| |
| |||||||
Log-Analyse und Auswertung: Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
18.10.2013, 15:51
| #1 |
| |  Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Hallo zusammen, ich habe oben genanntes Problem. Ich nutze den Rechner beruflisch und Privat und bin viel auf Reisen. Wahrscheinlich enstanden nach der Nutzung eines Memory-Sticks diese Probleme. Zumindestens ist es mir danach aufgefallen, weil der Virenscanner angeschlagen hatte und ich danach die Firewall-Einstellungen nicht mehr ändern konnte. Zusätzlich ist mir aufgefallen, dass ich fast jedesmal bei einem Wechsel des WLAN Netzwerks die Problembehandlung ausführen muss, um eine Verbindung zum Internet zu bekommen. Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 16:05 on 18/10/2013 (armin.basten)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
-=E.O.F=-
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 18-10-2013 16:10:29
Running from C:\Users\armin.basten\Downloads
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\NetKit.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
() C:\Users\armin.basten\Downloads\Defogger.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
HKLM\...\Runonce: [Del5750820] - cmd.exe /Q /D /c del "C:\Users\ARMIN~1.BAS\AppData\Local\Temp\0.del"
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Runonce: [Del5750820] - cmd.exe /Q /D /c del "C:\Users\ARMIN~1.BAS\AppData\Local\Temp\0.del"
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
HKCU\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=119816&babsrc=HP_ss_din2g&mntrId=FECE001060D1BBAB
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119816&babsrc=SP_ss_din2g&mntrId=FECE001060D1BBAB
SearchScopes: HKCU - bProtectorDefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=119816&babsrc=SP_ss_din2g&mntrId=FECE001060D1BBAB
SearchScopes: HKCU - {483830EE-A4CD-4b71-B0A3-3D82E62A6909} URL =
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\..\Interfaces\{555765F5-ECDF-4795-B550-30881F8EAB47}: [NameServer]77.243.240.230 77.243.240.231
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Chrome:
=======
CHR HomePage: hxxp://www.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId=FECE001060D1BBAB
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-06] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-05] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
S4 BrowserProtect; C:\ProgramData\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-06] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-11] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-11] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-11] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-19] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-16] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
R3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
U3 mbr; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\mbr.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:08 - 2013-10-18 16:09 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:05 - 2013-10-18 16:06 - 00000556 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:42 - 2013-10-18 15:42 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DigitalSite
2013-10-18 15:36 - 2013-10-18 15:41 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 15:25 - 2013-10-18 15:25 - 00015001 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2010.720p.brrip.x264.yify.torrent
2013-10-18 15:25 - 2013-10-18 15:25 - 00008244 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008232 _____ C:\Users\armin.basten\Downloads\[kickass.to]despicable.me.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008198 _____ C:\Users\armin.basten\Downloads\[kickass.to]r.i.p.d.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008178 _____ C:\Users\armin.basten\Downloads\[kickass.to]parkland.2013.720p.brrip.x264.yify.torrent
2013-10-18 14:58 - 2013-10-18 14:58 - 00028958 _____ C:\ComboFix.txt
2013-10-18 13:47 - 2013-10-18 14:59 - 00000000 ____D C:\ComboFix
2013-10-18 13:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 13:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 13:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 12:34 - 2013-10-18 12:36 - 05134711 ____R (Swearware) C:\Users\armin.basten\Downloads\ComboFix.exe
2013-10-18 08:39 - 2013-10-18 15:07 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 12:48 - 2013-10-17 07:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 15:31 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:06 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 07:06 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 07:06 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 07:06 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 07:06 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 07:05 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:48 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:48 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:48 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:48 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 23:48 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:48 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:48 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:48 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:48 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:48 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:48 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:48 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:48 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:48 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:48 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:48 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:48 - 2013-07-03 06:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:48 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:48 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:48 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:47 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:52 - 2013-10-03 12:53 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 13:28 - 2013-10-02 17:55 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 21:49 - 2013-10-01 03:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 22:31 - 2013-09-29 23:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 22:13 - 2013-09-30 16:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-29 22:12 - 2013-09-29 23:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:10 - 1996-11-05 15:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 21:22 - 2013-09-29 21:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-10-18 14:06 - 00008454 _____ C:\Windows\PFRO.log
2013-09-29 21:17 - 2013-10-18 14:06 - 00001637 _____ C:\Windows\setupact.log
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:12 - 2013-09-29 13:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 12:12 - 2011-06-21 10:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 12:06 - 2013-09-28 12:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-27 23:28 - 2013-09-28 06:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:28 - 2012-12-10 10:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-27 23:28 - 2012-12-10 10:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-27 22:29 - 2013-09-27 22:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-09-27 22:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 15:48 - 2013-09-26 03:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:33 - 2013-10-09 14:06 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 08:52 - 2008-11-23 09:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 08:50 - 2013-09-29 14:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 08:48 - 2006-12-20 10:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 08:48 - 2006-11-30 10:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 08:48 - 2005-09-06 16:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 08:48 - 2002-07-26 16:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 08:15 - 2013-09-29 14:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-20 19:00 - 2013-10-13 21:54 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
==================== One Month Modified Files and Folders =======
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:09 - 2013-10-18 16:08 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:06 - 2013-10-18 16:05 - 00000556 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:44 - 2011-07-27 11:04 - 01132133 _____ C:\Windows\WindowsUpdate.log
2013-10-18 15:42 - 2013-10-18 15:42 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DigitalSite
2013-10-18 15:41 - 2013-10-18 15:36 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 15:25 - 2013-10-18 15:25 - 00015001 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2010.720p.brrip.x264.yify.torrent
2013-10-18 15:25 - 2013-10-18 15:25 - 00008244 _____ C:\Users\armin.basten\Downloads\[kickass.to]grown.ups.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008232 _____ C:\Users\armin.basten\Downloads\[kickass.to]despicable.me.2.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008198 _____ C:\Users\armin.basten\Downloads\[kickass.to]r.i.p.d.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:24 - 2013-10-18 15:24 - 00008178 _____ C:\Users\armin.basten\Downloads\[kickass.to]parkland.2013.720p.brrip.x264.yify.torrent
2013-10-18 15:07 - 2013-10-18 08:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 14:59 - 2013-10-18 13:47 - 00000000 ____D C:\ComboFix
2013-10-18 14:58 - 2013-10-18 14:58 - 00028958 _____ C:\ComboFix.txt
2013-10-18 14:58 - 2013-08-10 11:57 - 00000000 ____D C:\Qoobox
2013-10-18 14:52 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 14:17 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-18 14:17 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-18 14:15 - 2011-10-14 17:18 - 00763840 _____ C:\Windows\system32\perfh01F.dat
2013-10-18 14:15 - 2011-10-14 17:18 - 00182854 _____ C:\Windows\system32\perfc01F.dat
2013-10-18 14:15 - 2011-08-09 13:24 - 00830312 _____ C:\Windows\system32\perfh019.dat
2013-10-18 14:15 - 2011-08-09 13:24 - 00193648 _____ C:\Windows\system32\perfc019.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00602068 _____ C:\Windows\system32\perfh014.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00549482 _____ C:\Windows\system32\perfh012.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00526592 _____ C:\Windows\system32\prfh0404.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00510290 _____ C:\Windows\system32\prfh0804.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00165054 _____ C:\Windows\system32\perfc012.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00164626 _____ C:\Windows\system32\prfc0804.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00159712 _____ C:\Windows\system32\prfc0404.dat
2013-10-18 14:15 - 2011-07-28 08:38 - 00137768 _____ C:\Windows\system32\perfc014.dat
2013-10-18 14:15 - 2010-07-01 02:19 - 00844522 _____ C:\Windows\system32\perfh010.dat
2013-10-18 14:15 - 2010-07-01 02:19 - 00188544 _____ C:\Windows\system32\perfc010.dat
2013-10-18 14:15 - 2010-06-30 16:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-18 14:06 - 2013-09-29 21:17 - 00008454 _____ C:\Windows\PFRO.log
2013-10-18 14:06 - 2013-09-29 21:17 - 00001637 _____ C:\Windows\setupact.log
2013-10-18 12:36 - 2013-10-18 12:34 - 05134711 ____R (Swearware) C:\Users\armin.basten\Downloads\ComboFix.exe
2013-10-18 12:13 - 2011-07-27 13:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-18 07:02 - 2013-02-16 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-17 23:48 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 09:33 - 2012-04-15 11:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 07:30 - 2013-10-17 12:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 07:40 - 2011-08-17 07:37 - 00000000 ____D C:\Windows\Minidump
2013-10-13 21:54 - 2013-09-20 19:00 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 17:11 - 2012-03-03 08:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 08:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 07:43 - 2009-07-14 06:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 07:15 - 2011-07-28 12:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 07:13 - 2013-07-20 12:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 07:07 - 2011-07-27 18:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 14:06 - 2013-09-21 11:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 08:47 - 2013-05-06 13:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:53 - 2013-10-03 12:52 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-02 17:55 - 2013-10-01 13:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-01 16:00 - 2013-05-06 10:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 03:49 - 2013-09-30 21:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 16:20 - 2013-09-29 22:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 23:14 - 2013-09-29 22:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 23:11 - 2013-09-29 22:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:09 - 2013-03-23 16:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 21:35 - 2013-09-29 21:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 17:18 - 2012-04-03 13:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 16:10 - 2013-03-24 14:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 14:32 - 2013-09-21 08:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 14:02 - 2013-09-21 08:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 14:02 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system
2013-09-29 13:57 - 2013-09-28 12:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:08 - 2013-09-28 12:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 09:16 - 2012-06-17 16:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 07:32 - 2012-05-11 19:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 07:32 - 2011-07-27 15:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 06:10 - 2013-09-27 23:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:25 - 2013-07-27 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Local\SwvUpdater
2013-09-27 22:37 - 2013-09-27 22:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:22 - 2013-09-27 20:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-02-04 04:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 20:22 - 2013-03-23 16:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\BabSolution
2013-09-27 20:21 - 2011-08-03 13:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 20:21 - 2011-08-03 12:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 20:17 - 2011-08-03 13:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 20:17 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 20:08 - 2012-04-15 11:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 03:48 - 2013-09-25 15:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 01:28 - 2013-10-10 07:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-10 07:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:28 - 2013-10-10 07:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 09:01 - 2011-10-08 07:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 05:30 - 2013-10-10 07:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-10 07:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe
C:\Users\armin.basten\AppData\Local\temp\ICReinstall_DownloadManagerSetup (1).exe
C:\Users\armin.basten\AppData\Local\temp\ICReinstall_DownloadManagerSetup.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-11 00:20
==================== End Of Log ============================
Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 03-10-2013
Ran by armin.basten at 2013-10-18 16:11:31
Running from C:\Users\armin.basten\Downloads
Boot Mode: Normal
==========================================================
==================== Security Center ========================
AV: Avira Desktop (Disabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Disabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer (Version: 8.1.1)
7-Zip 9.20
ABB DTM500 (Version: 05.03.00)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.175)
Adobe Flash Player 11 Plugin (Version: 11.6.602.180)
Adobe Reader X (10.1.8) - Deutsch (Version: 10.1.8)
Adobe SVG Viewer 3.0 (Version: 3.0)
AIMP3 (Version: v3.00.981)
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
Audacity 2.0
Autodesk Design Review 2009 DGN Importer (Version: 2.00.071)
Autodesk Design Review 2009 JT Importer (Version: 2.00.071)
Autodesk Design Review 2010 (Version: 10.0.0.108)
Avira Free Antivirus (Version: 14.0.0.383)
Bluetooth Stack for Windows by Toshiba (Version: v7.10.12)
Bonjour (Version: 3.0.0.10)
Bonjour-Druckdienste (Version: 2.0.2.0)
BufferChm (Version: 130.0.331.000)
CameraHelperMsi (Version: 13.31.1038.0)
CCleaner (Version: 3.09)
Core Temp 1.0 RC3 (Version: 1.0)
D3DX10 (Version: 15.4.2368.0902)
DAEMON Tools Lite (Version: 4.47.1.0333)
Destinations (Version: 130.0.0.0)
Disoplan (Version: 9.00.0006)
DocProc (Version: 13.0.0.0)
DTM 266-PdP HART (Version: 05.00.02.31)
DTM TTX300 HART (Version: 05.00.10.16)
DTM500 Library (Version: 05.00.17.25)
DWG TrueView 2010 (Version: 18.0.55.0)
Elcomsoft Advanced Office Password Recovery Professional (Version: v4.10)
ELECTRA 2.8
ElsaWin (Version: 4.00)
ElsterFormular (Version: 13.0.0.8086)
eReg (Version: 1.20.138.34)
ETKA 7.4 Germany 2013
FileZilla Client 3.7.3 (Version: 3.7.3)
FlukeView ScopeMeter 4
FluMoS Light V01.40R01
GOM Player (Version: 2.1.50.5145)
Google Chrome (HKCU Version: 29.0.1547.66)
