files (x86)\CopySafe PDF Reader
2013-12-12 21:26 - 2013-12-12 21:26 - 06280128 _____ (ArtistScope) C:\Users\dagobert\Desktop\CopysafePDFreader.exe
2013-12-11 18:34 - 2013-12-11 18:34 - 00000000 ____D C:\Users\dagobert\.thumbnails
2013-12-11 18:30 - 2013-12-23 16:02 - 00000000 ____D C:\Users\dagobert\.gimp-2.8
2013-12-11 18:30 - 2013-12-11 18:30 - 00000000 ____D C:\Users\dagobert\AppData\Local\gegl-0.2
2013-12-11 18:27 - 2013-12-11 18:28 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-11 16:24 - 2013-10-25 07:19 - 02241536 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-12-11 16:24 - 2013-10-25 07:19 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-12-11 16:24 - 2013-10-25 07:19 - 00915968 _____ (Microsoft Corporation) C:\windows\system32\uxtheme.dll
2013-12-11 16:24 - 2013-10-25 07:19 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-12-11 16:24 - 2013-10-25 07:18 - 19271168 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-12-11 16:24 - 2013-10-25 07:18 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 03959808 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-12-11 16:24 - 2013-10-25 07:17 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-12-11 16:24 - 2013-10-25 05:45 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-12-11 16:24 - 2013-10-25 05:44 - 14356992 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-12-11 16:24 - 2013-10-25 05:44 - 01140736 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 13761536 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 02877952 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 02049024 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-12-11 16:24 - 2013-10-25 05:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-12-11 16:24 - 2013-10-19 06:45 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\imagehlp.dll
2013-12-11 16:24 - 2013-10-19 05:04 - 00059392 _____ (Microsoft Corporation) C:\windows\SysWOW64\imagehlp.dll
2013-12-11 16:24 - 2013-10-09 02:33 - 00059416 _____ (Microsoft Corporation) C:\windows\system32\wuauclt.exe
2013-12-11 16:24 - 2013-10-08 23:30 - 00628736 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapi.dll
2013-12-11 16:24 - 2013-10-08 23:30 - 00126976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuwebv.dll
2013-12-11 16:24 - 2013-10-08 23:30 - 00084992 _____ (Microsoft Corporation) C:\windows\SysWOW64\wudriver.dll
2013-12-11 16:24 - 2013-10-08 23:30 - 00035328 _____ (Microsoft Corporation) C:\windows\SysWOW64\wuapp.exe
2013-12-11 16:24 - 2013-10-08 23:28 - 00040448 _____ (Microsoft Corporation) C:\windows\system32\wuapp.exe
2013-12-11 16:24 - 2013-10-08 23:27 - 03279872 _____ (Microsoft Corporation) C:\windows\system32\wuaueng.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 01622016 _____ (Microsoft Corporation) C:\windows\system32\wucltux.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00773120 _____ (Microsoft Corporation) C:\windows\system32\wuapi.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00252928 _____ (Microsoft Corporation) C:\windows\system32\WUSettingsProvider.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00175104 _____ (Microsoft Corporation) C:\windows\system32\storewuauth.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00142848 _____ (Microsoft Corporation) C:\windows\system32\wuwebv.dll
2013-12-11 16:24 - 2013-10-08 23:27 - 00099328 _____ (Microsoft Corporation) C:\windows\system32\wudriver.dll
2013-12-11 16:24 - 2013-10-05 07:10 - 00285016 _____ (Microsoft Corporation) C:\windows\system32\Drivers\spaceport.sys
2013-12-11 16:24 - 2013-10-03 23:09 - 00385528 _____ C:\windows\system32\ApnDatabase.xml
2013-12-11 16:24 - 2013-10-02 03:50 - 00447320 _____ (Microsoft Corporation) C:\windows\system32\Drivers\USBHUB3.SYS
2013-12-11 16:24 - 2013-09-28 06:48 - 00778752 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2013-12-11 16:24 - 2013-09-28 04:58 - 00551424 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2013-12-11 16:24 - 2013-09-19 08:32 - 01455448 _____ (Microsoft Corporation) C:\windows\system32\Drivers\dxgkrnl.sys
2013-12-11 16:24 - 2013-08-30 06:19 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\resutils.dll
2013-12-11 16:24 - 2013-08-30 06:18 - 00374784 _____ (Microsoft Corporation) C:\windows\system32\clusapi.dll
2013-12-11 16:24 - 2013-08-30 00:48 - 00488960 _____ (Microsoft Corporation) C:\windows\SysWOW64\resutils.dll
2013-12-11 16:24 - 2013-08-30 00:47 - 00302080 _____ (Microsoft Corporation) C:\windows\SysWOW64\clusapi.dll
2013-12-11 16:23 - 2013-11-23 07:43 - 00420864 _____ (Microsoft Corporation) C:\windows\system32\WMPhoto.dll
2013-12-11 16:23 - 2013-11-23 06:05 - 00368640 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMPhoto.dll
2013-12-11 16:23 - 2013-11-07 00:18 - 04036608 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-12-11 16:23 - 2013-11-01 06:38 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\msieftp.dll
2013-12-11 16:23 - 2013-11-01 04:49 - 00273408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msieftp.dll
2013-12-11 16:23 - 2013-10-10 10:32 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\cscript.exe
2013-12-11 16:23 - 2013-10-10 10:30 - 00162304 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrobj.dll
2013-12-11 16:23 - 2013-10-10 10:30 - 00156160 _____ (Microsoft Corporation) C:\windows\SysWOW64\scrrun.dll
2013-12-11 16:23 - 2013-10-10 10:24 - 00143872 _____ (Microsoft Corporation) C:\windows\system32\wshom.ocx
2013-12-11 16:23 - 2013-10-10 10:23 - 00146944 _____ (Microsoft Corporation) C:\windows\system32\cscript.exe
2013-12-11 16:23 - 2013-10-10 10:22 - 00222720 _____ (Microsoft Corporation) C:\windows\system32\scrobj.dll
2013-12-11 16:23 - 2013-10-10 10:22 - 00194048 _____ (Microsoft Corporation) C:\windows\system32\scrrun.dll
2013-12-11 16:23 - 2013-09-28 04:35 - 00288768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\portcls.sys

