| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GENWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
17.06.2013, 18:06
| #1 |
| |  Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN Hallo zusammen, nun hats mich vielleicht auch erwischt und ich habe mir Malware oder irgendwas anderes eingefangen. Habe bereits im Board geschaut und diverse Scans mit den genannten Programmen durchlaufen lassen (LOG-Files anbei). Angefangen hat meine Suche damit, dass mein USB-Stick statt der gespeicherten Ordner nur noch die Verknüpfungen angezeigt hat. Ein Scan mit Avira hat das trojanische Pferd TR/Dropper.Gen gefunden : Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Sonntag, 16. Juni 2013 21:10
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : R1
Computername : FAHRENHEIT0812
Versionsinformationen:
BUILD.DAT : 13.0.0.3640 Bytes 18.04.2013 13:29:00
AVSCAN.EXE : 13.6.0.1262 636984 Bytes 15.04.2013 18:23:10
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 07.12.2012 07:39:19
LUKE.DLL : 13.6.0.1262 65080 Bytes 15.04.2013 18:31:37
AVSCPLR.DLL : 13.6.0.1262 92216 Bytes 15.04.2013 18:23:21
AVREG.DLL : 13.6.0.1262 247864 Bytes 15.04.2013 18:22:59
avlode.dll : 13.6.2.1262 432184 Bytes 15.04.2013 18:22:38
avlode.rdf : 13.0.1.12 25921 Bytes 16.06.2013 19:07:07
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:00:13
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 19:06:40
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 19:06:47
VBASE003.VDF : 7.11.80.61 2048 Bytes 28.05.2013 19:06:47
VBASE004.VDF : 7.11.80.62 2048 Bytes 28.05.2013 19:06:47
VBASE005.VDF : 7.11.80.63 2048 Bytes 28.05.2013 19:06:47
VBASE006.VDF : 7.11.80.64 2048 Bytes 28.05.2013 19:06:47
VBASE007.VDF : 7.11.80.65 2048 Bytes 28.05.2013 19:06:47
VBASE008.VDF : 7.11.80.66 2048 Bytes 28.05.2013 19:06:48
VBASE009.VDF : 7.11.80.67 2048 Bytes 28.05.2013 19:06:48
VBASE010.VDF : 7.11.80.68 2048 Bytes 28.05.2013 19:06:48
VBASE011.VDF : 7.11.80.69 2048 Bytes 28.05.2013 19:06:48
VBASE012.VDF : 7.11.80.70 2048 Bytes 28.05.2013 19:06:48
VBASE013.VDF : 7.11.80.71 2048 Bytes 28.05.2013 19:06:48
VBASE014.VDF : 7.11.81.57 145408 Bytes 29.05.2013 19:06:48
VBASE015.VDF : 7.11.81.137 130048 Bytes 30.05.2013 19:06:49
VBASE016.VDF : 7.11.81.255 207360 Bytes 31.05.2013 19:06:49
VBASE017.VDF : 7.11.82.91 156160 Bytes 03.06.2013 19:06:50
VBASE018.VDF : 7.11.82.169 220160 Bytes 04.06.2013 19:06:50
VBASE019.VDF : 7.11.83.27 325632 Bytes 06.06.2013 19:06:51
VBASE020.VDF : 7.11.83.121 320512 Bytes 07.06.2013 19:06:52
VBASE021.VDF : 7.11.83.210 244736 Bytes 10.06.2013 19:06:52
VBASE022.VDF : 7.11.84.59 333824 Bytes 12.06.2013 19:06:53
VBASE023.VDF : 7.11.84.163 264192 Bytes 14.06.2013 19:06:54