GPBaseService2 (Version: 130.0.371.000)
HART Communication FDT 1.2 DTM (V1.0.39) (Version: 1.0.39.0)
HP Deskjet 3050 J610 series Basic Device Software (Version: 22.0.334.0)
HP Deskjet 3050 J610 series Hilfe (Version: 140.0.63.63)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP LaserJet 100 color MFP M175
HP LJ100 M175 HP Scan (Version: 1.0.302.0)
HP Photosmart 5510d series - Grundlegende Software für das Gerät (Version: 25.0.607.0)
HP Scanjet G3010 (Version: 13.0)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.003.001.001)
hpbDSService (Version: 001.001.05133)
hpbM175DSService (Version: 001.001.05133)
hpg3010 (Version: 13.0.0.0)
HPProductAssistant (Version: 130.0.371.000)
HUAWEI DataCard Driver 4.22.19.00 (Version: 4.22.19.00)
iCloud (Version: 2.1.2.8)
ICS Generic HART Release 4 FDT 1.2 DTM (Version: 4.0.3)
IDT Audio (Version: 5.10.0000.0)
ImgBurn (Version: 2.5.8.0)
Intel PROSet Wireless
Intel(R) Graphics Media Accelerator Driver (Version: 8.15.10.2182)
Intel(R) Management Engine Components (Version: 6.0.0.1179)
Intel(R) Network Connections 15.4.82.0 (Version: 15.4.82.0)
Intel(R) PROSet/Wireless WiFi Software (Version: 13.03.0000)
iTunes (Version: 11.0.5.5)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Logitech SetPoint 6.32 (Version: 6.32.20)
Logitech Webcam Software (Version: 2.0)
LWS Facebook (Version: 13.31.1038.0)
LWS Gallery (Version: 13.31.1038.0)
LWS Help_main (Version: 13.31.1044.0)
LWS Launcher (Version: 13.31.1038.0)
LWS Motion Detection (Version: 13.30.1395.0)
LWS Pictures And Video (Version: 13.31.1038.0)
LWS Twitter (Version: 13.30.1346.0)
LWS Video Mask Maker (Version: 13.30.1379.0)
LWS VideoEffects (Version: 13.30.1379.0)
LWS Webcam Software (Version: 13.31.1038.0)
LWS WLM Plugin (Version: 1.30.1201.0)
LWS YouTube Plugin (Version: 13.31.1038.0)
Microsoft .NET Framework 1.1 (Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Standard 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Primary Interoperability Assemblies 2005 (Version: 8.0.50727.42)
Microsoft SOAP Toolkit 3.0 (Version: 3.0.1325.4)
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Backward compatibility (Version: 8.05.2312)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2005 Express Edition (WINCCFLEXEXPRESS) (Version: 9.4.5000.00)
Microsoft SQL Server 2005 Express Edition (WINCCPLUS) (Version: 9.4.5000.00)
Microsoft SQL Server 2005 Express Edition (WINCCPLUSMIG) (Version: 9.4.5000.00)
Microsoft SQL Server Native Client (Version: 9.00.5000.00)
Microsoft SQL Server Setup Support Files (English) (Version: 9.00.5000.00)
Microsoft SQL Server VSS Writer (Version: 9.00.5000.00)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft XML Parser (Version: 8.30.9530.0)
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Neuratron PhotoScore Ultimate Demo (Version: 7.0.2)
NirSoft ShellExView
Notepad++ (Version: 6.1.2)
Nur Entfernen der CopyTrans Suite möglich (HKCU Version: 2.37)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
OPC .NET API 2.00 Redistributables (x86) 101.0 (Version: 2.00.10200)
OPC Core Components Redistributable (Version: 3.00.102)
OPC Core Components Redistributable (x86) 101.2 (Version: 3.00.10102)
OPC UA SDK 1.01 Redistributables 314.0 (Version: 1.01.31400)
PACTware 4.0 (Version: 4.0.06)
pdfsam (Version: 2.2.1)
PKZIP Server for Windows 12.40.0008 (Version: 12.40.0008)
Scan (Version: 13.0.0.0)
Sibelius 7 OpenType Fonts (Version: 7.0.0)
Siemens Totally Integrated Automation Portal V10 (Version: V10.5 SP2)
Siemens Automation License Manager (Version: 05.01.0103)
Siemens Automation License Manager V5.1 + SP1 + Upd3 (Version: 05.01.0103)
Siemens Totally Integrated Automation Portal V11 (Version: V11)
SIMATIC STEP 7 (Version: 05.05.0000)
SIMATIC STEP 7 V5.5 Professional 2010 (Version: 05.05.0000)
SIMATIC Device Drivers (Version: 08.02.0200)
SIMATIC Event Database (Version: 05.05.0003)
SIMATIC HMI License Manager Panel Plugin (Version: 11.00.0100)
SIMATIC HMI ProSave (Version: 09.00.0300)
SIMATIC HMI Symbol Library (Version: 11.00.0200)
SIMATIC LanguageSupportTool (Version: 05.08.0100)
SIMATIC OPC-XML-Gateway (Version: 01.03.0200)
SIMATIC OPC-XML-Gateway V1.3 + SP 2 (Version: 01.03.0200)
SIMATIC Prosave (Version: 09.00.0300)
SIMATIC Prosave V9.0 incl. SP3 (Version: 09.00.0300)
SIMATIC S7 CP PtP Param (Version: 5.1.1300)
SIMATIC S7 CP PtP Param V5.1 + SP13 (Version: 5.1.1300)
SIMATIC S7 Distributed Safety Prog. V5.4 + SP5 (Version: 05.04.0500)
SIMATIC S7 Distributed Safety Prog. V5.4 SP5
SIMATIC S7 F ConfigurationPack (Version: 05.05.0700)
SIMATIC S7 F ConfigurationPack V5.5 + SP7 (Version: 05.05.0700)
SIMATIC S7-GRAPH V5.3 + SP6 Professional 2010 (Version: 05.03.0600)
SIMATIC S7-GRAPH V5.3 inkl. SP6 Professional 2010
SIMATIC S7-PCT (Version: 02.01.0000)
SIMATIC S7-PCT Advanced Services
SIMATIC S7-PCT V2.1 Professional 2010 (Version: 02.01.0000)
SIMATIC S7-PLCSIM (Version: 5.4.0401)
SIMATIC S7-PLCSIM V5.4 + SP4 + HF1 (Version: 5.4.0401)
SIMATIC S7-SCL V5.3 + SP5 Professional 2010 (Version: 5.3.5.0)
SIMATIC S7-SCL V5.3 SP5 Professional 2010
SIMATIC STEP 7 Advanced Services
SIMATIC TS Adapter IE (Version: 03.00.0000)
SIMATIC TS Adapter IE V3.0 (Version: 03.00.0000)
SIMATIC TS Adapter MPI (Version: 3.0)
SIMATIC TS Adapter MPI V3.0 + SP1 (Version: 3.0)
SIMATIC Version View (Version: 01.07.0600)
SIMATIC WinCC flexible 2008 SP3 (Version: 01.04.0000)
SIMATIC WinCC flexible OCX (Version: 01.04.0000)
SIMATIC WinCC flexible Runtime (Version: 01.04.0000)
SIMATIC WinCC flexible Runtime 2008 SP3 (Version: 01.04.0000)
SIMATIC WinCC flexible Simulator (Version: 01.08.0300)
SIMATIC WinCC flexible Tag Simulator (Version: 01.04.0000)
Skype Click to Call (Version: 6.4.11328)
Skype™ 6.9 (Version: 6.9.106)
Softing PROFIdtm (Version: 2.11.00)
SolutionCenter (Version: 130.0.373.000)
Synaptics Pointing Device Driver (Version: 14.0.3.0)
Target 3001! V15 discover (Version: )
TeamViewer 8 (Version: 8.0.19617)
Texas Instruments PCIxx21/x515/xx12 drivers. (Version: 2.00.0005)
ThirdPartyCompInstaller (Version: 05.00.04)
TIA Portal Single SetupPackage - Hardware Support Base Package 0 V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Hardware Support Base Package 02 V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Hardware Support Base Package 03 V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Hardware Support Base Package WCF-01 V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - HW Module Base Package V10.5 + HF1 (Version: 10.05.0001)
TIA Portal Single SetupPackage - HWConfig Single SetupPackage V10.5 + SP2 (Version: 10.05.0200)
TIA Portal Single SetupPackage - HWConfig Single SetupPackage V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - S7BASUCL V10.5 + SP12 (Version: 10.05.1200)
TIA Portal Single SetupPackage - STEP 7 Single SetupPackage V10.5 + SP2 (Version: 10.05.0200)
TIA Portal Single SetupPackage - STEP 7 Single SetupPackage V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Support Base Package TO-01 V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - Support Base Package TO-02 V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - TIA ESTOUR V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - WinCC Single SetupPackage V10.5 + SP2 (Version: 10.05.0200)
TIA Portal Single SetupPackage - WinCC Single SetupPackage V11.0 (Version: 11.00.0000)
TIA Portal Single SetupPackage - WINCCBASUCL V10.5 + SP12 (Version: 10.05.1200)
TIA Portal Single SetupPackage - WINCCBASUCL V11.0 + SP11 (Version: 11.00.1100)
TIPCI (Version: 2.00.0005)
Totally Integrated Automation Portal V10 - TIA Portal Single SetupPackage V10.5 + SP2 (Version: 10.05.0200)
Totally Integrated Automation Portal V11 - TIA Portal Single SetupPackage V11.0 (Version: 11.00.0000)
Update for 2007 Microsoft Office System (KB967642)
Update for Codec Pack
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2827325) 32-Bit Edition
Update for Mipony Download Manager
Update für Microsoft Office Excel 2007 Help (KB963678)
Update für Microsoft Office Outlook 2007 Help (KB963677)
Update für Microsoft Office Powerpoint 2007 Help (KB963669)
Update für Microsoft Office Word 2007 Help (KB963665)
VC User 71 RTL X86 --- (Version: 1.0)
VCDS Release 11.11.6 (Version: 11.11.6)
VCDS Release 12.12.0 (Version: 12.12.0)
VEGA DTM VEGADIF 55 V1.4.129.244 (Version: 1.7.244)
VEGA-DTM 1.65.0 (Version: 1.48.0000)
Visual C++ 2008 x86 Runtime - (v9.0.30729.5578) (Version: 9.0.30729.5578)
Visual C++ 2008 x86 Runtime - v9.0.30729.5578 (Version: 9.0.30729.5578)
WebReg (Version: 130.0.132.017)
Wetelecom (Version: 1.0)
WinCC flexible (Version: 01.04.0000)
WinCC flexible Graphics (Version: 1.04.0000)
WinCC flexible Languages (Version: 1.04.0000)
WinCC Runtime Advanced Simulator (Version: 11.00.0000)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Media Player Firefox Plugin (Version: 1.0.0.8)
Windows-Treiberpaket - Ross-Tech USB Driver Package (06/16/2010 2.06.02) (Version: 06/16/2010 2.06.02)
Xvid Video Codec (Version: 1.3.2)
ZTE USB Driver (Version: 1.0.1.5_Turkcell)
==================== Restore Points =========================
17-10-2013 22:03:29 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:04 - 2013-10-18 13:33 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
Task: {00AC3588-F115-444A-ABD0-93570EAF801B} - System32\Tasks\{9E14ADC3-014D-4A79-87AF-735E769D2294} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {16A38688-0E30-401D-ADD7-272B1C07BAA0} - System32\Tasks\{D912E601-65A8-4EA4-9BDA-55202B39B343} => Chrome.exe hxxp://ui.skype.com/ui/0/6.3.66.105/de/go/help.faq.installer?LastError=1618
Task: {1BF3961C-D6C8-45A8-A146-D677174205BC} - System32\Tasks\AmiUpdXp => C:\Users\armin.basten\AppData\Local\SwvUpdater\Updater.exe
Task: {1CC7CCC9-30F7-4237-96A2-6DFD41554BDD} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {267CEBFB-42AD-4935-A087-4535A557E249} - System32\Tasks\AdobeFlashPlayerUpdate 2 => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {4ED61137-C6ED-4E41-8178-74B22D617E22} - System32\Tasks\{5D468662-5516-4BBC-8503-ACD84219E1FB} => Chrome.exe hxxp://ui.skype.com/ui/0/6.3.66.105/de/go/help.faq.installer?LastError=1618
Task: {6EC248CA-255C-4EB8-AE09-D5306C0ED2FA} - System32\Tasks\{A3FB6368-314A-482B-9579-0CA6E53194D3} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {789F4F36-BCBB-4F01-8CBA-136DF573AD7A} - System32\Tasks\DealPlyUpdate => C:\Program
Task: {91C8F6E6-1DAF-476B-9965-D00AF65BF694} - System32\Tasks\{7E7FF179-F4F8-4C7B-A246-B94C10BE5A48} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {92FF716D-60AD-4F4F-AA69-E68EC7148041} - System32\Tasks\AdobeFlashPlayerUpdate => C:\Windows\system32\FlashPlayerUpdateService.exe
Task: {9E50076B-5350-4E37-8DCB-8476B6480124} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04] (Google Inc.)
Task: {A4CE552A-9A7F-4C36-9574-125690A46CDE} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04] (Google Inc.)
Task: {D12C3D3E-D9B0-4CD6-8647-DAB7AA0E967C} - System32\Tasks\{25A0B681-AEE8-4F2E-9F3C-7DDD726AAC5A} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: {DCD67A11-71BC-4DF6-B58B-ED2DE2D2B092} - System32\Tasks\{F38BB4CB-5BD7-4E3B-A0A5-7BDC59B1050F} => C:\Program Files\Skype\\Phone\Skype.exe [2013-10-02] (Skype Technologies S.A.)
Task: {E297CBDB-E008-4B41-A4D6-7962CE15DB5B} - System32\Tasks\BrowserProtect => Sc.exe start BrowserProtect
Task: {EF41E1B1-2590-4F8B-9BB2-CFDB5040688C} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {FC548396-9875-4F3D-8EC9-E821867AF3DD} - System32\Tasks\{FC749B2D-4412-4C4C-813B-5144CC89805F} => C:\Users\armin.basten\Downloads\1832201\setup.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core.job => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA.job => C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe
==================== Loaded Modules (whitelisted) =============
2012-02-20 20:29 - 2012-02-20 20:29 - 00087912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2012-02-20 20:28 - 2012-02-20 20:28 - 01242472 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2011-07-18 23:04 - 2011-07-18 23:04 - 00296448 _____ () C:\Program Files\Notepad++\NppShell_04.dll
2013-08-07 21:25 - 2013-08-07 21:25 - 00093696 _____ () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 00709584 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\libglesv2.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 00099792 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\libegl.dll
2010-05-10 03:24 - 2010-05-10 03:24 - 00581632 _____ () C:\Program Files\Wetelecom\sqlite3.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 04053456 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 00410576 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 01604560 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ffmpegsumo.dll
2013-09-04 08:26 - 2013-09-02 22:35 - 13599184 _____ () C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll
==================== Alternate Data Streams (whitelisted) =========
AlternateDataStreams: C:\ProgramData\TEMP:8CE646EE
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:AFP_AfpInfo
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:com.apple.metadata?kMDItemWhereFroms
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:com.apple.quarantine
AlternateDataStreams: C:\Users\armin.basten\Downloads\BonjourPSSetup.exe:Mac_Metadata
==================== Safe Mode (whitelisted) ===================
==================== Faulty Device Manager Devices =============
Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/09/2013 04:02:12 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pniopcac.exe, Version: 8.1.1.4312, Zeitstempel: 0x4ea68e07
Name des fehlerhaften Moduls: pniopcac.exe, Version: 8.1.1.4312, Zeitstempel: 0x4ea68e07
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000387a4
ID des fehlerhaften Prozesses: 0x2d04
Startzeit der fehlerhaften Anwendung: 0xpniopcac.exe0
Pfad der fehlerhaften Anwendung: pniopcac.exe1
Pfad des fehlerhaften Moduls: pniopcac.exe2
Berichtskennung: pniopcac.exe3
Error: (10/05/2013 07:31:22 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: WLANExt.exe, Version: 6.1.7600.16385, Zeitstempel: 0x4a5bc89a
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db96c5
Ausnahmecode: 0xc0000008
Fehleroffset: 0x00081f84
ID des fehlerhaften Prozesses: 0xaa8
Startzeit der fehlerhaften Anwendung: 0xWLANExt.exe0
Pfad der fehlerhaften Anwendung: WLANExt.exe1
Pfad des fehlerhaften Moduls: WLANExt.exe2
Berichtskennung: WLANExt.exe3
Error: (10/03/2013 03:58:31 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: pniopcac.exe, Version: 8.1.1.4312, Zeitstempel: 0x4ea68e07
Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.18205, Zeitstempel: 0x51db96c5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0003224d
ID des fehlerhaften Prozesses: 0xfe0
Startzeit der fehlerhaften Anwendung: 0xpniopcac.exe0
Pfad der fehlerhaften Anwendung: pniopcac.exe1
Pfad des fehlerhaften Moduls: pniopcac.exe2
Berichtskennung: pniopcac.exe3
Error: (09/30/2013 10:29:43 AM) (Source: LCSVRADM) (User: NT-AUTORITÄT)
Description: LoadLibrary Instdllu.dll failed.
Error: (09/29/2013 11:10:00 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 7e8
Startzeit: 01cebd5814ee1b6d
Endzeit: 16
Anwendungspfad: F:\crack\keygen.exe
Berichts-ID: 7f0f394c-294b-11e3-924a-001060d1bbab
Error: (09/29/2013 11:08:34 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: d10
Startzeit: 01cebd57fd41abf3
Endzeit: 0
Anwendungspfad: F:\crack\keygen.exe
Berichts-ID: 4ae08eca-294b-11e3-924a-001060d1bbab
Error: (09/29/2013 10:30:01 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 1038
Startzeit: 01cebd525a377337
Endzeit: 0
Anwendungspfad: F:\crack\keygen.exe
Berichts-ID: e7a72828-2945-11e3-924a-001060d1bbab
Error: (09/29/2013 10:26:06 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 9ac
Startzeit: 01cebd515bec562f
Endzeit: 0
Anwendungspfad: F:\crack\keygen.exe
Berichts-ID: 5a4c3bf1-2945-11e3-924a-001060d1bbab
Error: (09/29/2013 10:16:16 PM) (Source: Application Hang) (User: )
Description: Programm keygen.exe, Version 0.0.0.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.
Prozess-ID: 17e4
Startzeit: 01cebd5075d343d2
Endzeit: 15
Anwendungspfad: F:\crack\keygen.exe
Berichts-ID: fb993cc0-2943-11e3-924a-001060d1bbab
Error: (09/29/2013 01:47:02 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: etka7.exe, Version: 7.4.0.1643, Zeitstempel: 0x51fa2794
Name des fehlerhaften Moduls: EtUpdCon.dll, Version: 1.0.0.2, Zeitstempel: 0x4e799e51
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000041ec
ID des fehlerhaften Prozesses: 0x1338
Startzeit der fehlerhaften Anwendung: 0xetka7.exe0
Pfad der fehlerhaften Anwendung: etka7.exe1
Pfad des fehlerhaften Moduls: etka7.exe2
Berichtskennung: etka7.exe3
System errors:
=============
Error: (10/18/2013 03:02:49 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.
Error: (10/18/2013 03:02:31 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.
Error: (10/18/2013 03:02:10 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.
Error: (10/18/2013 02:10:15 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)
Error: (10/18/2013 02:09:53 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Gemeinsame Nutzung der Internetverbindung" wurde nicht richtig gestartet.
Error: (10/18/2013 02:08:47 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTLOKALER DIENSTS-1-5-19LocalHost (unter Verwendung von LRPC)
Error: (10/18/2013 02:07:16 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows-Firewall" wurde mit folgendem dienstspezifischem Fehler beendet: %%13.
Error: (10/18/2013 02:06:55 PM) (Source: EventLog) (User: )
Description: Das System wurde zuvor am 18.10.2013 um 14:05:32 unerwartet heruntergefahren.