==================== One Month Modified Files and Folders =======

2014-01-04 18:23 - 2014-01-04 18:23 - 00015848 _____ C:\Users\dagobert\Desktop\FRST.txt
2014-01-04 18:22 - 2013-09-22 20:17 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-01-04 18:21 - 2012-07-26 08:22 - 00000006 ____H C:\windows\Tasks\SA.DAT
2014-01-04 18:20 - 2013-12-13 19:31 - 00424640 _____ C:\windows\system32\FNTCACHE.DAT
2014-01-04 18:19 - 2013-09-23 14:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2014-01-04 18:19 - 2012-11-14 03:05 - 00060762 _____ C:\windows\PFRO.log
2014-01-04 18:19 - 2012-07-26 06:26 - 00262144 ___SH C:\windows\system32\config\BBI
2014-01-04 18:18 - 2014-01-04 18:11 - 00000000 ____D C:\AdwCleaner
2014-01-04 18:02 - 2013-09-22 20:43 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\Skype
2014-01-04 18:00 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\sru
2014-01-04 17:45 - 2013-11-17 22:04 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2014-01-04 17:34 - 2013-09-22 20:17 - 00001120 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-01-04 17:32 - 2013-09-21 03:41 - 01594781 _____ C:\windows\WindowsUpdate.log
2014-01-04 16:50 - 2014-01-04 16:50 - 00000000 ____D C:\windows\system32\IO
2014-01-04 16:49 - 2014-01-04 16:49 - 00003136 _____ C:\windows\System32\Tasks\{F8D0D227-1CE3-4729-880C-88C727E51CB3}
2014-01-04 16:43 - 2014-01-04 16:43 - 01233962 _____ C:\Users\dagobert\Desktop\adwcleaner(1).exe
2014-01-04 13:22 - 2013-12-19 00:22 - 00000072 _____ C:\Users\dagobert\AppData\Roaming\WB.CFG
2014-01-04 12:51 - 2014-01-04 12:51 - 00000000 ____D C:\FRST
2014-01-04 12:50 - 2014-01-04 12:50 - 01931368 _____ (Farbar) C:\Users\dagobert\Desktop\FRST64.exe
2014-01-03 21:39 - 2014-01-03 21:39 - 01233962 _____ C:\Users\dagobert\Desktop\adwcleaner.exe
2014-01-03 21:29 - 2014-01-03 20:54 - 106000000 _____ C:\Users\dagobert\Downloads\BRRTB_DENUADH_PG.part1.rar
2014-01-03 21:17 - 2014-01-03 21:17 - 00017071 _____ C:\Users\dagobert\Desktop\JRT.txt
2014-01-03 21:08 - 2014-01-03 21:08 - 00000000 ____D C:\windows\ERUNT
2014-01-03 21:07 - 2014-01-01 22:29 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKennitt - Troubadours On The Rhine (2012)
2014-01-03 21:02 - 2014-01-03 21:02 - 01036305 _____ (Thisisu) C:\Users\dagobert\Desktop\JRT.exe
2014-01-03 20:06 - 2013-10-05 21:58 - 00000000 ____D C:\Users\dagobert\AppData\Local\PokerStars.EU
2014-01-03 16:50 - 2013-10-09 22:35 - 00000000 ____D C:\Users\dagobert\AppData\Local\CrashDumps
2014-01-03 16:37 - 2012-07-26 09:12 - 00000000 ____D C:\windows\AUInstallAgent
2014-01-03 14:43 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\FxsTmp
2014-01-02 22:40 - 2013-12-25 16:44 - 00000000 ____D C:\Users\dagobert\Desktop\CD
2014-01-02 21:38 - 2014-01-02 21:22 - 48281764 _____ C:\Users\dagobert\Downloads\RTB_M_PG.rar
2014-01-02 21:21 - 2013-12-27 18:15 - 338124282 _____ C:\Users\dagobert\Downloads\497834093840394.7z
2014-01-02 17:46 - 2014-01-02 17:46 - 05629632 _____ (IvoSoft) C:\Users\dagobert\Downloads\ClassicShellSetup_4_0_2.exe