VBASE024.VDF : 7.11.84.233 203264 Bytes 16.06.2013 19:06:54
VBASE025.VDF : 7.11.84.234 2048 Bytes 16.06.2013 19:06:54
VBASE026.VDF : 7.11.84.235 2048 Bytes 16.06.2013 19:06:55
VBASE027.VDF : 7.11.84.236 2048 Bytes 16.06.2013 19:06:55
VBASE028.VDF : 7.11.84.237 2048 Bytes 16.06.2013 19:06:55
VBASE029.VDF : 7.11.84.238 2048 Bytes 16.06.2013 19:06:55
VBASE030.VDF : 7.11.84.239 2048 Bytes 16.06.2013 19:06:55
VBASE031.VDF : 7.11.85.4 10240 Bytes 16.06.2013 19:06:55
Engineversion : 8.2.12.60
AEVDF.DLL : 8.1.3.4 102774 Bytes 16.06.2013 19:07:06
AESCRIPT.DLL : 8.1.4.122 487806 Bytes 16.06.2013 19:07:06
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 14:54:32
AESBX.DLL : 8.2.5.12 606578 Bytes 29.11.2012 10:25:33
AERDL.DLL : 8.2.0.128 688504 Bytes 16.06.2013 19:07:06
AEPACK.DLL : 8.3.2.16 754041 Bytes 16.06.2013 19:07:04
AEOFFICE.DLL : 8.1.2.56 205180 Bytes 08.03.2013 13:58:35
AEHEUR.DLL : 8.1.4.412 5955962 Bytes 16.06.2013 19:07:03
AEHELP.DLL : 8.1.27.2 266617 Bytes 16.06.2013 19:06:57
AEGEN.DLL : 8.1.7.4 442741 Bytes 16.06.2013 19:06:56
AEEXP.DLL : 8.4.0.34 201079 Bytes 16.06.2013 19:07:07
AEEMU.DLL : 8.1.3.2 393587 Bytes 29.11.2012 10:25:29
AECORE.DLL : 8.1.31.2 201080 Bytes 25.02.2013 14:47:15
AEBB.DLL : 8.1.1.4 53619 Bytes 29.11.2012 10:25:29
AVWINLL.DLL : 13.6.0.480 26480 Bytes 25.01.2013 08:25:06
AVPREF.DLL : 13.6.0.480 51056 Bytes 25.01.2013 08:25:03
AVREP.DLL : 13.6.0.480 178544 Bytes 25.01.2013 08:25:03
AVARKT.DLL : 13.6.0.1262 258104 Bytes 15.04.2013 18:21:18
AVEVTLOG.DLL : 13.6.0.1262 164920 Bytes 15.04.2013 18:22:27
SQLITE3.DLL : 3.7.0.1 397704 Bytes 25.01.2013 08:25:19
AVSMTP.DLL : 13.6.0.480 62832 Bytes 25.01.2013 08:25:04
NETNT.DLL : 13.6.0.480 16240 Bytes 25.01.2013 08:25:15
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 07.12.2012 07:39:21
RCTEXT.DLL : 13.6.0.976 69344 Bytes 08.03.2013 13:58:59
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: ShlExt
Konfigurationsdatei...................: C:\Users\R1\AppData\Local\Temp\581ee382.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: J:,
Durchsuche aktive Programme...........: aus
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Beginn des Suchlaufs: Sonntag, 16. Juni 2013 21:10
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'J:\' <USB DISK>
J:\84612795\FRITZ.exe
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
J:\84612795\Mathe_I_Aufgaben.exe
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
Beginne mit der Desinfektion:
J:\84612795\Mathe_I_Aufgaben.exe
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
[HINWEIS] Die Datei wurde gelöscht.
J:\84612795\FRITZ.exe
[FUND] Ist das Trojanische Pferd TR/Dropper.Gen
[HINWEIS] Die Datei wurde gelöscht.