Error: (10/18/2013 01:58:40 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Error: (10/18/2013 01:48:51 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PEVSystemStart" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren.
Microsoft Office Sessions:
=========================
Error: (08/19/2013 00:39:11 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 1010 seconds with 480 seconds of active time. This session ended with a crash.
Error: (08/16/2013 00:21:09 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 27 seconds with 0 seconds of active time. This session ended with a crash.
Error: (08/16/2013 04:34:31 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash.
Error: (07/03/2012 08:09:15 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2664 seconds with 1980 seconds of active time. This session ended with a crash.
Error: (06/11/2012 08:00:40 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1274 seconds with 600 seconds of active time. This session ended with a crash.
Error: (03/16/2012 10:25:39 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6654.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 813 seconds with 720 seconds of active time. This session ended with a crash.
Error: (03/14/2012 00:07:00 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6654.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 18712 seconds with 5040 seconds of active time. This session ended with a crash.
==================== Memory info ===========================
Percentage of memory in use: 52%
Total physical RAM: 2997.86 MB
Available physical RAM: 1413.11 MB
Total Pagefile: 5991.95 MB
Available Pagefile: 3694.89 MB
Total Virtual: 2047.88 MB
Available Virtual: 1899.17 MB
==================== Drives ================================
Drive c: (System) (Fixed) (Total:50 GB) (Free:2.91 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Data) (Fixed) (Total:182.88 GB) (Free:43.05 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 8BC4714F)
Partition 1: (Active) - (Size=50 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=183 GB) - (Type=07 NTFS)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-18 18:17:13
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00 232,89GB
Running: 0i2g6zy8.exe; Driver: C:\Users\ARMIN~1.BAS\AppData\Local\Temp\kgriruog.sys
---- System - GMER 2.1 ----
SSDT 91DA3336 ZwCreateSection
SSDT 91DA3340 ZwRequestWaitReplyPort
SSDT 91DA333B ZwSetContextThread
SSDT 91DA3345 ZwSetSecurityObject
SSDT 91DA334A ZwSystemDebugControl
SSDT 91DA32D7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwRollbackEnlistment + 1409 838729A5 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 83892512 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 14BF 83899AB4 4 Bytes [36, 33, DA, 91] {XOR EBX, EDX; XCHG ECX, EAX}
.text ntoskrnl.exe!KeRemoveQueueEx + 181B 83899E10 4 Bytes [40, 33, DA, 91] {INC EAX; XOR EBX, EDX; XCHG ECX, EAX}
.text ntoskrnl.exe!KeRemoveQueueEx + 185F 83899E54 4 Bytes [3B, 33, DA, 91]
.text ntoskrnl.exe!KeRemoveQueueEx + 18DB 83899ED0 4 Bytes [45, 33, DA, 91] {INC EBP; XOR EBX, EDX; XCHG ECX, EAX}
.text ntoskrnl.exe!KeRemoveQueueEx + 192F 83899F24 4 Bytes [4A, 33, DA, 91] {DEC EDX; XOR EBX, EDX; XCHG ECX, EAX}
.text ...
.text C:\Windows\system32\drivers\hardlock.sys section is writeable [0xA15C9400, 0x87EE2, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620] C:\Windows\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620]
.protectÿÿÿÿhardlockunknown last code section [0xA166D400, 0x5126, 0xE0000020] C:\Windows\system32\drivers\hardlock.sys unknown last code section [0xA166D400, 0x5126, 0xE0000020]
? C:\Windows\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
Device \Driver\BTHUSB \Device\0000009f bthport.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\{4714AF41-F5B2-11d3-919D-00D0B71030AD}@IndexT -1338417521
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Alive 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@UDN uuid:1108ad33-bd15-4c8e-8b23-da7087643dc1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@SerialNumber {4866A119-52BE-4828-B58B-C0E2F5FD19EF}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@FriendlyName KIS-FIELD-PG: armin.basten:
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelName Windows Media Player Sharing
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelNumber 12.0
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelURL hxxp://go.microsoft.com/fwlink/?LinkId=105926
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ManufacturerURL hxxp://www.microsoft.com/
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Manufacturer Microsoft Corporation
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkInterface {E29AC6C2-7037-11DE-816D-806E6F6E6963}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIPCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIP0 127.0.0.0/8
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@RemoteURLCount 0
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IPAddress 127.0.0.1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IconFileName C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files\1108ad33-bd15-4c8e-8b23-da7087643dc1.png
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch@VirtualStoreSize 1798
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex@LazyCheckPointUpdateInterval 86400
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\armin.basten\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe 1
---- EOF - GMER 2.1 ----
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-10-18 18:17:13
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00 232,89GB
Running: 0i2g6zy8.exe; Driver: C:\Users\ARMIN~1.BAS\AppData\Local\Temp\kgriruog.sys
---- System - GMER 2.1 ----
SSDT 91DA3336 ZwCreateSection
SSDT 91DA3340 ZwRequestWaitReplyPort
SSDT 91DA333B ZwSetContextThread
SSDT 91DA3345 ZwSetSecurityObject
SSDT 91DA334A ZwSystemDebugControl
SSDT 91DA32D7 ZwTerminateProcess
---- Kernel code sections - GMER 2.1 ----
.text ntoskrnl.exe!ZwRollbackEnlistment + 1409 838729A5 1 Byte [06]
.text ntoskrnl.exe!KiDispatchInterrupt + 5A2 83892512 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntoskrnl.exe!KeRemoveQueueEx + 14BF 83899AB4 4 Bytes [36, 33, DA, 91] {XOR EBX, EDX; XCHG ECX, EAX}
.text ntoskrnl.exe!KeRemoveQueueEx + 181B 83899E10 4 Bytes [40, 33, DA, 91] {INC EAX; XOR EBX, EDX; XCHG ECX, EAX}
.text ntoskrnl.exe!KeRemoveQueueEx + 185F 83899E54 4 Bytes [3B, 33, DA, 91]
.text ntoskrnl.exe!KeRemoveQueueEx + 18DB 83899ED0 4 Bytes [45, 33, DA, 91] {INC EBP; XOR EBX, EDX; XCHG ECX, EAX}
.text ntoskrnl.exe!KeRemoveQueueEx + 192F 83899F24 4 Bytes [4A, 33, DA, 91] {DEC EDX; XOR EBX, EDX; XCHG ECX, EAX}
.text ...
.text C:\Windows\system32\drivers\hardlock.sys section is writeable [0xA15C9400, 0x87EE2, 0xE8000020]
.protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620] C:\Windows\system32\drivers\hardlock.sys entry point in ".protectÿÿÿÿhardlockentry point in ".protectÿÿÿÿhardlockentry point in ".p" section [0xA166D620]
.protectÿÿÿÿhardlockunknown last code section [0xA166D400, 0x5126, 0xE0000020] C:\Windows\system32\drivers\hardlock.sys unknown last code section [0xA166D400, 0x5126, 0xE0000020]
? C:\Windows\system32\Drivers\PROCEXP113.SYS Das System kann die angegebene Datei nicht finden. !
---- Devices - GMER 2.1 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys
Device \Driver\BTHUSB \Device\0000009f bthport.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\{4714AF41-F5B2-11d3-919D-00D0B71030AD}@IndexT -1338417521
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Alive 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@UDN uuid:1108ad33-bd15-4c8e-8b23-da7087643dc1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@SerialNumber {4866A119-52BE-4828-B58B-C0E2F5FD19EF}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@FriendlyName KIS-FIELD-PG: armin.basten:
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelName Windows Media Player Sharing
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelNumber 12.0
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ModelURL hxxp://go.microsoft.com/fwlink/?LinkId=105926
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@ManufacturerURL hxxp://www.microsoft.com/
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@Manufacturer Microsoft Corporation
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkInterface {E29AC6C2-7037-11DE-816D-806E6F6E6963}
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIPCount 1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@NetworkIP0 127.0.0.0/8
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@RemoteURLCount 0
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IPAddress 127.0.0.1
Reg HKLM\SOFTWARE\Microsoft\Windows Media Player NSS\3.0\Servers\1108AD33-BD15-4C8E-8B23-DA7087643DC1@IconFileName C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows Media Player NSS\3.0\Icon Files\1108ad33-bd15-4c8e-8b23-da7087643dc1.png
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Superfetch@VirtualStoreSize 1798
Reg HKLM\SOFTWARE\Microsoft\Windows Search\Gather\Windows\SystemIndex@LazyCheckPointUpdateInterval 86400
Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\armin.basten\AppData\Local\Logitech\xae Webcam-Software\Logishrd\LU2.0\LogitechUpdate.exe 1
---- EOF - GMER 2.1 ----
|
|
18.10.2013, 16:10
| #2 | |
| /// the machine /// TB-Ausbilder    | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
18.10.2013, 17:05
| #3 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Danke Schrauber!!!
__________________Code:
ATTFilter ComboFix 13-10-16.02 - armin.basten 18.10.2013 19:34:53.4.2 - x86
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.49.1031.18.2998.1486 [GMT 2:00]
ausgeführt von:: c:\users\armin.basten\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-09-18 bis 2013-10-18 ))))))))))))))))))))))))))))))
.
.
2013-10-18 17:50 . 2013-10-18 17:50 -------- d-----w- c:\users\Public\AppData\Local\temp
2013-10-18 17:50 . 2013-10-18 17:50 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-10-18 14:10 . 2013-10-18 14:10 -------- d-----w- C:\FRST
2013-10-18 13:42 . 2013-10-18 13:42 -------- d-----w- c:\users\armin.basten\AppData\Roaming\DigitalSite
2013-10-18 11:30 . 2013-10-18 17:52 -------- d-----w- c:\users\armin.basten\AppData\Local\temp
2013-10-18 06:39 . 2013-10-18 14:23 -------- d-----w- c:\program files\Wetelecom
2013-10-17 10:52 . 2013-10-17 10:52 -------- d-----w- c:\program files\Bonjour Print Services
2013-10-10 13:31 . 2013-09-04 01:14 76288 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2013-10-10 13:31 . 2013-09-04 01:14 43008 ----a-w- c:\windows\system32\drivers\usbehci.sys
2013-10-10 13:31 . 2013-09-04 01:15 258560 ----a-w- c:\windows\system32\drivers\usbhub.sys
2013-10-10 13:31 . 2013-09-04 01:14 284672 ----a-w- c:\windows\system32\drivers\usbport.sys
2013-10-10 13:31 . 2013-09-04 01:14 20480 ----a-w- c:\windows\system32\drivers\usbohci.sys
2013-10-10 13:31 . 2013-09-04 01:14 24064 ----a-w- c:\windows\system32\drivers\usbuhci.sys
2013-10-10 13:31 . 2013-09-04 01:14 6016 ----a-w- c:\windows\system32\drivers\usbd.sys
2013-10-10 05:05 . 2013-09-22 23:28 817664 ----a-w- c:\program files\Common Files\Microsoft Shared\VGX\VGX.dll
2013-10-10 05:05 . 2013-09-22 23:54 770648 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2013-10-10 05:05 . 2013-09-22 23:28 1767936 ----a-w- c:\windows\system32\wininet.dll
2013-10-09 21:47 . 2013-06-25 22:56 527064 ----a-w- c:\windows\system32\drivers\Wdf01000.sys
2013-09-30 15:00 . 2013-09-30 15:00 -------- d-----w- C:\VW
2013-09-30 10:36 . 2013-09-30 10:36 -------- d-----w- c:\programdata\Western Digital
2013-09-29 20:12 . 2013-09-29 21:11 -------- d-----w- c:\program files\Diagnose-BK
2013-09-29 20:10 . 1996-11-05 13:13 299008 ----a-w- c:\windows\uninst.exe
2013-09-28 10:12 . 2011-06-21 08:24 32768 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2013-09-28 10:12 . 2013-09-29 11:57 -------- d-----w- c:\program files\Spyware Terminator
2013-09-27 21:28 . 2012-12-10 08:04 81920 ----a-w- c:\windows\eSellerateControl350.dll
2013-09-27 21:28 . 2012-12-10 08:04 356352 ----a-w- c:\windows\eSellerateEngine.dll
2013-09-27 21:28 . 2009-07-23 15:32 274432 ----a-w- c:\windows\system32\ssleay32.dll
2013-09-27 21:28 . 2009-07-23 15:32 1122304 ----a-w- c:\windows\system32\libeay32.dll
2013-09-27 21:28 . 2013-09-28 04:10 -------- d-----w- c:\program files\Browser Protect Removal Tool
2013-09-27 20:29 . 2013-09-27 20:37 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2013-09-27 20:27 . 2013-09-27 20:27 -------- d-----w- c:\users\armin.basten\AppData\Local\Programs
2013-09-27 18:34 . 2013-09-27 18:34 -------- d-----w- c:\program files\Enigma Software Group
2013-09-27 18:32 . 2013-09-27 20:22 -------- d-----w- c:\windows\865537E164904193A4B6669C62711852.TMP
2013-09-21 06:52 . 2008-11-23 07:23 97792 ----a-w- c:\windows\system32\drivers\NSHE.SYS
2013-09-21 06:48 . 2013-09-21 06:48 191488 ----a-w- c:\windows\system32\hlvdd.dll
2013-09-21 06:48 . 2006-12-20 07:00 671112 ----a-w- c:\windows\system32\hdinst_windows.dll
2013-09-21 06:48 . 2006-11-30 08:06 69632 ----a-w- c:\windows\system32\hasp_inst_help1.dll
2013-09-21 06:48 . 2005-09-06 14:06 28672 ----a-w- c:\windows\system32\hlduinst.exe
2013-09-21 06:48 . 2006-12-20 08:55 3066968 ----a-w- c:\windows\system32\hinstd.dll
2013-09-21 06:48 . 2006-12-20 07:00 2511360 ----a-w- c:\windows\system32\haspds_windows.dll
2013-09-21 06:15 . 2013-09-29 12:02 -------- d-----w- c:\windows\ETKA7.4_Germany
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-10-01 14:00 . 2013-05-06 08:45 67680 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-10-01 14:00 . 2012-11-05 04:14 89376 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-10-01 14:00 . 2012-11-05 04:14 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-10-01 14:00 . 2012-11-05 04:14 137208 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-09-28 05:32 . 2012-05-11 17:25 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-09-28 05:32 . 2011-07-27 13:02 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-09-05 05:02 . 2013-10-17 22:05 7328304 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A4C0FD0F-A2A1-4EA9-8A4B-DB139921A3E0}\mpengine.dll
2013-08-07 02:22 . 2011-07-27 11:50 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-08-05 01:56 . 2013-09-11 12:26 133056 ----a-w- c:\windows\system32\drivers\ataport.sys
2013-08-02 01:50 . 2013-09-11 12:25 169984 ----a-w- c:\windows\system32\winsrv.dll
2013-08-02 01:49 . 2013-09-11 12:25 293376 ----a-w- c:\windows\system32\KernelBase.dll
2013-08-02 01:48 . 2013-09-11 12:25 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
2013-08-02 01:48 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll
2013-08-02 00:52 . 2013-09-11 12:25 271360 ----a-w- c:\windows\system32\conhost.exe
2013-08-02 00:43 . 2013-09-11 12:25 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
2013-08-02 00:43 . 2013-09-11 12:25 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
2013-08-02 00:43 . 2013-09-11 12:25 3584 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
2013-08-02 00:43 . 2013-09-11 12:25 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
2013-07-25 08:57 . 2013-08-15 00:18 1620992 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-25 07:29 . 2013-07-25 07:29 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-07-25 07:29 . 2012-08-16 19:09 867240 ----a-w- c:\windows\system32\npdeployJava1.dll
2013-07-25 07:29 . 2011-10-30 06:57 789416 ----a-w- c:\windows\system32\deployJava1.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-10-01 681032]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2013-08-16 152392]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"LoadMdm"="c:\program files\Wetelecom\LoadMdm.exe" [2010-09-13 397312]
.
c:\users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
RT-Updater.lnk - d:\program files\VCDS\VCDS.EXE Update [2013-9-9 1430104]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2011-09-27 19:03 66328 ----a-w- c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=c:\windows\pss\Bluetooth Manager.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Status Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Status Monitor.lnk
backup=c:\windows\pss\Status Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKLM\~\startupfolder\C:^Users^armin.basten^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk]
path=c:\users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Logitech . Produktregistrierung.lnk
backup=c:\windows\pss\Logitech . Produktregistrierung.lnk.Startup
backupExtension=.Startup
.