2014-01-02 12:01 - 2014-01-02 12:01 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2014-01-02 11:18 - 2014-01-02 11:18 - 00000000 ____D C:\Users\dagobert\Desktop\MyPhoneExplorer portable
2014-01-02 11:15 - 2014-01-02 11:15 - 07080248 _____ C:\Users\dagobert\Downloads\MyPhoneExplorer_1.8.5.exe
2014-01-02 11:13 - 2013-12-23 09:18 - 00000000 ____D C:\Users\dagobert\Documents\HiSuite
2014-01-02 11:12 - 2012-08-01 17:55 - 00780976 _____ C:\windows\system32\perfh010.dat
2014-01-02 11:12 - 2012-08-01 17:55 - 00152608 _____ C:\windows\system32\perfc010.dat
2014-01-02 11:12 - 2012-08-01 17:38 - 00753134 _____ C:\windows\system32\perfh007.dat
2014-01-02 11:12 - 2012-08-01 17:38 - 00155826 _____ C:\windows\system32\perfc007.dat
2014-01-02 11:12 - 2012-07-26 08:28 - 02679026 _____ C:\windows\system32\PerfStringBackup.INI
2014-01-02 11:02 - 2013-10-21 11:21 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\TeamViewer
2014-01-02 11:00 - 2012-07-26 08:21 - 00030044 _____ C:\windows\setupact.log
2014-01-02 10:51 - 2014-01-02 10:51 - 00001173 _____ C:\Users\Public\Desktop\TeamViewer 9.lnk
2014-01-02 10:51 - 2014-01-02 10:51 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2014-01-01 22:26 - 2014-01-01 22:26 - 00001732 _____ C:\Users\dagobert\Desktop\dee8bf01883ccfcc31d20370e4879aac.dlc
2014-01-01 21:55 - 2014-01-01 21:55 - 102703242 _____ C:\Users\dagobert\Desktop\Rhein.rar
2013-12-30 18:56 - 2013-12-30 18:56 - 00001171 _____ C:\Users\dagobert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2013-12-30 12:54 - 2013-12-30 12:54 - 00189714 _____ C:\Users\dagobert\Desktop\1by1_181.exe
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\cache
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 _____ C:\Users\dagobert\daemonprocess.txt
2013-12-30 12:52 - 2013-09-21 03:43 - 00000000 ____D C:\Users\dagobert
2013-12-30 12:51 - 2013-12-30 12:51 - 00003248 _____ C:\windows\System32\Tasks\SomotoUpdateCheckerAutoStart
2013-12-30 12:43 - 2013-12-30 12:43 - 00000000 ____D C:\Users\dagobert\Desktop\Loreena McKenitt
2013-12-29 21:05 - 2013-12-29 21:05 - 00001873 _____ C:\Users\Public\Desktop\FLAC Frontend.lnk
2013-12-29 21:05 - 2013-12-29 21:05 - 00000000 ____D C:\Program Files (x86)\FLAC
2013-12-27 20:51 - 2013-12-27 20:51 - 02744087 _____ C:\Users\dagobert\Desktop\flac-1.2.1b.exe
2013-12-27 20:45 - 2013-12-27 20:45 - 00000000 ____D C:\Program Files\7-Zip
2013-12-27 20:41 - 2013-10-29 23:23 - 00000000 ____D C:\Program Files (x86)\JDownloader
2013-12-27 18:15 - 2013-12-27 18:07 - 23551482 _____ C:\Users\dagobert\Downloads\497834093840394.7z.004
2013-12-26 21:14 - 2013-10-08 18:13 - 00000000 ____D C:\Users\dagobert\Desktop\Neuer Ordner
2013-12-26 18:01 - 2013-12-26 17:27 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.003
2013-12-25 21:34 - 2013-12-25 21:00 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.002
2013-12-25 17:38 - 2013-12-25 17:03 - 104857600 _____ C:\Users\dagobert\Downloads\497834093840394.7z.001