Ende des Suchlaufs: Sonntag, 16. Juni 2013 21:21
Benötigte Zeit: 09:16 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
239 Verzeichnisse wurden überprüft
56750 Dateien wurden geprüft
2 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
2 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
56748 Dateien ohne Befall
3808 Archive wurden durchsucht
0 Warnungen
2 Hinweise
AVIRA : Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Sonntag, 16. Juni 2013 23:04
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Free Antivirus
Seriennummer : 0000149996-ADJIE-0000001
Plattform : Windows 7 Home Premium
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : R1
Computername : FAHRENHEIT0812
Versionsinformationen:
BUILD.DAT : 13.0.0.3640 54852 Bytes 18.04.2013 13:29:00
AVSCAN.EXE : 13.6.0.1262 636984 Bytes 15.04.2013 18:23:10
AVSCANRC.DLL : 13.4.0.360 64800 Bytes 07.12.2012 07:39:19
LUKE.DLL : 13.6.0.1262 65080 Bytes 15.04.2013 18:31:37
AVSCPLR.DLL : 13.6.0.1262 92216 Bytes 15.04.2013 18:23:21
AVREG.DLL : 13.6.0.1262 247864 Bytes 15.04.2013 18:22:59
avlode.dll : 13.6.2.1262 432184 Bytes 15.04.2013 18:22:38
avlode.rdf : 13.0.1.12 25921 Bytes 16.06.2013 19:07:07
VBASE000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 09:00:13
VBASE001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 19:06:40
VBASE002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 19:06:47
VBASE003.VDF : 7.11.80.61 2048 Bytes 28.05.2013 19:06:47
VBASE004.VDF : 7.11.80.62 2048 Bytes 28.05.2013 19:06:47
VBASE005.VDF : 7.11.80.63 2048 Bytes 28.05.2013 19:06:47
VBASE006.VDF : 7.11.80.64 2048 Bytes 28.05.2013 19:06:47
VBASE007.VDF : 7.11.80.65 2048 Bytes 28.05.2013 19:06:47
VBASE008.VDF : 7.11.80.66 2048 Bytes 28.05.2013 19:06:48
VBASE009.VDF : 7.11.80.67 2048 Bytes 28.05.2013 19:06:48
VBASE010.VDF : 7.11.80.68 2048 Bytes 28.05.2013 19:06:48
VBASE011.VDF : 7.11.80.69 2048 Bytes 28.05.2013 19:06:48
VBASE012.VDF : 7.11.80.70 2048 Bytes 28.05.2013 19:06:48
VBASE013.VDF : 7.11.80.71 2048 Bytes 28.05.2013 19:06:48
VBASE014.VDF : 7.11.81.57 145408 Bytes 29.05.2013 19:06:48
VBASE015.VDF : 7.11.81.137 130048 Bytes 30.05.2013 19:06:49
VBASE016.VDF : 7.11.81.255 207360 Bytes 31.05.2013 19:06:49
VBASE017.VDF : 7.11.82.91 156160 Bytes 03.06.2013 19:06:50
VBASE018.VDF : 7.11.82.169 220160 Bytes 04.06.2013 19:06:50
VBASE019.VDF : 7.11.83.27 325632 Bytes 06.06.2013 19:06:51
VBASE020.VDF : 7.11.83.121 320512 Bytes 07.06.2013 19:06:52
VBASE021.VDF : 7.11.83.210 244736 Bytes 10.06.2013 19:06:52
VBASE022.VDF : 7.11.84.59 333824 Bytes 12.06.2013 19:06:53
VBASE023.VDF : 7.11.84.163 264192 Bytes 14.06.2013 19:06:54
VBASE024.VDF : 7.11.84.233 203264 Bytes 16.06.2013 19:06:54
VBASE025.VDF : 7.11.84.234 2048 Bytes 16.06.2013 19:06:54
VBASE026.VDF : 7.11.84.235 2048 Bytes 16.06.2013 19:06:55
VBASE027.VDF : 7.11.84.236 2048 Bytes 16.06.2013 19:06:55
VBASE028.VDF : 7.11.84.237 2048 Bytes 16.06.2013 19:06:55
VBASE029.VDF : 7.11.84.238 2048 Bytes 16.06.2013 19:06:55
VBASE030.VDF : 7.11.84.239 2048 Bytes 16.06.2013 19:06:55
VBASE031.VDF : 7.11.85.4 10240 Bytes 16.06.2013 19:06:55
Engineversion : 8.2.12.60
AEVDF.DLL : 8.1.3.4 102774 Bytes 16.06.2013 19:07:06
AESCRIPT.DLL : 8.1.4.122 487806 Bytes 16.06.2013 19:07:06
AESCN.DLL : 8.1.10.4 131446 Bytes 26.03.2013 14:54:32
AESBX.DLL : 8.2.5.12 606578 Bytes 29.11.2012 10:25:33
AERDL.DLL : 8.2.0.128 688504 Bytes 16.06.2013 19:07:06
AEPACK.DLL : 8.3.2.16 754041 Bytes 16.06.2013 19:07:04