[HKLM\~\startupfolder\C:^Users^armin.basten^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk]
path=c:\users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk
backup=c:\windows\pss\Tintenwarnungen überwachen - HP Photosmart 5510d series (Netzwerk).lnk.Startup
backupExtension=.Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\9de5]
c:\users\armin.basten\AppData\Roaming\8bf\9de5.js [X]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2013-04-04 21:06 958576 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2013-04-21 19:43 59720 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2013-03-14 08:23 3672640 ----a-w- d:\program files\DAEMON Tools\DTLite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6]
2011-10-07 09:40 1387288 ----a-w- c:\program files\Logitech\SetPointP\SetPoint.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2011-12-04 12:34 136176 ----atw- c:\users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2011-02-11 17:26 171032 ----a-w- c:\windows\System32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Photosmart 5510d series (NET)]
2011-08-16 06:47 1804648 ----a-w- c:\program files\HP\HP Photosmart 5510d series\Bin\ScanToPCActivationApp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-05-09 23:41 49208 ----a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2011-02-11 17:26 137752 ----a-w- c:\windows\System32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelWireless]
2010-07-19 15:26 1206544 ----a-w- c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ITSecMng]
2009-07-22 11:40 83336 ----a-w- c:\program files\Toshiba\Bluetooth Toshiba Stack\ItSecMng.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2013-08-16 07:07 152392 ----a-w- d:\program files\iTunes\iTunesHelper.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Download Assistant]
2010-11-03 17:50 1246544 ----a-w- c:\windows\System32\LogiLDA.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LWS]
2011-11-11 11:08 205336 ----a-w- c:\program files\Logitech\LWS\Webcam Software\LWS.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2011-02-11 17:26 172568 ----a-w- c:\windows\System32\igfxpers.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S7UB Start]
2010-06-03 00:29 102453 ----a-w- c:\program files\Common Files\Siemens\S7UBTOOX\S7ubTstx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2010-11-20 00:17 1174016 ----a-w- c:\program files\Windows Sidebar\sidebar.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiemensAutomationFileStorage]
2011-04-13 20:42 806912 ----a-w- c:\program files\Siemens\Automation\Portal V11\Bin\Siemens.Automation.ObjectFrame.FileStorage.Server.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2013-10-02 10:11 20473504 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2013-03-12 05:32 253816 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2009-08-28 08:32 1557800 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinCC flexible Smart Start]
2011-12-14 04:07 118784 ----a-w- c:\program files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008\HmiSmartStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Xvid]
2011-01-17 19:41 8192 ----a-w- c:\program files\Xvid\CheckUpdate.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"="1"
"FirewallOverride"="1"
.
R2 CCAgent;CCAgent;c:\program files\Common Files\Siemens\ACE\bin\CCAgent.exe [2009-07-16 344064]
R2 CCEServer;CCEServer;c:\program files\Common Files\Siemens\ace\bin\CCEServer.exe [2009-07-16 237568]
R2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [2013-09-05 171680]
R3 ALSysIO;ALSysIO;c:\users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
R3 CCEClient;CCEClient;c:\program files\Common Files\Siemens\ace\bin\CCEClient.exe [2009-07-16 262144]
R3 dpmcslv;dpmcslv; [x]
R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
R3 EverestDriver;Lavalys EVEREST Kernel Driver;c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
R3 ew_hwusbdev;Huawei MobileBroadband USB PNP Device;c:\windows\system32\DRIVERS\ew_hwusbdev.sys [x]
R3 ewusbmbb;HUAWEI USB-WWAN miniport;c:\windows\system32\DRIVERS\ewusbwwan.sys [2011-05-31 349184]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppcbulkio.sys [2011-05-10 20504]
R3 huawei_enumerator;huawei_enumerator;c:\windows\system32\DRIVERS\ew_jubusenum.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 IAMT03;Driver for Intel(R) Active Management Technology - KCS;c:\windows\system32\DRIVERS\IAMT03.sys [2007-04-11 40848]
R3 IAMTV;Driver for Intel(R) Active Management Technology - KCS;c:\windows\system32\DRIVERS\IAMTV.sys [2007-04-11 38288]
R3 IAMTXP;Driver for Intel(R) Active Management Technology - KCS;c:\windows\system32\DRIVERS\IAMTXP.sys [2007-04-11 47496]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\Drivers\LEqdUsb.Sys [2011-04-30 42648]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\Drivers\LHidEqd.Sys [2011-04-30 12184]
R3 massfilter;MBB Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-07-19 227600]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl.sys [2011-08-02 18432]
R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETw5s32.sys [2010-01-13 6755840]
R3 PROFIpnp;PROFIBUS PnP Hardware Driver (Softing); [x]
R3 PROFIusb;PROFIusb Device Driver (Softing AG); [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 14848]
R3 RedundancyControl;RedundancyControl;c:\program files\Common Files\Siemens\ace\bin\RedundancyControl.exe [2009-07-16 430080]
R3 RedundancyState;RedundancyState;c:\program files\Common Files\Siemens\ace\bin\RedundancyState.exe [2009-07-16 180224]
R3 RT-USB;Ross-Tech USB driver;c:\windows\system32\drivers\RT-USB.SYS [2010-06-16 59464]
R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 49664]
R3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [x]
R3 usbbulk;USBBulk driver;c:\windows\system32\Drivers\USBBulk.sys [2008-07-04 18776]
R3 VGPU;VGPU;c:\windows\system32\drivers\rdvgkmd.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-09 1343400]
R3 wmdusbser;Wetelecom USB Device for Legacy Serial Communication;c:\windows\system32\DRIVERS\wmdusbser.sys [2010-06-11 107136]
R3 WSDScan;WSD-Scanunterstützung durch UMB;c:\windows\system32\drivers\WSDScan.sys [2009-07-14 20480]
R3 ZTEusbMB;ZTE NMEAExt2 Port;c:\windows\system32\DRIVERS\ZTEusbnmeaext2.sys [2011-07-04 107520]
R3 ZTEusbwwan;ZTE MBN Miniport;c:\windows\system32\DRIVERS\ZTEusbwwan.sys [2011-12-01 195072]
R4 BrowserProtect;BrowserProtect;c:\programdata\BrowserProtect\2.6.1519.190\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe [x]
R4 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-02 3064000]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-01 37352]
S1 dpmconv;SIMATIC NET DP Driver;c:\windows\system32\DRIVERS\dpmconv32.sys [2010-04-28 288256]
S1 DPMTRCDD;SIMATIC NET Softnet Trace Driver;c:\windows\system32\DRIVERS\DPMTRCDD32.sys [2010-03-22 72248]
S1 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2013-03-23 242240]
S1 vsnl2ada;SIMATIC NET FDL Driver;c:\windows\system32\DRIVERS\vsnl2ada32.sys [2010-03-22 98944]
S2 almservice;Automation License Manager Service;c:\program files\Common Files\Siemens\sws\almsrv\almsrvx.exe [2011-12-11 1138312]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-10-01 440392]
S2 HP DS Service;HP DS Service;c:\program files\HP\HPBDSService\HPBDSService.exe [2010-10-27 13824]
S2 LcSvrAdm;ELSA Administration Service;d:\elsawin\bin\LcSvrAdm.exe [2011-12-06 240640]
S2 LcSvrDba;ELSA DBA Server;d:\elsawin\bin\LcSvrDba.exe [2011-12-06 392704]
S2 LcSvrHis;ELSA Historie Server;d:\elsawin\bin\LcSvrHis.exe [2011-12-06 335360]
S2 LcSvrPAS;ELSA PASS Server;d:\elsawin\bin\LcSvrPas.exe [2011-12-06 477696]
S2 LcSvrSaz;ELSA APOSpro Server;d:\elsawin\bin\LcSvrSaz.exe [2011-12-06 373248]
S2 MSSQL$WINCCFLEXEXPRESS;SQL Server (WINCCFLEXEXPRESS);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 MSSQL$WINCCPLUS;SQL Server (WINCCPLUS);c:\program files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 MSSQL$WINCCPLUSMIG;SQL Server (WINCCPLUSMIG);c:\program files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [2010-12-10 29293408]
S2 NSHE;Guardant Emulator Driver;c:\windows\system32\Drivers\NSHE.SYS [2008-11-23 97792]
S2 PROFIbrd;PROFIBUS V5 Hardware Driver (Softing); [x]
S2 PROFIprt;PROFIBUS Protocol Driver (Softing); [x]
S2 PROFIstack;PROFIBUS V6 Hardware Driver (Softing); [x]
S2 s7hspsvx;S7 HSP Service;c:\program files\Siemens\Step7\s7bin\s7hspsvx.exe [2010-06-02 61493]
S2 s7oiehsx;SIMATIC IEPG Help Service;c:\program files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [2011-11-03 412808]
S2 S7opcsrtx;PROFINET IO RT-Protocol (LLDP);c:\windows\system32\DRIVERS\s7opcsrtx.sys [2011-02-22 31744]
S2 s7ousbu32x;SIMATIC USB Service;c:\windows\system32\DRIVERS\s7ousbu32x.sys [2011-09-29 641280]
S2 s7sn2srtx;PROFINET IO RT-Protocol V2.0;c:\windows\system32\DRIVERS\s7sn2srtx.sys [2011-06-16 63104]
S2 s7snsrtx;PROFINET IO RT-Protocol V1.0;c:\windows\system32\DRIVERS\s7snsrtx.sys [2009-02-24 73088]
S2 S7TraceServiceX;S7TraceServiceX;c:\program files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [2011-11-03 556168]
S2 SCSMonitor;SCSMonitor;c:\program files\Common Files\Siemens\ace\bin\SCSMX.exe [2009-07-16 167936]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2010-06-09 5120]
S2 TeamViewer8;TeamViewer 8;c:\program files\TeamViewer\Version8\TeamViewer_Service.exe [2013-07-08 4153184]
S2 UA Local Discovery Server;UA Local Discovery Server;c:\program files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [2010-05-05 28160]
S2 UMVPFSrv;UMVPFSrv;c:\program files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [2012-01-18 450848]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-09 2320920]
S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-07-19 225280]
S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k6232.sys [2010-04-05 224424]
S3 fwkbdrtm;fwkbdrtm;c:\windows\system32\drivers\fwkbdrtm.sys [2011-12-06 21464]
S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-07-19 47104]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 132480]
S3 LcSvrAuf;ELSA Auftragsverwaltungs Service;d:\elsawin\bin\LcSvrAuf.exe [2011-12-06 1321472]
S3 NETwNs32;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\DRIVERS\NETwNs32.sys [2010-07-14 6814720]
S3 S7odpx2x32;SIMATIC Knotentaufe;c:\windows\system32\Drivers\S7odpx2x32.sys [2011-05-06 87552]
S3 s7opciax32;SIMATIC CP 5611;c:\windows\system32\DRIVERS\s7opciax32.sys [2011-06-22 227840]
S3 s7otmcd32x;SIMATIC Memory Cards;c:\windows\system32\Drivers\s7otmcd32x.sys [2011-05-06 256512]
S3 S7otranx32;SIMATIC Transport;c:\windows\system32\Drivers\S7otranx32.sys [2011-05-06 521216]
S3 s7otsadx32;SIMATIC TS Adapter RS232-32;c:\windows\system32\Drivers\s7otsadx32.sys [2011-09-29 182784]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core.job
- c:\users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04 12:34]
.
2013-09-12 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA.job
- c:\users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-04 12:34]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://www.google.de/
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
Trusted Zone: samsungsetup.com\www
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: NameServer = 8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\EverestDriver]
"ImagePath"="\??\c:\program files\Lavalys\EVEREST Home Edition\kerneld.wnt"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\WLANExt.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\windows\system32\conhost.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\DllHost.exe
c:\program files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files\Common Files\Intel\WirelessCommon\RegSrvc.exe
c:\program files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
c:\windows\system32\conhost.exe
c:\program files\Common Files\Siemens\SimNetCom\pniopcac.exe
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
c:\program files\Intel\WiFi\bin\EvtEng.exe
c:\program files\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wbem\unsecapp.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-10-18 20:01:07 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-10-18 18:01
ComboFix2.txt 2013-10-18 12:58
ComboFix3.txt 2013-10-18 11:42
.
Vor Suchlauf: 3.076.698.112 Bytes frei
Nach Suchlauf: 2.889.506.816 Bytes frei
.