2013-12-25 16:46 - 2013-10-04 10:28 - 00000000 ____D C:\Users\dagobert\Desktop\Facebook Bilder
2013-12-25 16:45 - 2013-10-09 10:07 - 00000000 ____D C:\Users\dagobert\Desktop\Arturas
2013-12-23 17:00 - 2013-10-19 19:59 - 00001002 _____ C:\Users\dagobert\Desktop\FairBot.lnk
2013-12-23 17:00 - 2013-10-19 19:59 - 00000000 ____D C:\Program Files (x86)\FairBot
2013-12-23 16:02 - 2013-12-23 16:02 - 00002786 _____ C:\Users\dagobert\AppData\Local\recently-used.xbel
2013-12-23 16:02 - 2013-12-23 16:02 - 00000000 ____D C:\Users\dagobert\AppData\Local\gtk-2.0
2013-12-23 16:02 - 2013-12-11 18:30 - 00000000 ____D C:\Users\dagobert\.gimp-2.8
2013-12-23 09:19 - 2013-12-23 09:19 - 00000000 ____D C:\Users\dagobert\.android
2013-12-23 09:19 - 2013-12-23 09:18 - 00000000 ____D C:\Users\dagobert\AppData\Local\HiSuite
2013-12-23 09:18 - 2013-12-23 09:18 - 00001002 _____ C:\Users\Public\Desktop\HiSuite.lnk
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_WinUsb_01007.Wdf
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HiSuiteOuc
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\ProgramData\HandSetService
2013-12-23 09:18 - 2013-12-23 09:18 - 00000000 ____D C:\Program Files (x86)\HiSuite
2013-12-23 09:15 - 2013-12-23 09:15 - 00000000 ____H C:\windows\system32\Drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
2013-12-22 21:46 - 2013-11-06 21:46 - 00000000 ____D C:\Users\dagobert\Desktop\Fussi Trades
2013-12-22 21:46 - 2013-10-01 13:03 - 00000000 ____D C:\Users\dagobert\Desktop\tex
2013-12-19 13:51 - 2013-12-19 12:36 - 451675335 _____ C:\Users\dagobert\Downloads\Secret Garden.part3.rar
2013-12-19 12:41 - 2013-09-22 20:43 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-12-19 12:41 - 2013-09-22 20:42 - 00000000 ____D C:\ProgramData\Skype
2013-12-19 07:57 - 2013-12-19 06:21 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part2.rar
2013-12-19 00:25 - 2013-12-18 21:12 - 576716800 _____ C:\Users\dagobert\Downloads\Secret Garden.part1.rar
2013-12-15 18:29 - 2013-10-05 21:58 - 00000000 ____D C:\Program Files (x86)\PokerStars.EU
2013-12-15 11:36 - 2013-12-15 11:36 - 110600192 _____ C:\Users\dagobert\Desktop\ebook 2.camrec
2013-12-15 11:35 - 2013-10-09 15:12 - 00004096 _____ C:\Users\dagobert\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2013-12-15 11:09 - 2013-12-15 11:09 - 47251456 _____ C:\Users\dagobert\Desktop\insidertips ebook.camrec
2013-12-15 11:04 - 2013-12-15 11:04 - 167469056 _____ C:\Users\dagobert\Desktop\insidertips.at.camrec
2013-12-14 22:11 - 2012-07-26 09:12 - 00000000 ____D C:\windows\rescache
2013-12-14 22:00 - 2013-09-22 22:09 - 00000000 ____D C:\windows\system32\MRT
2013-12-14 21:58 - 2013-09-22 22:09 - 90708896 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-12-14 21:23 - 2013-09-23 17:36 - 00004182 _____ C:\windows\System32\Tasks\avast! Emergency Update
2013-12-13 19:31 - 2013-12-13 19:31 - 555133442 _____ C:\windows\MEMORY.DMP
2013-12-13 19:31 - 2013-12-13 19:31 - 00285928 _____ C:\windows\Minidump\121313-38265-01.dmp
2013-12-13 19:31 - 2013-12-13 19:31 - 00000000 ____D C:\windows\Minidump
2013-12-13 16:26 - 2013-12-13 16:26 - 08065024 _____ C:\Users\dagobert\Desktop\capture-1.camrec
2013-12-13 14:40 - 2013-12-13 14:40 - 07613196 _____ C:\Users\dagobert\Desktop\104751_Mach_dich_zum_Gewinner_2.enc
2013-12-13 12:54 - 2013-12-13 12:54 - 00000000 ____D C:\Users\dagobert\AppData\Roaming\AVAST Software
2013-12-12 23:14 - 2012-07-26 09:12 - 00000000 ____D C:\windows\system32\SecureBootUpdates
2013-12-12 22:03 - 2013-12-12 22:03 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay(1).zip
2013-12-12 22:00 - 2013-12-12 22:00 - 00008942 _____ C:\Users\dagobert\Desktop\InsidertippsEachWay.zip
2013-12-12 21:28 - 2013-12-12 21:28 - 00002022 _____ C:\Users\Public\Desktop\CopySafe PDF Reader.lnk
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\windows\CopySafe PDF Reader
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files\Common Files\ArtistScope
2013-12-12 21:28 - 2013-12-12 21:28 - 00000000 ____D C:\Program Files (x86)\CopySafe PDF Reader
2013-12-12 21:26 - 2013-12-12 21:26 - 06280128 _____ (ArtistScope) C:\Users\dagobert\Desktop\CopysafePDFreader.exe
2013-12-11 18:34 - 2013-12-11 18:34 - 00000000 ____D C:\Users\dagobert\.thumbnails
2013-12-11 18:30 - 2013-12-11 18:30 - 00000000 ____D C:\Users\dagobert\AppData\Local\gegl-0.2
2013-12-11 18:28 - 2013-12-11 18:27 - 00000000 ____D C:\Program Files\GIMP 2
2013-12-11 16:29 - 2013-09-23 21:14 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-12-11 16:27 - 2012-07-26 06:38 - 00000000 ____D C:\windows\system32\oobe
2013-12-10 19:45 - 2013-11-17 22:04 - 00003772 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-12-09 10:46 - 2013-09-21 03:50 - 00003598 _____ C:\windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3541415397-2149579106-852229368-1001
2013-12-08 19:54 - 2013-09-23 17:36 - 01032416 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00409832 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00334648 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2013-12-08 19:54 - 2013-09-23 17:36 - 00205320 _____ C:\windows\system32\Drivers\aswVmm.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00092544 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00084328 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00065776 _____ C:\windows\system32\Drivers\aswRvrt.sys
2013-12-08 19:54 - 2013-09-23 17:36 - 00038984 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys
2013-12-08 19:54 - 2013-09-23 17:34 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr
2013-12-08 19:52 - 2013-09-23 17:34 - 00000000 ____D C:\ProgramData\AVAST Software
2013-12-08 19:51 - 2013-09-23 17:36 - 00000000 _____ C:\windows\SysWOW64\config.nt
2013-12-06 09:16 - 2013-09-24 14:49 - 00000000 ____D C:\Users\dagobert\Desktop\MAG
2013-12-06 07:40 - 2013-09-23 21:14 - 00000000 ____D C:\Users\dagobert\AppData\Local\Microsoft Help
2013-12-06 06:36 - 2013-09-22 20:17 - 00002186 _____ C:\Users\Public\Desktop\Google Chrome.lnk