- - End Of File - - 3B4DA9B691BE1CE46053E91BD8C2A732
5C616939100B85E558DA92B899A0FC36
|
|
19.10.2013, 07:58
| #4 |
| /// the machine /// TB-Ausbilder | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.10.2013, 08:21
| #5 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Und weiter geht es: Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.18.11 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16721 armin.basten :: KIS-FIELD-PG [Administrator] 19.10.2013 01:00:29 mbam-log-2013-10-19 (01-00-29).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 270645 Laufzeit: 19 Minute(n), 41 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 8 HKCR\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} (PUP.Optional.Delta.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DigitalSite (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\BabylonToolbar (PUP.Optional.BabylonToolBar.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DataMngr_Toolbar (PUP.Optional.DataMngr.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\1ClickDownload (PUP.Optional.1ClickDownload.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings (PUP.Optional.BProtector.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\DEALPLY (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 4 HKCU\SOFTWARE\DealPly|Partner (PUP.Optional.DealPly.A) -> Daten: dpmnt -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|bProtector Start Page (PUP.BProtector) -> Daten: hxxp://search.babylon.com/?affID=119816&babsrc=HP_ss_din2g&mntrId=FECE001060D1BBAB -> Erfolgreich gelöscht und in Quarantäne gestellt. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|bProtectorDefaultScope (PUP.BProtector) -> Daten: {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\DealPly|ChromeCrxPath (PUP.Optional.DealPly.A) -> Daten: C:\Program Files\DealPly\DealPly.crx -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateiobjekte der Registrierung: 1 HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel|HomePage (PUM.Hijack.HomePageControl) -> Bösartig: (1) Gut: (0) -> Erfolgreich ersetzt und in Quarantäne gestellt. Infizierte Verzeichnisse: 7 C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\Babylon (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\Dealply (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\Dealply\UpdateProc (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\BabSolution (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\BabSolution\Shared (PUP.Optional.BabSolution.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\File Scout (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Dateien: 8 C:\Users\armin.basten\AppData\Roaming\File Scout\filescout.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc\config.dat (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc\prod.dat (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe (PUP.Optional.DigitalSite.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\Babylon\log_file.txt (PUP.Optional.Babylon.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\Dealply\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\Dealply\UpdateProc\TTL.DAT (PUP.Optional.DealPly.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Users\armin.basten\AppData\Roaming\File Scout\uninst.exe (PUP.Optional.FileScout.A) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) Code:
ATTFilter # AdwCleaner v3.008 - Bericht erstellt am 19/10/2013 um 06:01:05
# Updated 17/10/2013 von Xplode
# Betriebssystem : Windows 7 Ultimate Service Pack 1 (32 bits)
# Benutzername : armin.basten - KIS-FIELD-PG
# Gestartet von : C:\Users\armin.basten\Desktop\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
[#] Dienst Gelöscht : BrowserProtect
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\boost_interprocess
Ordner Gelöscht : C:\Users\armin.basten\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\armin.basten\AppData\Local\SwvUpdater
Ordner Gelöscht : C:\Users\armin.basten\AppData\Roaming\digitalsite
Ordner Gelöscht : C:\Users\armin.basten\AppData\Roaming\DSite
Datei Gelöscht : C:\Windows\System32\Tasks\AmiUpdXp
Datei Gelöscht : C:\Windows\System32\Tasks\BrowserProtect
Datei Gelöscht : C:\Windows\System32\Tasks\DealPlyUpdate
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\AmiUpdXp
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1BF3961C-D6C8-45A8-A146-D677174205BC}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{1BF3961C-D6C8-45A8-A146-D677174205BC}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BrowserProtect
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{E297CBDB-E008-4B41-A4D6-7962CE15DB5B}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{E297CBDB-E008-4B41-A4D6-7962CE15DB5B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DealPlyUpdate
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{789F4F36-BCBB-4F01-8CBA-136DF573AD7A}
[#] Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{789F4F36-BCBB-4F01-8CBA-136DF573AD7A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\UpdateTask_RASMANCS
Schlüssel Gelöscht : HKCU\Software\d538d8cbd3beb49
Schlüssel Gelöscht : HKLM\SOFTWARE\d538d8cbd3beb49
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7697BC38-D0FA-454B-AC75-968B4CCABFCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{483830EE-A4CD-4B71-B0A3-3D82E62A6909}
Schlüssel Gelöscht : HKCU\Software\BI
Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\dsiteproducts
Schlüssel Gelöscht : HKCU\Software\filescout
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\Freeze.com
Schlüssel Gelöscht : HKLM\Software\systweak
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16720
-\\ Google Chrome v
[ Datei : C:\Users\armin.basten\AppData\Local\Google\Chrome\User Data\Default\preferences ]
Gelöscht : homepage
*************************
AdwCleaner[R0].txt - [5437 octets] - [19/10/2013 05:57:54]
AdwCleaner[S0].txt - [5453 octets] - [19/10/2013 06:01:05]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [5513 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.0.7 (10.15.2013:3)
OS: Windows 7 Ultimate x86
Ran by armin.basten on 19.10.2013 at 6:18:58,79
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3934052282-1587484455-2844972666-1005\Software\SweetIM
~~~ Files
~~~ Folders
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{092C2B63-9B93-4609-95DB-F586E0B63327}
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{38FAABDB-FAEA-45A5-99BB-89E129CD821C}
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{79E91B86-EBD4-4980-BC51-3F64A82A9F53}
Successfully deleted: [Empty Folder] C:\Users\armin.basten\appdata\local\{81DC7DCF-7ED9-4355-8D3B-410FEBFE60ED}
~~~ Chrome
Successfully deleted: [Folder] C:\Users\armin.basten\appdata\local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 19.10.2013 at 6:23:18,30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 19-10-2013 11:18:02
Running from C:\Users\armin.basten\Downloads
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\LoadMdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - hxxp://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t
CHR DefaultSuggestURL: (Google) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Google Update) - C:\Users\armin.basten\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-06] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-05] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-06] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-11] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-11] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-11] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-19] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-16] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
S3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 05:57 - 2013-10-19 06:01 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:06 - 2013-10-19 01:07 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:48 - 2013-10-19 00:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 19:33 - 2013-10-18 20:02 - 00000000 ____D C:\ComboFix
2013-10-18 19:29 - 2013-10-18 19:31 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:11 - 2013-10-18 16:12 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:08 - 2013-10-18 16:09 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:05 - 2013-10-19 11:16 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:36 - 2013-10-18 15:41 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 13:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 13:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 13:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 08:39 - 2013-10-18 16:23 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 12:48 - 2013-10-17 07:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 15:31 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:06 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 07:06 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 07:06 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 07:06 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 07:06 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 07:05 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:48 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:48 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:48 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:48 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 23:48 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:48 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:48 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:48 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:48 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:48 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:48 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:48 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:48 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:48 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:48 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:48 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:48 - 2013-07-03 06:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:48 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:48 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:48 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:47 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:52 - 2013-10-03 12:53 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 13:28 - 2013-10-02 17:55 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 21:49 - 2013-10-01 03:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 22:31 - 2013-09-29 23:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 22:13 - 2013-09-30 16:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-29 22:12 - 2013-09-29 23:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:10 - 1996-11-05 15:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 21:22 - 2013-09-29 21:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-10-19 06:04 - 00001805 _____ C:\Windows\setupact.log
2013-09-29 21:17 - 2013-10-19 01:42 - 00013016 _____ C:\Windows\PFRO.log
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:12 - 2013-09-29 13:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 12:12 - 2011-06-21 10:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 12:06 - 2013-09-28 12:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-27 23:28 - 2013-09-28 06:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:28 - 2012-12-10 10:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-27 23:28 - 2012-12-10 10:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-27 22:29 - 2013-09-27 22:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-09-27 22:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 15:48 - 2013-09-26 03:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:33 - 2013-10-09 14:06 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 08:52 - 2008-11-23 09:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 08:50 - 2013-09-29 14:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 08:48 - 2006-12-20 10:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 08:48 - 2006-11-30 10:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 08:48 - 2005-09-06 16:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 08:48 - 2002-07-26 16:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 08:15 - 2013-09-29 14:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-20 19:00 - 2013-10-13 21:54 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
==================== One Month Modified Files and Folders =======
2013-10-19 11:16 - 2013-10-18 16:05 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-19 11:15 - 2011-07-27 13:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:04 - 2013-09-29 21:17 - 00001805 _____ C:\Windows\setupact.log
2013-10-19 06:03 - 2011-07-27 11:04 - 01186438 _____ C:\Windows\WindowsUpdate.log
2013-10-19 06:01 - 2013-10-19 05:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:52 - 2011-10-14 17:18 - 00763840 _____ C:\Windows\system32\perfh01F.dat
2013-10-19 01:52 - 2011-10-14 17:18 - 00182854 _____ C:\Windows\system32\perfc01F.dat
2013-10-19 01:52 - 2011-08-09 13:24 - 00830312 _____ C:\Windows\system32\perfh019.dat
2013-10-19 01:52 - 2011-08-09 13:24 - 00193648 _____ C:\Windows\system32\perfc019.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00602068 _____ C:\Windows\system32\perfh014.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00549482 _____ C:\Windows\system32\perfh012.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00526592 _____ C:\Windows\system32\prfh0404.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00510290 _____ C:\Windows\system32\prfh0804.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00165054 _____ C:\Windows\system32\perfc012.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00164626 _____ C:\Windows\system32\prfc0804.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00159712 _____ C:\Windows\system32\prfc0404.dat
2013-10-19 01:52 - 2011-07-28 08:38 - 00137768 _____ C:\Windows\system32\perfc014.dat
2013-10-19 01:52 - 2010-07-01 02:19 - 00844522 _____ C:\Windows\system32\perfh010.dat
2013-10-19 01:52 - 2010-07-01 02:19 - 00188544 _____ C:\Windows\system32\perfc010.dat
2013-10-19 01:52 - 2010-06-30 16:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-19 01:42 - 2013-09-29 21:17 - 00013016 _____ C:\Windows\PFRO.log
2013-10-19 01:38 - 2011-08-30 07:22 - 00000000 ____D C:\Windows\3PUPrgWsQafmis
2013-10-19 01:07 - 2013-10-19 01:06 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 01:01 - 2013-02-16 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:50 - 2013-10-19 00:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:02 - 2013-10-18 19:33 - 00000000 ____D C:\ComboFix
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 20:01 - 2013-08-10 11:57 - 00000000 ____D C:\Qoobox
2013-10-18 19:52 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 19:31 - 2013-10-18 19:29 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:23 - 2013-10-18 08:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:12 - 2013-10-18 16:11 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:09 - 2013-10-18 16:08 - 01087213 _____ (Farbar) C:\Users\armin.basten\Downloads\FRST.exe
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:41 - 2013-10-18 15:36 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 09:33 - 2012-04-15 11:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 07:30 - 2013-10-17 12:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 07:40 - 2011-08-17 07:37 - 00000000 ____D C:\Windows\Minidump
2013-10-13 21:54 - 2013-09-20 19:00 - 00005102 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 17:11 - 2012-03-03 08:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 08:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 07:43 - 2009-07-14 06:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 07:15 - 2011-07-28 12:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 07:13 - 2013-07-20 12:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 07:07 - 2011-07-27 18:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 14:06 - 2013-09-21 11:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 08:47 - 2013-05-06 13:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:53 - 2013-10-03 12:52 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-02 17:55 - 2013-10-01 13:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-01 16:00 - 2013-05-06 10:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 03:49 - 2013-09-30 21:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 16:20 - 2013-09-29 22:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 23:14 - 2013-09-29 22:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 23:11 - 2013-09-29 22:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:09 - 2013-03-23 16:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 21:35 - 2013-09-29 21:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 17:18 - 2012-04-03 13:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 16:10 - 2013-03-24 14:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 14:32 - 2013-09-21 08:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 14:02 - 2013-09-21 08:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 14:02 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system
2013-09-29 13:57 - 2013-09-28 12:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:08 - 2013-09-28 12:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 09:16 - 2012-06-17 16:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 07:32 - 2012-05-11 19:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 07:32 - 2011-07-27 15:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 06:10 - 2013-09-27 23:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 22:37 - 2013-09-27 22:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:22 - 2013-09-27 20:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-02-04 04:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 20:21 - 2011-08-03 13:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 20:21 - 2011-08-03 12:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 20:17 - 2011-08-03 13:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 20:17 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 20:08 - 2012-04-15 11:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 03:48 - 2013-09-25 15:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 01:28 - 2013-10-10 07:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-10 07:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:28 - 2013-10-10 07:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 09:01 - 2011-10-08 07:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 05:30 - 2013-10-10 07:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-10 07:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-11 00:20
==================== End Of Log ============================
Gruss, Bassi Geändert von Bassmann1968 (19.10.2013 um 09:02 Uhr) |
|
19.10.2013, 14:54
| #6 |
| /// the machine /// TB-Ausbilder | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 |
|
20.10.2013, 07:28
| #7 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 und weiter.... Code:
ATTFilter ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internet# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e73be8c59584de4ba68bbc560c778d22
# engine=15551
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-10-20 05:00:34
# local_time=2013-10-20 07:00:34 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 26290 247682924 0 0
# compatibility_mode=5893 16776573 100 94 0 133876425 0 0
# compatibility_mode=7937 16777214 0 25 1789379 1789379 0 0
# scanned=862038
# found=2
# cleaned=0
# scan_time=20035
sh=8BBBA031B29F78ED58DA9BE5489162A70142D207 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALI trojan" ac=I fn="C:\Program Files\94\95fa.js"
sh=8BBBA031B29F78ED58DA9BE5489162A70142D207 ft=0 fh=0000000000000000 vn="JS/Kryptik.ALI trojan" ac=I fn="C:\Qoobox\Quarantine\C\Users\armin.basten\AppData\Roaming\8bf\9de5.js.vir"
Code:
ATTFilter Results of screen317's Security Check version 0.99.74 Windows 7 Service Pack 1 x86 (UAC is disabled!) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java 7 Update 25 Java version out of Date! Adobe Flash Player 11.6.602.180 Adobe Reader 10.1.8 Adobe Reader out of Date! Google Chrome 29.0.1547.62 Google Chrome 29.0.1547.66 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 20-10-2013 11:05:24
Running from C:\Users\armin.basten\Desktop
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\LoadMdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "hxxp://www.google.de/"
CHR DefaultSearchURL: (Google) - hxxp://www.google.com/search?q={searchTerms}&ie=utf-8&oe=utf-8&aq=t
CHR DefaultSuggestURL: (Google) - hxxp://suggestqueries.google.com/complete/search?q={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\29.0.1547.66\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (Google Update) - C:\Users\armin.basten\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-06] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-05] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-06] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-11] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-11] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-11] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-19] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-16] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
S3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-20 11:04 - 2013-10-20 11:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 10:11 - 2013-10-20 10:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-19 18:09 - 2013-10-19 18:09 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu (1).exe
2013-10-19 12:22 - 2013-10-19 12:22 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu.exe
2013-10-19 11:19 - 2013-10-19 11:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 05:57 - 2013-10-19 06:01 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:06 - 2013-10-19 01:07 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:53 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:48 - 2013-10-19 00:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 19:33 - 2013-10-18 20:02 - 00000000 ____D C:\ComboFix
2013-10-18 19:29 - 2013-10-18 19:31 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:11 - 2013-10-18 16:12 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:05 - 2013-10-19 11:16 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:36 - 2013-10-18 15:41 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 13:13 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 13:13 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 13:13 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 13:13 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 08:39 - 2013-10-18 16:23 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 12:48 - 2013-10-17 07:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 15:31 - 2013-09-04 03:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 15:31 - 2013-09-04 03:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 07:06 - 2013-09-23 01:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 07:06 - 2013-09-23 01:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 07:06 - 2013-09-23 01:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 07:06 - 2013-09-23 01:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 07:06 - 2013-09-21 05:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 07:06 - 2013-09-21 04:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 07:05 - 2013-09-23 01:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 07:05 - 2013-09-23 01:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-09 23:48 - 2013-09-14 02:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-09 23:48 - 2013-09-08 04:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-09 23:48 - 2013-09-08 04:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-09 23:48 - 2013-08-29 03:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-09 23:48 - 2013-08-29 03:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-09 23:48 - 2013-08-29 03:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-09 23:48 - 2013-08-29 03:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-09 23:48 - 2013-08-29 03:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-09 23:48 - 2013-08-28 03:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-09 23:48 - 2013-08-28 02:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-09 23:48 - 2013-08-01 13:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-09 23:48 - 2013-07-20 12:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-09 23:48 - 2013-07-12 12:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-09 23:48 - 2013-07-12 12:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-09 23:48 - 2013-07-04 13:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-09 23:48 - 2013-07-04 13:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-09 23:48 - 2013-07-04 13:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-09 23:48 - 2013-07-04 11:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-09 23:48 - 2013-07-03 06:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-09 23:48 - 2013-07-03 05:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-09 23:48 - 2013-06-06 06:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-09 23:48 - 2013-06-06 06:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-09 23:48 - 2013-06-06 06:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-09 23:48 - 2013-06-06 05:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-09 23:47 - 2013-06-26 00:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:52 - 2013-10-03 12:53 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 13:28 - 2013-10-02 17:55 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 21:49 - 2013-10-01 03:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 22:31 - 2013-09-29 23:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 22:13 - 2013-09-30 16:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-29 22:12 - 2013-09-29 23:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:10 - 1996-11-05 15:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 21:22 - 2013-09-29 21:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-10-19 06:04 - 00001805 _____ C:\Windows\setupact.log