Some content of TEMP:
====================
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationCore.dll
C:\Users\ADMINI~1\AppData\Local\Temp\PresentationFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\ReachFramework.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationProvider.dll
C:\Users\ADMINI~1\AppData\Local\Temp\UIAutomationTypes.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsBase.dll
C:\Users\ADMINI~1\AppData\Local\Temp\WindowsFormsIntegration.dll
C:\Users\dagobert\AppData\Local\Temp\84892uninstall.exe
C:\Users\dagobert\AppData\Local\Temp\fairbot.exe
C:\Users\dagobert\AppData\Local\Temp\flac-1.2.1b.exe
C:\Users\dagobert\AppData\Local\Temp\ICReinstall_ImageEditorSetup.exe
C:\Users\dagobert\AppData\Local\Temp\ICReinstall_ZipExtractorSetup.exe
C:\Users\dagobert\AppData\Local\Temp\Installer_new.exe
C:\Users\dagobert\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\dagobert\AppData\Local\Temp\Mobogenie_Setup_2.1.23_515.exe
C:\Users\dagobert\AppData\Local\Temp\nsfB739.exe
C:\Users\dagobert\AppData\Local\Temp\nslB9DA.exe
C:\Users\dagobert\AppData\Local\Temp\nsoB295.exe
C:\Users\dagobert\AppData\Local\Temp\nsr7B07.exe
C:\Users\dagobert\AppData\Local\Temp\nsx7DE6.exe
C:\Users\dagobert\AppData\Local\Temp\nsz822D.exe
C:\Users\dagobert\AppData\Local\Temp\OptimizerPro.exe
C:\Users\dagobert\AppData\Local\Temp\ose00000.exe
C:\Users\dagobert\AppData\Local\Temp\PokerStarsInstallEU.exe
C:\Users\dagobert\AppData\Local\Temp\Quarantine.exe
C:\Users\dagobert\AppData\Local\Temp\SearchProtectINT.exe
C:\Users\dagobert\AppData\Local\Temp\SplashLite_downloader.exe
C:\Users\dagobert\AppData\Local\Temp\splash_lite_setup.exe
C:\Users\dagobert\AppData\Local\Temp\Sqlite3.dll
C:\Users\dagobert\AppData\Local\Temp\TeamViewer_Setup_de_9.0.24951.exe
C:\Users\dagobert\AppData\Local\Temp\uninst1.exe
C:\Users\dagobert\AppData\Local\Temp\UpdateCheckerSetup.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-12-28 17:28