2013-09-29 21:17 - 2013-10-19 01:42 - 00013016 _____ C:\Windows\PFRO.log
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:12 - 2013-09-29 13:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 12:12 - 2011-06-21 10:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 12:06 - 2013-09-28 12:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-27 23:28 - 2013-09-28 06:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 23:28 - 2012-12-10 10:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-27 23:28 - 2012-12-10 10:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-27 23:28 - 2009-07-23 17:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-27 22:29 - 2013-09-27 22:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-09-27 22:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 15:48 - 2013-09-26 03:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:33 - 2013-10-19 18:40 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 08:52 - 2008-11-23 09:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 08:50 - 2013-09-29 14:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 08:48 - 2006-12-20 10:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 08:48 - 2006-12-20 09:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 08:48 - 2006-11-30 10:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 08:48 - 2005-09-06 16:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 08:48 - 2002-07-26 16:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 08:15 - 2013-09-29 14:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-20 19:00 - 2013-10-20 00:28 - 00005122 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
==================== One Month Modified Files and Folders =======
2013-10-20 11:05 - 2011-07-27 13:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-20 11:04 - 2013-10-20 11:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 10:11 - 2013-10-20 10:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-20 08:35 - 2011-07-27 11:04 - 01200664 _____ C:\Windows\WindowsUpdate.log
2013-10-20 00:28 - 2013-09-20 19:00 - 00005122 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-19 18:40 - 2013-09-21 11:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-19 18:09 - 2013-10-19 18:09 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu (1).exe
2013-10-19 12:31 - 2011-10-14 17:18 - 00763840 _____ C:\Windows\system32\perfh01F.dat
2013-10-19 12:31 - 2011-10-14 17:18 - 00182854 _____ C:\Windows\system32\perfc01F.dat
2013-10-19 12:31 - 2011-08-09 13:24 - 00830312 _____ C:\Windows\system32\perfh019.dat
2013-10-19 12:31 - 2011-08-09 13:24 - 00193648 _____ C:\Windows\system32\perfc019.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00602068 _____ C:\Windows\system32\perfh014.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00549482 _____ C:\Windows\system32\perfh012.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00526592 _____ C:\Windows\system32\prfh0404.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00510290 _____ C:\Windows\system32\prfh0804.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00165054 _____ C:\Windows\system32\perfc012.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00164626 _____ C:\Windows\system32\prfc0804.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00159712 _____ C:\Windows\system32\prfc0404.dat
2013-10-19 12:31 - 2011-07-28 08:38 - 00137768 _____ C:\Windows\system32\perfc014.dat
2013-10-19 12:31 - 2010-07-01 02:19 - 00844522 _____ C:\Windows\system32\perfh010.dat
2013-10-19 12:31 - 2010-07-01 02:19 - 00188544 _____ C:\Windows\system32\perfc010.dat
2013-10-19 12:31 - 2010-06-30 16:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-19 12:22 - 2013-10-19 12:22 - 02347384 _____ (ESET) C:\Users\armin.basten\Downloads\esetsmartinstaller_enu.exe
2013-10-19 11:19 - 2013-10-19 11:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 11:16 - 2013-10-18 16:05 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-19 06:23 - 2013-10-19 06:23 - 00001436 _____ C:\Users\armin.basten\Desktop\JRT.txt
2013-10-19 06:18 - 2013-10-19 06:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:13 - 2009-07-14 06:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-19 06:04 - 2013-09-29 21:17 - 00001805 _____ C:\Windows\setupact.log
2013-10-19 06:01 - 2013-10-19 05:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 01:42 - 2013-09-29 21:17 - 00013016 _____ C:\Windows\PFRO.log
2013-10-19 01:42 - 2011-08-30 07:22 - 00000000 ____D C:\Windows\3PUPrgWsQafmis
2013-10-19 01:07 - 2013-10-19 01:06 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 01:01 - 2013-02-16 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-19 00:53 - 2013-10-19 00:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 00:53 - 2013-10-19 00:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 00:50 - 2013-10-19 00:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 00:50 - 2013-10-19 00:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 20:02 - 2013-10-18 19:33 - 00000000 ____D C:\ComboFix
2013-10-18 20:01 - 2013-10-18 20:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 20:01 - 2013-08-10 11:57 - 00000000 ____D C:\Qoobox
2013-10-18 19:52 - 2009-07-14 04:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 19:31 - 2013-10-18 19:29 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 18:19 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-18 18:17 - 2013-10-18 18:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 16:23 - 2013-10-18 08:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 16:20 - 2013-10-18 16:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 16:12 - 2013-10-18 16:11 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 16:10 - 2013-10-18 16:10 - 00000000 ____D C:\FRST
2013-10-18 16:05 - 2013-10-18 16:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 16:04 - 2013-10-18 16:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:41 - 2013-10-18 15:36 - 00001163 _____ C:\Users\armin.basten\Desktop\Continue Mipony Download Manager Installation.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 08:39 - 2013-10-18 08:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 12:52 - 2013-10-17 12:52 - 00002483 _____ C:\Users\Public\Desktop\Bonjour-Druckerassistent.lnk
2013-10-17 12:52 - 2013-10-17 12:52 - 00000000 ____D C:\Program Files\Bonjour Print Services
2013-10-17 09:33 - 2012-04-15 11:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 07:30 - 2013-10-17 12:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 07:40 - 2013-10-14 07:40 - 00131072 ____N C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 07:40 - 2011-08-17 07:37 - 00000000 ____D C:\Windows\Minidump
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 13:41 - 2011-07-27 13:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 17:11 - 2012-03-03 08:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 08:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 07:43 - 2009-07-14 06:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 07:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 07:15 - 2011-07-28 12:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 07:13 - 2013-07-20 12:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 07:07 - 2011-07-27 18:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 12:24 - 2013-10-09 12:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 12:24 - 2013-10-09 12:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 12:24 - 2012-05-21 04:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 08:47 - 2013-05-06 13:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-03 20:49 - 2013-10-03 20:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 12:53 - 2013-10-03 12:52 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-02 17:55 - 2013-10-01 13:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-01 16:00 - 2013-05-06 10:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 16:00 - 2012-11-05 06:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 03:49 - 2013-09-30 21:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 17:01 - 2013-09-30 17:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 17:00 - 2013-09-30 17:00 - 00000000 ____D C:\VW
2013-09-30 16:20 - 2013-09-29 22:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 12:36 - 2013-09-30 12:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-29 23:14 - 2013-09-29 22:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-29 23:11 - 2013-09-29 22:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-29 22:09 - 2013-03-23 16:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 21:35 - 2013-09-29 21:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 21:17 - 2013-09-29 21:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 17:18 - 2012-04-03 13:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 16:10 - 2013-03-24 14:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 14:32 - 2013-09-21 08:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 14:18 - 2013-09-29 14:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 14:02 - 2013-09-21 08:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 14:02 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system
2013-09-29 13:57 - 2013-09-28 12:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 21:50 - 2013-09-28 21:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 12:08 - 2013-09-28 12:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 09:16 - 2012-06-17 16:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 07:32 - 2012-05-11 19:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 07:32 - 2011-07-27 15:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 06:10 - 2013-09-27 23:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-27 22:37 - 2013-09-27 22:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:22 - 2013-09-27 20:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 20:34 - 2013-09-27 20:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 20:32 - 2013-02-04 04:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 20:21 - 2011-08-03 13:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 20:21 - 2011-08-03 12:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 20:17 - 2011-08-03 13:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 20:17 - 2009-07-14 06:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 20:08 - 2012-04-15 11:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 03:48 - 2013-09-25 15:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 01:28 - 2013-10-10 07:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 01:28 - 2013-10-10 07:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 01:28 - 2013-10-10 07:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 01:27 - 2013-10-10 07:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 01:27 - 2013-10-10 07:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 00:51 - 2013-09-23 00:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 09:01 - 2011-10-08 07:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 08:48 - 2013-09-21 08:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 05:30 - 2013-10-10 07:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 04:39 - 2013-10-10 07:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-11 00:20
==================== End Of Log ============================
Noch Probleme? Ich würde sagen ja. Noch ein Trojaner vorhanden, Firewall lässt sich immernoch nicht bedienen. Mein Schutz scheint auch nicht der Beste zu sein. Obwohl der Beste Schutz mein Verhalten ist. Trotzdem, was emphielt der Experte?  Geändert von Bassmann1968 (20.10.2013 um 08:08 Uhr) |
|
20.10.2013, 14:20
| #8 |
| /// the machine /// TB-Ausbilder | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Java und ADobe updaten. Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter C:\Program Files\94
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Ich empfehle immer Emsisoft. Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
20.10.2013, 15:08
| #9 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Java update auf 7.45 durchgeführt. Adobe wird als aktuell angezeigt. Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 19-10-2013
Ran by armin.basten at 2013-10-20 17:56:35 Run:1
Running from C:\Users\armin.basten\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Program Files\94
*****************
C:\Program Files\94 => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter Farbar Service Scanner Version: 13-09-2013
Ran by armin.basten (administrator) on 20-10-2013 at 18:06:35
Running from "C:\Users\armin.basten\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
MpsSvc Service is not running. Checking service configuration:
The start type of MpsSvc service is OK.
The ImagePath of MpsSvc service is OK.
The ServiceDll of MpsSvc service is OK.
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys
[2013-10-09 23:48] - [2013-09-14 02:48] - 0338944 ____A (Microsoft Corporation) F81BB7E487EDCEAB630A7EE66CF23913
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-10-09 23:48] - [2013-09-08 04:07] - 1294272 ____A (Microsoft Corporation) CA59F7C570AF70BC174F477CFE2D9EE3
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-08-15 02:18] - [2013-07-09 06:46] - 0140288 ____A (Microsoft Corporation) 7CA1BECEA5DE2643ADDAD32670E7A4C9
C:\Program Files\Windows Defender\MpSvc.dll
[2013-07-18 05:24] - [2013-05-27 06:57] - 0680960 ____A (Microsoft Corporation) 082CF481F659FAE0DE51AD060881EB47
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
**** End of log ****
|
|
20.10.2013, 18:02
| #10 |
| /// the machine /// TB-Ausbilder | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Downloade dir bitte Windows Repair (All In One) von hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.10.2013, 07:31
| #11 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Hallo Schrauber, alles scheint wieder normal zu laufen. Firewall ist aktiv und lässt sich wieder einstellen. Vielen Dank dafür. Soll ich noch etwas machen? Gruss Bassi Jetzt ist mir doch noch etwas aufgefallen. Im Wartungscenter werde ich dazu aufgefordert den Defender ein zu schalten. Wenn ich auf "Jetzt Einschalten" klicke, dann komme ich zu Defender und es wird gemeldet: "Es wurde keine unerwünschte oder schädliche Software ermittelt. Der Computer wird normal ausgeführt". Aber die Meldung, dass ich den Defender aktivieren soll bleibt bestehen. |
|
21.10.2013, 08:13
| #12 |
| /// the machine /// TB-Ausbilder | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Poste bitte ein frisches FSS und FRST log.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
21.10.2013, 15:49
| #13 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Frisch auf den Tisch  Code:
ATTFilter Farbar Service Scanner Version: 13-09-2013
Ran by armin.basten (administrator) on 21-10-2013 at 11:15:48
Running from "C:\Users\armin.basten\Desktop"
Microsoft Windows 7 Ultimate Service Pack 1 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
WAN connected
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
Other Services:
==============
File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcore.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys
[2013-10-10 01:48] - [2013-09-14 04:48] - 0338944 ____A (Microsoft Corporation) F81BB7E487EDCEAB630A7EE66CF23913
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2013-10-10 01:48] - [2013-09-08 06:07] - 1294272 ____A (Microsoft Corporation) CA59F7C570AF70BC174F477CFE2D9EE3
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll
[2013-08-15 04:18] - [2013-07-09 08:46] - 0140288 ____A (Microsoft Corporation) 7CA1BECEA5DE2643ADDAD32670E7A4C9
C:\Program Files\Windows Defender\MpSvc.dll
[2013-07-18 07:24] - [2013-05-27 08:57] - 0680960 ____A (Microsoft Corporation) 082CF481F659FAE0DE51AD060881EB47
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
**** End of log ****
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 19-10-2013
Ran by armin.basten (administrator) on KIS-FIELD-PG on 21-10-2013 11:16:28
Running from C:\Users\armin.basten\Desktop
Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Logitech Inc.) C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Siemens AG) C:\PROGRAM FILES\COMMON FILES\SIEMENS\ALMPANELPLUGIN\ALMPANELPLUGIN.EXE
(Hewlett-Packard Company) C:\Program Files\HP\HPBDSService\HPBDSService.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAdm.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrDba.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrHis.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrPas.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrSaz.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(SIEMENS AG) C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe
(Siemens AG) C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\PNIOMGR.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Service.exe
(OPC Foundation) C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Volkswagen AG) D:\ElsaWin\bin\LcSvrAuf.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) D:\Program Files\iTunes\iTunesHelper.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\LoadMdm.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(SIEMENS AG) C:\Program Files\Common Files\Siemens\SimNetCom\pniopcac.exe
(TODO: <Company name>) C:\Program Files\Wetelecom\NetKit.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\system32\wbengine.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [681032 2013-10-01] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [iTunesHelper] - D:\Program Files\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-05] (Adobe Systems Incorporated)
HKLM\...\Run: [LoadMdm] - C:\Program Files\Wetelecom\LoadMdm.exe [397312 2010-09-13] (TODO: <Company name>)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKCU\...\Run: [Google Update] - C:\Users\armin.basten\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-12-04] (Google Inc.)
HKCU\...\Run: [Xvid] - C:\Program Files\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
Startup: C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RT-Updater.lnk
ShortcutTarget: RT-Updater.lnk -> D:\Program Files\VCDS\VCDS.EXE (Ross-Tech, LLC)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.siemens.com
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x9A70EA11C858CC01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - D:\ElsaWin\bin\wiprot.dll (TODO: <Company name>)
Winsock: Catalog5 08 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 10.0.1.1
Tcpip\..\Interfaces\{506F0F6B-7885-4DEE-978F-D31EEF8B6428}: [NameServer]77.243.240.230 77.243.240.231
Tcpip\..\Interfaces\{BD04B7F9-5482-42B0-9390-430FB6D2248A}: [NameServer]8.8.8.8,8.8.4.4,4.2.2.1,4.2.2.2,208.67.222.222,208.67.220.220,8.26.56.26,8.20.247.20,156.154.70.1,156.154.71.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR Extension: (YouTube) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Windows Media Player Extension for HTML5) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\hokdglbhghcebcopdbanieangmcamaak\1.0_0
CHR Extension: (20-20 3D Viewer for IKEA) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfhldcakmgpmglboaclpfdedehjblalp\5.0.94.1_0
CHR Extension: (Gmail) - C:\Users\ARMIN~1.BAS\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR StartMenuInternet: Google Chrome - C:\Users\armin.basten\AppData\Local\Google\Chrome\Application\chrome.exe
========================== Services (Whitelisted) =================
R2 almservice; C:\Program Files\Common Files\Siemens\sws\almsrv\almsrvx.exe [1138312 2011-12-11] (SIEMENS AG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440392 2013-10-01] (Avira Operations GmbH & Co. KG)
S2 CCAgent; C:\Program Files\Common Files\Siemens\ACE\bin\CCAgent.exe [344064 2009-07-16] (SIEMENS AG)
S3 CCEClient; C:\Program Files\Common Files\Siemens\ace\bin\CCEClient.exe [262144 2009-07-16] (SIEMENS AG)
S2 CCEServer; C:\Program Files\Common Files\Siemens\ace\bin\CCEServer.exe [237568 2009-07-16] (SIEMENS AG)
R2 HP DS Service; C:\Program Files\HP\HPBDSService\HPBDSService.exe [13824 2010-10-27] (Hewlett-Packard Company)
R2 LcSvrAdm; D:\ElsaWin\bin\LcSvrAdm.exe [240640 2011-12-06] (Volkswagen AG)
R3 LcSvrAuf; D:\ElsaWin\bin\LcSvrAuf.exe [1321472 2011-12-06] (Volkswagen AG)
R2 LcSvrDba; D:\ElsaWin\bin\LcSvrDba.exe [392704 2011-12-06] (Volkswagen AG)
R2 LcSvrHis; D:\ElsaWin\bin\LcSvrHis.exe [335360 2011-12-06] (Volkswagen AG)
R2 LcSvrPAS; D:\ElsaWin\bin\LcSvrPas.exe [477696 2011-12-06] (Volkswagen AG)
R2 LcSvrSaz; D:\ElsaWin\bin\LcSvrSaz.exe [373248 2011-12-06] (Volkswagen AG)
R2 MSSQL$WINCCFLEXEXPRESS; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUS; C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
R2 MSSQL$WINCCPLUSMIG; C:\Program Files\Microsoft SQL Server\MSSQL.3\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [44384 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [227600 2010-07-19] ()
S3 OpcEnum; C:\Windows\system32\Opcenum.exe [139488 2009-02-05] (OPC Foundation)
S3 RedundancyControl; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyControl.exe [430080 2009-07-16] (SIEMENS AG)
S3 RedundancyState; C:\Program Files\Common Files\Siemens\ace\bin\RedundancyState.exe [180224 2009-07-16] (SIEMENS AG)
R2 s7hspsvx; C:\Program Files\Siemens\Step7\s7bin\s7hspsvx.exe [61493 2010-06-02] (SIEMENS AG)
R2 s7oiehsx; C:\Program Files\Common Files\Siemens\S7IEPG\s7oiehsx.exe [412808 2011-11-04] (SIEMENS AG)
R2 S7TraceServiceX; C:\Program Files\Common Files\Siemens\Automation\TraceEngine\bin\S7TraceServiceX.exe [556168 2011-11-04] (SIEMENS AG)
R2 SCSMonitor; C:\Program Files\Common Files\Siemens\ace\bin\SCSMX.exe [167936 2009-07-16] (SIEMENS AG)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3064000 2012-10-02] (Skype Technologies S.A.)
S2 smartserver; C:\Program Files\Siemens\SIMATIC WinCC flexible\WinCC flexible 2008 Runtime\SmartServer.exe [558416 2011-12-07] (Siemens AG)
R2 UA Local Discovery Server; C:\Program Files\Common Files\OPC Foundation\UA\v1.0\Bin\Opc.Ua.DiscoveryServer.exe [28160 2010-05-06] (OPC Foundation)
R2 UMVPFSrv; C:\Program Files\Common Files\logishrd\LVMVFM\UMVPFSrv.exe [450848 2012-01-18] (Logitech Inc.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [89376 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [137208 2013-10-01] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-01] (Avira Operations GmbH & Co. KG)
R3 btmhsf; C:\Windows\System32\DRIVERS\btmhsf.sys [225280 2011-07-19] (Intel Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
R1 dpmconv; C:\Windows\System32\DRIVERS\dpmconv32.sys [288256 2010-04-28] (SIEMENS AG)
S3 dpmcslv; C:\Windows\System32\Drivers\dpmcslv.sys [68280 2005-07-04] (Siemens AG)
R1 DPMTRCDD; C:\Windows\System32\DRIVERS\DPMTRCDD32.sys [72248 2010-03-22] (SIEMENS AG)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [242240 2013-03-23] (DT Soft Ltd)
R3 e1qexpress; C:\Windows\System32\DRIVERS\e1q6232.sys [215208 2009-11-05] (Intel Corporation)
S3 FTDIBUS; C:\Windows\System32\drivers\ftdibus.sys [63464 2013-02-13] (FTDI Ltd.)
R3 fwkbdrtm; C:\Windows\system32\drivers\fwkbdrtm.sys [21464 2011-12-07] (Windows (R) Win 7 DDK provider)
R2 Hardlock; C:\Windows\system32\drivers\hardlock.sys [693760 2006-11-22] (Aladdin Knowledge Systems Ltd.)
S3 HPFXBULKLEDM; C:\Windows\System32\drivers\hppcbulkio.sys [20504 2011-05-10] (Hewlett Packard)
S3 IAMT03; C:\Windows\system32\DRIVERS\IAMT03.sys [40848 2007-04-12] (Intel Corporation)
S3 IAMTV; C:\Windows\system32\DRIVERS\IAMTV.sys [38288 2007-04-12] (Intel Corporation)
S3 IAMTXP; C:\Windows\system32\DRIVERS\IAMTXP.sys [47496 2007-04-12] (Intel Corporation)
R3 iBtFltCoex; C:\Windows\System32\DRIVERS\iBtFltCoex.sys [47104 2011-07-20] (Intel Corporation)
S3 LEqdUsb; C:\Windows\System32\Drivers\LEqdUsb.Sys [42648 2011-04-30] (Logitech, Inc.)
S3 LHidEqd; C:\Windows\System32\Drivers\LHidEqd.Sys [12184 2011-04-30] (Logitech, Inc.)
S3 LUsbFilt; C:\Windows\System32\Drivers\LUsbFilt.Sys [30360 2011-04-30] (Logitech, Inc.)
S3 NAL; C:\Windows\system32\Drivers\iqvw32.sys [30880 2010-03-24] (Intel Corporation )
R3 NETwNs32; C:\Windows\System32\DRIVERS\NETwNs32.sys [6814720 2010-07-14] (Intel Corporation)
R2 NSHE; C:\Windows\system32\Drivers\NSHE.SYS [97792 2008-11-23] (T0r0 2008)
R2 PROFIbrd; C:\Windows\System32\Drivers\PROFIbrd.sys [165432 2010-03-10] (Softing AG)
S3 PROFIpnp; C:\Windows\System32\Drivers\PROFIpnp.sys [19256 2010-03-10] (Softing AG)
R2 PROFIprt; C:\Windows\System32\Drivers\PROFIprt.sys [39480 2010-03-10] (Softing AG)
R2 PROFIstack; C:\Windows\System32\Drivers\PROFIstack.sys [130104 2010-03-10] (Softing AG)
S3 PROFIusb; C:\Windows\System32\Drivers\PROFIusb.sys [39352 2010-03-10] (Softing AG)
S3 RT-USB; C:\Windows\System32\drivers\RT-USB.SYS [59464 2010-06-17] (Ross-Tech LLC)
R3 S7odpx2x32; C:\Windows\System32\Drivers\S7odpx2x32.sys [87552 2011-05-06] (SIEMENS AG)
R3 s7opciax32; C:\Windows\System32\DRIVERS\s7opciax32.sys [227840 2011-06-22] (SIEMENS AG)
R2 S7opcsrtx; C:\Windows\System32\DRIVERS\s7opcsrtx.sys [31744 2011-02-22] (SIEMENS AG)
R3 s7otmcd32x; C:\Windows\System32\Drivers\s7otmcd32x.sys [256512 2011-05-06] (SIEMENS AG)
R3 S7otranx32; C:\Windows\System32\Drivers\S7otranx32.sys [521216 2011-05-06] (SIEMENS AG)
R3 s7otsadx32; C:\Windows\System32\Drivers\s7otsadx32.sys [182784 2011-09-29] (SIEMENS AG)
R2 s7ousbu32x; C:\Windows\System32\DRIVERS\s7ousbu32x.sys [641280 2011-09-29] (SIEMENS AG)
R2 s7sn2srtx; C:\Windows\System32\DRIVERS\s7sn2srtx.sys [63104 2011-06-16] (SIEMENS AG)
R2 s7snsrtx; C:\Windows\System32\DRIVERS\s7snsrtx.sys [73088 2009-02-24] (SIEMENS AG)
R2 SNTIE; C:\Windows\System32\DRIVERS\sntie.sys [343888 2011-10-11] (SIEMENS AG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2010-06-09] (Samsung Electronics)
S3 usbbulk; C:\Windows\System32\Drivers\USBBulk.sys [18776 2008-07-04] (SEGGER MICROCONTROLLER GmbH & Co. KG)
R1 vsnl2ada; C:\Windows\System32\DRIVERS\vsnl2ada32.sys [98944 2010-03-22] (SIEMENS AG)
R3 wmdusbser; C:\Windows\System32\DRIVERS\wmdusbser.sys [107136 2010-06-11] (WeTelecom Incorporated)
S3 ZTEusbMB; C:\Windows\System32\DRIVERS\ZTEusbnmeaext2.sys [107520 2011-07-04] (ZTE Incorporated)
S3 ZTEusbwwan; C:\Windows\System32\DRIVERS\ZTEusbwwan.sys [195072 2011-12-01] (ZTE Incorporated)
S3 ALSysIO; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ARMIN~1.BAS\AppData\Local\Temp\catchme.sys [x]
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
S3 EverestDriver; \??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt [x]
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
S3 massfilter; system32\DRIVERS\massfilter.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S3 ZTEusbmdm6k; system32\DRIVERS\ZTEusbmdm6k.sys [x]
S3 ZTEusbnmea; system32\DRIVERS\ZTEusbnmea.sys [x]
S3 ZTEusbser6k; system32\DRIVERS\ZTEusbser6k.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-10-21 11:15 - 2013-10-21 11:15 - 00002507 _____ C:\Users\armin.basten\Desktop\FSS.txt
2013-10-21 10:33 - 2011-05-30 17:42 - 00240640 _____ C:\Windows\system32\xvidvfw.dll
2013-10-21 10:33 - 2011-05-23 13:52 - 00153088 _____ C:\Windows\system32\xvid.ax
2013-10-21 10:33 - 2011-05-23 11:46 - 00645632 _____ C:\Windows\system32\xvidcore.dll
2013-10-21 10:25 - 2013-10-21 10:27 - 10768856 _____ (Xvid Team) C:\Users\armin.basten\Downloads\Xvid-1.3.2-20110601.exe
2013-10-21 00:49 - 2013-10-21 07:57 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-10-20 23:24 - 2013-10-20 23:24 - 00003408 ____N C:\bootsqm.dat
2013-10-20 23:05 - 2013-10-20 23:05 - 00000000 ____D C:\Users\armin.basten\Downloads\tweaking.com_windows_repair_aio
2013-10-20 20:04 - 2013-10-20 20:04 - 00358923 _____ (Farbar) C:\Users\armin.basten\Desktop\FSS.exe
2013-10-20 19:54 - 2013-10-20 19:54 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 19:53 - 2013-10-08 09:50 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-20 19:53 - 2013-10-08 09:46 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-20 19:53 - 2013-10-08 09:46 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-20 19:53 - 2013-10-08 09:46 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-20 19:51 - 2013-10-20 19:53 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-20 13:04 - 2013-10-20 13:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 12:11 - 2013-10-20 12:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-19 13:19 - 2013-10-19 13:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 08:18 - 2013-10-19 08:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 07:57 - 2013-10-19 08:01 - 00000000 ____D C:\AdwCleaner
2013-10-19 03:06 - 2013-10-19 03:07 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 02:53 - 2013-10-19 02:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 02:53 - 2013-04-04 16:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-10-19 02:50 - 2013-10-19 02:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 02:48 - 2013-10-19 02:50 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 22:01 - 2013-10-18 22:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 21:33 - 2013-10-18 22:02 - 00000000 ____D C:\ComboFix
2013-10-18 21:29 - 2013-10-18 21:31 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 20:17 - 2013-10-18 20:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 18:20 - 2013-10-18 18:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 18:11 - 2013-10-18 18:12 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 18:10 - 2013-10-18 18:10 - 00000000 ____D C:\FRST
2013-10-18 18:05 - 2013-10-19 13:16 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-18 18:05 - 2013-10-18 18:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 18:04 - 2013-10-18 18:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 15:13 - 2011-06-26 10:45 - 00256000 _____ C:\Windows\PEV.exe
2013-10-18 15:13 - 2010-11-07 21:20 - 00208896 _____ C:\Windows\MBR.exe
2013-10-18 15:13 - 2009-04-20 08:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00098816 _____ C:\Windows\sed.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00080412 _____ C:\Windows\grep.exe
2013-10-18 15:13 - 2000-08-31 04:00 - 00068096 _____ C:\Windows\zip.exe
2013-10-18 10:39 - 2013-10-21 08:37 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-18 10:39 - 2013-10-18 10:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 10:39 - 2013-10-18 10:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 14:48 - 2013-10-17 09:30 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 09:40 - 2013-10-14 09:40 - 00131072 _____ C:\Windows\Minidump\101413-31184-01.dmp
2013-10-10 17:31 - 2013-09-04 05:15 - 00258560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00076288 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00020480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
2013-10-10 17:31 - 2013-09-04 05:14 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2013-10-10 09:06 - 2013-09-23 03:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-10-10 09:06 - 2013-09-23 03:28 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-10-10 09:06 - 2013-09-23 03:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-10-10 09:06 - 2013-09-23 03:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-10-10 09:06 - 2013-09-21 07:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-10-10 09:06 - 2013-09-21 06:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-10-10 09:05 - 2013-09-23 03:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-10-10 09:05 - 2013-09-23 03:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-10-10 09:05 - 2013-09-23 03:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-10-10 01:48 - 2013-09-14 04:48 - 00338944 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-10-10 01:48 - 2013-09-08 06:07 - 01294272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-10-10 01:48 - 2013-09-08 06:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
2013-10-10 01:48 - 2013-08-29 05:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-10-10 01:48 - 2013-08-29 05:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-10-10 01:48 - 2013-08-29 05:50 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-10-10 01:48 - 2013-08-29 05:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
2013-10-10 01:48 - 2013-08-29 05:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
2013-10-10 01:48 - 2013-08-28 05:04 - 02348544 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-10-10 01:48 - 2013-08-28 04:57 - 00434688 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
2013-10-10 01:48 - 2013-08-01 15:03 - 00729024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2013-10-10 01:48 - 2013-07-20 14:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2013-10-10 01:48 - 2013-07-12 14:08 - 00146816 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2013-10-10 01:48 - 2013-07-12 14:07 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
2013-10-10 01:48 - 2013-07-12 14:07 - 00080896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\USBAUDIO.sys
2013-10-10 01:48 - 2013-07-04 15:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
2013-10-10 01:48 - 2013-07-04 15:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
2013-10-10 01:48 - 2013-07-04 15:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2013-10-10 01:48 - 2013-07-04 13:48 - 00115712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
2013-10-10 01:48 - 2013-07-03 08:02 - 00036352 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
2013-10-10 01:48 - 2013-07-03 07:36 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
2013-10-10 01:48 - 2013-07-03 07:36 - 00025728 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2013-10-10 01:48 - 2013-06-06 08:52 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2013-10-10 01:48 - 2013-06-06 08:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2013-10-10 01:48 - 2013-06-06 08:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2013-10-10 01:48 - 2013-06-06 07:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2013-10-10 01:48 - 2013-06-06 07:01 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2013-10-10 01:47 - 2013-06-26 02:56 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2013-10-09 14:24 - 2013-10-09 14:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 14:24 - 2013-10-09 14:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-03 22:49 - 2013-10-03 22:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 14:52 - 2013-10-03 14:53 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 15:28 - 2013-10-20 15:02 - 00000056 _____ C:\Windows\Acroread.ini
2013-09-30 23:49 - 2013-10-01 05:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 19:00 - 2013-09-30 19:00 - 00000000 ____D C:\VW
2013-09-30 14:36 - 2013-09-30 14:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-30 00:31 - 2013-09-30 01:14 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-30 00:13 - 2013-09-30 18:20 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 00:12 - 2013-09-30 01:11 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-30 00:10 - 1996-11-05 17:13 - 00299008 _____ (InstallShield Corporation, Inc.) C:\Windows\uninst.exe
2013-09-29 23:22 - 2013-09-29 23:35 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 23:17 - 2013-10-21 07:59 - 00015858 _____ C:\Windows\PFRO.log
2013-09-29 23:17 - 2013-10-21 07:59 - 00001917 _____ C:\Windows\setupact.log
2013-09-29 23:17 - 2013-09-29 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-28 23:50 - 2013-09-28 23:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 14:12 - 2013-09-29 15:57 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 14:12 - 2011-06-21 12:24 - 00032768 _____ C:\Windows\system32\Drivers\sp_rsdrv2.sys
2013-09-28 14:06 - 2013-09-28 14:08 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 01:28 - 2013-09-28 08:10 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-28 01:28 - 2012-12-10 12:04 - 00356352 _____ (eSellerate Inc.) C:\Windows\eSellerateEngine.dll
2013-09-28 01:28 - 2012-12-10 12:04 - 00081920 _____ (eSellerate Inc.) C:\Windows\eSellerateControl350.dll
2013-09-28 01:28 - 2009-07-23 19:32 - 01122304 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\libeay32.dll
2013-09-28 01:28 - 2009-07-23 19:32 - 00274432 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Windows\system32\ssleay32.dll
2013-09-28 00:29 - 2013-09-28 00:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-27 22:34 - 2013-09-27 22:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 22:32 - 2013-09-28 00:22 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-25 17:48 - 2013-09-26 05:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 02:51 - 2013-09-23 02:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 13:33 - 2013-10-19 20:40 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-09-21 10:52 - 2008-11-23 11:23 - 00097792 _____ (T0r0 2008) C:\Windows\system32\Drivers\NSHE.SYS
2013-09-21 10:50 - 2013-09-29 16:32 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-21 10:48 - 2013-09-21 10:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 10:48 - 2006-12-20 12:55 - 03066968 _____ (Aladdin Knowledge Systems.) C:\Windows\system32\hinstd.dll
2013-09-21 10:48 - 2006-12-20 11:00 - 02511360 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\haspds_windows.dll
2013-09-21 10:48 - 2006-12-20 11:00 - 00671112 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hdinst_windows.dll
2013-09-21 10:48 - 2006-11-30 12:06 - 00069632 _____ (Aladdin Knowledge Systems) C:\Windows\system32\hasp_inst_help1.dll
2013-09-21 10:48 - 2005-09-06 18:06 - 00028672 _____ C:\Windows\system32\hlduinst.exe
2013-09-21 10:48 - 2002-07-26 18:02 - 00006836 _____ C:\Windows\system32\UNWISE.INI
2013-09-21 10:15 - 2013-09-29 16:02 - 00000000 ____D C:\Windows\ETKA7.4_Germany
==================== One Month Modified Files and Folders =======
2013-10-21 11:15 - 2013-10-21 11:15 - 00002507 _____ C:\Users\armin.basten\Desktop\FSS.txt
2013-10-21 11:08 - 2011-07-27 15:54 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Skype
2013-10-21 10:52 - 2011-12-04 16:34 - 00001148 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005UA.job
2013-10-21 10:33 - 2012-02-04 13:55 - 00000000 ____D C:\Program Files\Xvid
2013-10-21 10:27 - 2013-10-21 10:25 - 10768856 _____ (Xvid Team) C:\Users\armin.basten\Downloads\Xvid-1.3.2-20110601.exe
2013-10-21 08:38 - 2011-07-27 13:04 - 01235735 _____ C:\Windows\WindowsUpdate.log
2013-10-21 08:37 - 2013-10-18 10:39 - 00000000 ____D C:\Program Files\Wetelecom
2013-10-21 07:59 - 2013-09-29 23:17 - 00015858 _____ C:\Windows\PFRO.log