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---

Ops...sorry ..dachte hätte den LogFile von AdwCleaner gelöscht...

Aber habe den Logfile doch noch :crazy:

Hier :
Code:
# AdwCleaner v3.016 - Bericht erstellt am 04/01/2014 um 18:18:01
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 8  (64 bits)
# Benutzername : dagobert - PC
# Gestartet von : C:\Users\dagobert\Desktop\adwcleaner(1).exe
# Option : Löschen

***** [ Dienste ] *****

[#] Dienst Gelöscht : bonanzadealslive
[#] Dienst Gelöscht : bonanzadealslivem

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\DNSErrorHelper
Ordner Gelöscht : C:\Program Files (x86)\Mobogenie
Ordner Gelöscht : C:\Program Files (x86)\LyriXeeker-1
Ordner Gelöscht : C:\Users\dagobert\AppData\Local\Mobogenie
Ordner Gelöscht : C:\Users\dagobert\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\dagobert\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\dagobert\AppData\Roaming\FoxTab
Ordner Gelöscht : C:\Users\dagobert\AppData\Roaming\HELPER
Ordner Gelöscht : C:\Users\dagobert\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\dagobert\Documents\Mobogenie
Ordner Gelöscht : C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\Extensions\firejump@firejump.net
Ordner Gelöscht : C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ccncljhbalbbkkfgopogabimepmfkmff
Ordner Gelöscht : C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghgmpcnmaamenhngcinchjeifhhnlaig
Datei Gelöscht : C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\searchplugins\conduit-search.xml
Datei Gelöscht : C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\user.js
Datei Gelöscht : C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www2.delta-search.com_0.localstorage
Datei Gelöscht : C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www2.delta-search.com_0.localstorage-journal
Datei Gelöscht : C:\windows\System32\Tasks\BonanzaDealsUpdate
Datei Gelöscht : C:\windows\Tasks\FoxTab.job
Datei Gelöscht : C:\windows\System32\Tasks\FoxTab
Datei Gelöscht : C:\windows\Tasks\LyriXeeker-1-chromeinstaller.job
Datei Gelöscht : C:\windows\System32\Tasks\LyriXeeker-1-chromeinstaller
Datei Gelöscht : C:\windows\Tasks\LyriXeeker-1-updater.job
Datei Gelöscht : C:\windows\System32\Tasks\LyriXeeker-1-updater

***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [dnshelp@dnshelp.com]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [firejump@firejump.net]
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\updateBatBrowse_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BonanzaDealsLive.exe
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [mobilegeni daemon]
Schlüssel Gelöscht : HKLM\SOFTWARE\5328ad9b36abe47
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F904AC50-215C-42AB-A532-77E9FDBA9B19}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FE063412-BEA4-4D76-8ED3-183BE6220D17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063412-BEA4-4D76-8ED3-183BE6220D17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{B67B3DBB-C1C9-49D2-B016-2748B0B5017E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FE063412-BEA4-4D76-8ED3-183BE6220D17}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{B67B3DBB-C1C9-49D2-B016-2748B0B5017E}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{FE063412-BEA4-4D76-8ED3-183BE6220D17}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{29494049-211F-4F5C-8545-7DA8BF7A6CF8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C4BEF720-313C-420A-ACF6-77DD95D8F553}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{33BAF587-9647-4281-A34F-F4830CDC1B9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{090bb045-13a7-447c-b78e-30b1ddb41389}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2fa47400-045a-4ff8-81a2-377f157a4e5a}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{37237a65-5777-43f2-ba9b-339de5a29d22}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4b7fb8aa-25e0-4a1d-ba79-f77e674dd6a2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{90b3c11d-5652-4b5a-886b-9e20a42dbadc}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Wert Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Schlüssel Gelöscht : HKCU\Software\InstalledThirdPartyPrograms
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\SearchProtectINT
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\LyriXeeker-1
Schlüssel Gelöscht : HKLM\Software\LyriXeeker-1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LyriXeeker-1
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\InstalledThirdPartyPrograms
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DesktopIconAmazon

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16537


-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\dagobert\AppData\Roaming\Mozilla\Firefox\Profiles\ufdk0uqw.default\prefs.js ]