2013-10-21 07:59 - 2013-09-29 23:17 - 00001917 _____ C:\Windows\setupact.log
2013-10-21 07:59 - 2009-07-14 08:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-10-21 07:59 - 2009-07-14 08:33 - 00509944 _____ C:\Windows\system32\FNTCACHE.DAT
2013-10-21 07:57 - 2013-10-21 00:49 - 00181064 _____ (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-10-21 06:52 - 2011-12-04 16:34 - 00001096 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3934052282-1587484455-2844972666-1005Core.job
2013-10-21 06:43 - 2011-07-27 13:02 - 00111912 _____ C:\Users\armin.basten\AppData\Local\GDIPFONTCACHEV1.DAT
2013-10-21 06:07 - 2011-10-14 19:18 - 00760046 _____ C:\Windows\system32\perfh01F.dat
2013-10-21 06:07 - 2011-10-14 19:18 - 00179060 _____ C:\Windows\system32\perfc01F.dat
2013-10-21 06:07 - 2011-08-09 15:24 - 00826518 _____ C:\Windows\system32\perfh019.dat
2013-10-21 06:07 - 2011-08-09 15:24 - 00189854 _____ C:\Windows\system32\perfc019.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00598274 _____ C:\Windows\system32\perfh014.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00545688 _____ C:\Windows\system32\perfh012.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00522798 _____ C:\Windows\system32\prfh0404.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00506496 _____ C:\Windows\system32\prfh0804.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00161260 _____ C:\Windows\system32\perfc012.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00160832 _____ C:\Windows\system32\prfc0804.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00155918 _____ C:\Windows\system32\prfc0404.dat
2013-10-21 06:07 - 2011-07-28 10:38 - 00133974 _____ C:\Windows\system32\perfc014.dat
2013-10-21 06:07 - 2010-07-01 04:19 - 00840728 _____ C:\Windows\system32\perfh010.dat
2013-10-21 06:07 - 2010-07-01 04:19 - 00184750 _____ C:\Windows\system32\perfc010.dat
2013-10-21 06:07 - 2010-06-30 18:31 - 11561664 _____ C:\Windows\system32\PerfStringBackup.INI
2013-10-21 06:07 - 2009-07-14 08:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-21 06:07 - 2009-07-14 08:34 - 00009920 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-20 23:24 - 2013-10-20 23:24 - 00003408 ____N C:\bootsqm.dat
2013-10-20 23:05 - 2013-10-20 23:05 - 00000000 ____D C:\Users\armin.basten\Downloads\tweaking.com_windows_repair_aio
2013-10-20 20:04 - 2013-10-20 20:04 - 00358923 _____ (Farbar) C:\Users\armin.basten\Desktop\FSS.exe
2013-10-20 19:54 - 2013-10-20 19:54 - 00000000 ____D C:\ProgramData\Oracle
2013-10-20 19:53 - 2013-10-20 19:51 - 00004874 _____ C:\Windows\system32\jupdate-1.7.0_45-b18.log
2013-10-20 19:53 - 2012-04-03 12:04 - 00000000 ____D C:\Program Files\Java
2013-10-20 15:02 - 2013-10-01 15:28 - 00000056 _____ C:\Windows\Acroread.ini
2013-10-20 14:18 - 2013-02-16 19:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\uTorrent
2013-10-20 13:44 - 2013-09-20 21:00 - 00005140 _____ C:\Users\armin.basten\Desktop\S6-4F.txt
2013-10-20 13:04 - 2013-10-20 13:04 - 01087515 _____ (Farbar) C:\Users\armin.basten\Desktop\FRST.exe
2013-10-20 12:11 - 2013-10-20 12:11 - 00891167 _____ C:\Users\armin.basten\Downloads\SecurityCheck.exe
2013-10-19 20:40 - 2013-09-21 13:33 - 00000955 _____ C:\Users\armin.basten\Desktop\ETKA.txt
2013-10-19 13:19 - 2013-10-19 13:19 - 00047920 _____ C:\Users\armin.basten\Downloads\FRST.txt
2013-10-19 13:16 - 2013-10-18 18:05 - 00000460 _____ C:\Users\armin.basten\Downloads\defogger_disable.log
2013-10-19 08:18 - 2013-10-19 08:18 - 00000000 ____D C:\Windows\ERUNT
2013-10-19 08:01 - 2013-10-19 07:57 - 00000000 ____D C:\AdwCleaner
2013-10-19 03:42 - 2011-08-30 09:22 - 00000000 ____D C:\Windows\3PUPrgWsQafmis
2013-10-19 03:07 - 2013-10-19 03:06 - 01033335 _____ (Thisisu) C:\Users\armin.basten\Desktop\JRT.exe
2013-10-19 02:53 - 2013-10-19 02:53 - 00001037 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-10-19 02:53 - 2013-10-19 02:53 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-10-19 02:50 - 2013-10-19 02:50 - 01050644 _____ C:\Users\armin.basten\Desktop\adwcleaner.exe
2013-10-19 02:50 - 2013-10-19 02:48 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\armin.basten\Downloads\mbam-setup-1.75.0.1300.exe
2013-10-18 22:02 - 2013-10-18 21:33 - 00000000 ____D C:\ComboFix
2013-10-18 22:01 - 2013-10-18 22:01 - 00028809 _____ C:\ComboFix.txt
2013-10-18 22:01 - 2013-08-10 13:57 - 00000000 ____D C:\Qoobox
2013-10-18 21:52 - 2009-07-14 06:04 - 00000215 _____ C:\Windows\system.ini
2013-10-18 21:31 - 2013-10-18 21:29 - 05134711 ____R (Swearware) C:\Users\armin.basten\Desktop\ComboFix.exe
2013-10-18 20:19 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\NDF
2013-10-18 20:17 - 2013-10-18 20:17 - 00015554 _____ C:\Users\armin.basten\Downloads\GMER.txt
2013-10-18 18:20 - 2013-10-18 18:20 - 00377856 _____ C:\Users\armin.basten\Downloads\0i2g6zy8.exe
2013-10-18 18:12 - 2013-10-18 18:11 - 00031389 _____ C:\Users\armin.basten\Downloads\Addition.txt
2013-10-18 18:10 - 2013-10-18 18:10 - 00000000 ____D C:\FRST
2013-10-18 18:05 - 2013-10-18 18:05 - 00000146 _____ C:\Users\armin.basten\defogger_reenable
2013-10-18 18:04 - 2013-10-18 18:04 - 00050477 _____ C:\Users\armin.basten\Downloads\Defogger.exe
2013-10-18 10:39 - 2013-10-18 10:39 - 00000952 _____ C:\Users\armin.basten\Desktop\NetKit.lnk
2013-10-18 10:39 - 2013-10-18 10:39 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wetelecom
2013-10-17 11:33 - 2012-04-15 13:00 - 00000000 ____D C:\ProgramData\Apple
2013-10-17 09:30 - 2013-10-17 14:48 - 05436744 _____ (Apple Inc.) C:\Users\armin.basten\Downloads\BonjourPSSetup.exe
2013-10-14 09:40 - 2013-10-14 09:40 - 00131072 _____ C:\Windows\Minidump\101413-31184-01.dmp
2013-10-14 09:40 - 2011-08-17 09:37 - 00000000 ____D C:\Windows\Minidump
2013-10-12 15:41 - 2011-07-27 15:52 - 00000000 ___RD C:\Program Files\Skype
2013-10-12 15:41 - 2011-07-27 15:52 - 00000000 ____D C:\ProgramData\Skype
2013-10-10 19:11 - 2012-03-03 10:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\AIMP3
2013-10-10 10:32 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\zh-TW
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\zh-CN
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\tr-TR
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\ru-RU
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\nb-NO
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\ko-KR
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\it-IT
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\fr-FR
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\fi-FI
2013-10-10 09:38 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system32\de-DE
2013-10-10 09:15 - 2011-07-28 14:07 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-10-10 09:13 - 2013-07-20 14:09 - 00000000 ____D C:\Windows\system32\MRT
2013-10-10 09:07 - 2011-07-27 20:14 - 78106760 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-10-09 14:24 - 2013-10-09 14:24 - 00001401 _____ C:\Users\armin.basten\Desktop\CopyTrans Control Center.lnk
2013-10-09 14:24 - 2013-10-09 14:24 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CopyTrans Suite
2013-10-09 14:24 - 2012-05-21 06:20 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\WindSolutions
2013-10-09 14:24 - 2012-05-21 06:20 - 00000000 ____D C:\ProgramData\WindSolutions
2013-10-09 10:47 - 2013-05-06 15:40 - 00004756 _____ C:\Users\armin.basten\Desktop\Edenites.txt
2013-10-08 09:50 - 2013-10-20 19:53 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-10-08 09:46 - 2013-10-20 19:53 - 00264616 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-10-08 09:46 - 2013-10-20 19:53 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-10-08 09:46 - 2013-10-20 19:53 - 00174504 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-10-03 22:49 - 2013-10-03 22:49 - 00189643 _____ C:\Users\armin.basten\Documents\Schiebedach.xps
2013-10-03 14:53 - 2013-10-03 14:52 - 12105568 _____ (EVC electronic GmbH ) C:\Users\armin.basten\Downloads\WinOLS_Testversion.EXE
2013-10-01 18:00 - 2013-05-06 12:45 - 00067680 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-10-01 18:00 - 2012-11-05 08:14 - 00137208 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-10-01 18:00 - 2012-11-05 08:14 - 00089376 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-10-01 18:00 - 2012-11-05 08:14 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-10-01 05:49 - 2013-09-30 23:49 - 98602865 _____ C:\Windows\system32\胜塃ᵌd
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000756 _____ C:\Users\Public\Desktop\ElsaWin Administration.lnk
2013-09-30 19:01 - 2013-09-30 19:01 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ElsaWin
2013-09-30 19:00 - 2013-09-30 19:00 - 00000000 ____D C:\VW
2013-09-30 18:20 - 2013-09-30 00:13 - 00000556 _____ C:\Windows\ODBC.INI
2013-09-30 14:36 - 2013-09-30 14:36 - 00000000 ____D C:\ProgramData\Western Digital
2013-09-30 01:14 - 2013-09-30 00:31 - 00124421 _____ C:\Users\armin.basten\Documents\esla.xps
2013-09-30 01:11 - 2013-09-30 00:12 - 00000000 ____D C:\Program Files\Diagnose-BK
2013-09-30 00:09 - 2013-03-23 18:26 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\DAEMON Tools Lite
2013-09-29 23:35 - 2013-09-29 23:22 - 00005120 _____ C:\WirelessDiagLog.csv
2013-09-29 23:17 - 2013-09-29 23:17 - 00000000 _____ C:\Windows\setuperr.log
2013-09-29 19:18 - 2012-04-03 15:27 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\FileZilla
2013-09-29 18:10 - 2013-03-24 16:04 - 00000156 _____ C:\Windows\etkinst.ini
2013-09-29 16:32 - 2013-09-21 10:50 - 00007771 _____ C:\Windows\system32\HLDRV.LOG
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\Vincreator.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000675 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Germany 2013.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000670 _____ C:\Users\armin.basten\Desktop\ETKA 7.4 Online-Update.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000664 _____ C:\Users\armin.basten\Desktop\ETKA-Supportforum.lnk
2013-09-29 16:18 - 2013-09-29 16:18 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ETKA 7.4 Germany 2013
2013-09-29 16:02 - 2013-09-21 10:15 - 00000000 ____D C:\Windows\ETKA7.4_Germany
2013-09-29 16:02 - 2009-07-14 06:37 - 00000000 ____D C:\Windows\system
2013-09-29 15:57 - 2013-09-28 14:12 - 00000000 ____D C:\Program Files\Spyware Terminator
2013-09-28 23:50 - 2013-09-28 23:50 - 98442955 _____ C:\Windows\system32\㻚ᵌa
2013-09-28 14:08 - 2013-09-28 14:06 - 00000000 ____D C:\Users\armin.basten\Downloads\TuWG2013
2013-09-28 11:16 - 2012-06-17 18:37 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Audacity
2013-09-28 09:32 - 2012-05-11 21:25 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-09-28 09:32 - 2011-07-27 17:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-09-28 08:10 - 2013-09-28 01:28 - 00000000 ____D C:\Program Files\Browser Protect Removal Tool
2013-09-28 00:37 - 2013-09-28 00:29 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-09-28 00:22 - 2013-09-27 22:32 - 00000000 ____D C:\Windows\865537E164904193A4B6669C62711852.TMP
2013-09-27 22:34 - 2013-09-27 22:34 - 00000000 ____D C:\Program Files\Enigma Software Group
2013-09-27 22:32 - 2013-02-04 06:27 - 00000000 ____D C:\Program Files\Common Files\Wise Installation Wizard
2013-09-27 22:21 - 2011-08-03 15:31 - 00000000 ____D C:\Users\armin.basten\AppData\Roaming\Canon
2013-09-27 22:21 - 2011-08-03 14:44 - 00000000 ____D C:\Program Files\Canon
2013-09-27 22:17 - 2011-08-03 15:32 - 00000000 ___HD C:\ProgramData\CanonIJScan
2013-09-27 22:17 - 2009-07-14 08:52 - 00000000 ____D C:\Windows\twain_32
2013-09-27 22:08 - 2012-04-15 13:04 - 00000000 ____D C:\ProgramData\Apple Computer
2013-09-26 05:48 - 2013-09-25 17:48 - 97892804 _____ C:\Windows\system32\橩難ὄh
2013-09-23 03:28 - 2013-10-10 09:06 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-09-23 03:28 - 2013-10-10 09:06 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-09-23 03:28 - 2013-10-10 09:05 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 02876928 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00039424 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-09-23 03:27 - 2013-10-10 09:06 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-09-23 03:27 - 2013-10-10 09:05 - 14335488 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-09-23 03:27 - 2013-10-10 09:05 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-09-23 02:51 - 2013-09-23 02:51 - 00001247 _____ C:\Users\armin.basten\Desktop\UniSettings Bosch ME7.lnk
2013-09-21 11:01 - 2011-10-08 09:18 - 00000000 ____D C:\Users\armin.basten\Desktop\IFM VES003_2_6
2013-09-21 10:48 - 2013-09-21 10:48 - 00191488 _____ (Aladdin Knowledge Systems Ltd.) C:\Windows\system32\hlvdd.dll
2013-09-21 07:30 - 2013-10-10 09:06 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-09-21 06:39 - 2013-10-10 09:06 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
Some content of TEMP:
====================
C:\Users\armin.basten\AppData\Local\temp\avgnt.exe
C:\Users\armin.basten\AppData\Local\temp\jre-7u45-windows-i586-iftw.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-09-11 02:20
==================== End Of Log ============================
--- --- --- Alles wird gut!!! Nach einem Neustart wurde der Defender nun als aktiv angezeigt. Vielen Dank für die Hilfe!!! |
|
22.10.2013, 07:34
| #14 |
| /// the machine /// TB-Ausbilder | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [x]
C:\Program Files\Enigma Software Group
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
Fertig Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
22.10.2013, 16:48
| #15 |
| | Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 Alles ausgeführt. FRST Log File ist leider gelöscht, aber es war alles ok. Updates Auto, Secunia installiert, AV habe ich jetzt erst mal Avira drauf gelassen bis ich in Deutschland zurück bin. Werde alle empfohlenen Programme nun laden und nutzen. Browser nutze ich momentan Chrome. Nicht zu empfehlen? Englische Links sind kein Problem. Vielen vielen Dank. Dann werde ich mich jetzt mal um die Spende kümmern  Nach einem Lauf von Malwarebytes habe ich das noch gefunden: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.10.22.03 Windows 7 Service Pack 1 x86 NTFS Internet Explorer 10.0.9200.16721 armin.basten :: KIS-FIELD-PG [Administrator] Schutz: Aktiviert 22.10.2013 13:07:35 MBAM-log-2013-10-22 (13-32-55).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 270886 Laufzeit: 24 Minute(n), 17 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 1 C:\Users\armin.basten\AppData\Local\temp\OCS\ocs_v7f.exe (PUP.Optional.DownloadSponsor.A) -> Keine Aktion durchgeführt. (Ende) abendlichen Scan durchgeführt und alles sieht gut aus! System schnurrt wie ein Kätzchen. Vielen vielen Dank nochmal. ABO kann gelöscht werden! |
|
| Themen zu Windows 7: Windows Firewall deaktiviert, nicht bedienbar, Fehlercode: 0x6D9 |
| 4d36e972-e325-11ce-bfc1-08002be10318, antivir, antivirus, chromium, continue, entfernen, farbar, farbar recovery scan tool, flash player, homepage, icreinstall, js/kryptik.ali, minidump, mipony, nicht möglich, plug-in, programm, pum.hijack.homepagecontrol, pup.bprotector, pup.optional.1clickdownload.a, pup.optional.babsolution.a, pup.optional.babylon.a, pup.optional.babylontoolbar.a, pup.optional.bprotector.a, pup.optional.datamngr.a, pup.optional.dealply.a, pup.optional.delta.a, pup.optional.digitalsite.a, pup.optional.filescout.a, software, spyware, svchost.exe, system, windows, ändern |
Linear-Darstellung