Zeile gelöscht : user_pref("extensions.helperbar.DockingPositionDown", false);
Zeile gelöscht : user_pref("extensions.helperbar.Visibility", true);
Zeile gelöscht : user_pref("extensions.helperbar.countryiso", "de");
Zeile gelöscht : user_pref("extensions.helperbar.externalJsFiles", "{\"d\":\"[]\"}");
Zeile gelöscht : user_pref("extensions.helperbar.installationid", "63d1f931-4e1a-85ca-e2d6-ee2f74858a54");
Zeile gelöscht : user_pref("extensions.helperbar.installdate", "30/12/2013");
Zeile gelöscht : user_pref("extensions.helperbar.lastExternalJsUpdate", "1388405626266");
Zeile gelöscht : user_pref("iminent.versioning", "{\"CurrentVersion\":\"7.43.4.1\",\"InstallEventCTime\":1383091714481,\"InstallEvent\":\"True\"}");

-\\ Google Chrome v31.0.1650.63

[ Datei : C:\Users\dagobert\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Gelöscht : homepage
Gelöscht : icon_url

*************************

AdwCleaner[R0].txt - [17010 octets] - [04/01/2014 18:11:49]
AdwCleaner[R1].txt - [17071 octets] - [04/01/2014 18:17:23]
AdwCleaner[S0].txt - [15868 octets] - [04/01/2014 18:18:01]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [15929 octets] ##########

aharonov 04.01.2014 19:38
Wie läuft der Rechner nach folgenden Schritten? Noch Probleme vorhangen?


Schritt 1

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [ ] ()
BHO: LyriXeeker-1 - {11111111-1111-1111-1111-110411181156} - C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-bho64.dll No File
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\cache
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 _____ C:\Users\dagobert\daemonprocess.txt
C:\Users\dagobert\AppData\Local\Temp\*.exe

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.




Schritt 2

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




Schritt 3


ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


boti 05.01.2014 17:57
Hi

...so habe die ersten Schritte wie von Dir beschrieben gemacht.
Ich poste jetzt die beiden Log Files und danach lasse ich ESET das System Scannen

Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.04.05

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
dagobert :: PC [Administrator]

Schutz: Aktiviert

04.01.2014 21:27:45
mbam-log-2014-01-04 (21-27-45).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 221712
Laufzeit: 4 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\dagobert\Downloads\Java.exe (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\dagobert\Downloads\Java7.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
Malwarebytes Anti-Malware (Test) 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2014.01.04.05

Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16750
dagobert :: PC [Administrator]

Schutz: Aktiviert

04.01.2014 21:27:45
mbam-log-2014-01-04 (21-27-45).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 221712
Laufzeit: 4 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\dagobert\Downloads\Java.exe (PUP.Optional.DomaIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\dagobert\Downloads\Java7.exe (PUP.Optional.BundleInstaller.A) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
Code:
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 04-01-2014
Ran by dagobert at 2014-01-04 21:24:35 Run:1
Running from C:\Users\dagobert\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [ ] ()
BHO: LyriXeeker-1 - {11111111-1111-1111-1111-110411181156} - C:\Program Files (x86)\LyriXeeker-1\LyriXeeker-1-bho64.dll No File
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 ____D C:\Users\dagobert\AppData\Local\cache
2013-12-30 12:52 - 2013-12-30 12:52 - 00000000 _____ C:\Users\dagobert\daemonprocess.txt
C:\Users\dagobert\AppData\Local\Temp\*.exe
*****************

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs => Value was restored successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110411181156} => Key deleted successfully.
HKCR\CLSID\{11111111-1111-1111-1111-110411181156} => Key not found.
C:\Users\dagobert\AppData\Local\cache => Moved successfully.
C:\Users\dagobert\daemonprocess.txt => Moved successfully.
C:\Users\dagobert\AppData\Local\Temp\*.exe => Moved successfully.

==== End of Fixlog ====

aharonov 05.01.2014 18:12
Ok soweit. Der ESET-Scan könnte etwas länger dauern, das ist normal.
(Sind die Probleme mittlerweile verschwunden?)

boti 05.01.2014 22:38
Danke Dir....
ESET hat noch einiges gefunden und in Quarantäne gesteckt...
Aber der Rechner läuft jetzt wieder Richtig Flott!

Danke für deine Hilfe

LG boti

aharonov 05.01.2014 22:42
Hast du das ESET-Log noch?


Alle Zeitangaben in WEZ +1. Es ist jetzt 11:25 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132