AEOFFICE.DLL : 8.1.2.56 205180 Bytes 08.03.2013 13:58:35
AEHEUR.DLL : 8.1.4.412 5955962 Bytes 16.06.2013 19:07:03
AEHELP.DLL : 8.1.27.2 266617 Bytes 16.06.2013 19:06:57
AEGEN.DLL : 8.1.7.4 442741 Bytes 16.06.2013 19:06:56
AEEXP.DLL : 8.4.0.34 201079 Bytes 16.06.2013 19:07:07
AEEMU.DLL : 8.1.3.2 393587 Bytes 29.11.2012 10:25:29
AECORE.DLL : 8.1.31.2 201080 Bytes 25.02.2013 14:47:15
AEBB.DLL : 8.1.1.4 53619 Bytes 29.11.2012 10:25:29
AVWINLL.DLL : 13.6.0.480 26480 Bytes 25.01.2013 08:25:06
AVPREF.DLL : 13.6.0.480 51056 Bytes 25.01.2013 08:25:03
AVREP.DLL : 13.6.0.480 178544 Bytes 25.01.2013 08:25:03
AVARKT.DLL : 13.6.0.1262 258104 Bytes 15.04.2013 18:21:18
AVEVTLOG.DLL : 13.6.0.1262 164920 Bytes 15.04.2013 18:22:27
SQLITE3.DLL : 3.7.0.1 397704 Bytes 25.01.2013 08:25:19
AVSMTP.DLL : 13.6.0.480 62832 Bytes 25.01.2013 08:25:04
NETNT.DLL : 13.6.0.480 16240 Bytes 25.01.2013 08:25:15
RCIMAGE.DLL : 13.4.0.360 4780832 Bytes 07.12.2012 07:39:21
RCTEXT.DLL : 13.6.0.976 69344 Bytes 08.03.2013 13:58:59
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Suche nach Rootkits und aktiver Malware
Konfigurationsdatei...................: C:\ProgramData\Avira\AntiVir Desktop\PROFILES\rootkit.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Durchsuche aktive Programme...........: ein
Laufende Programme erweitert..........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: ein
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Alle Dateien
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: vollständig
Beginn des Suchlaufs: Sonntag, 16. Juni 2013 23:04
Der Suchlauf nach versteckten Objekten wird begonnen.
Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'SearchFilterHost.exe' - '27' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchProtocolHost.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'RunDll32.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskeng.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '63' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'vssvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'avscan.exe' - '114' Modul(e) wurden durchsucht
Durchsuche Prozess 'avcenter.exe' - '138' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '59' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmpnetwk.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'googledrivesync.exe' - '120' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '61' Modul(e) wurden durchsucht
Durchsuche Prozess 'DefaultAudioChanger.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'googledrivesync.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'picpick.exe' - '72' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '89' Modul(e) wurden durchsucht
Durchsuche Prozess 'Updater.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'KHALMNPR.EXE' - '38' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrYNSvc.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'jusched.exe' - '29' Modul(e) wurden durchsucht
Durchsuche Prozess 'LWEMon.exe' - '45' Modul(e) wurden durchsucht
Durchsuche Prozess 'SearchIndexer.exe' - '54' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrStMonW.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'brccMCtl.exe' - '88' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '57' Modul(e) wurden durchsucht
Durchsuche Prozess 'wmdc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'DivXUpdate.exe' - '69' Modul(e) wurden durchsucht
Durchsuche Prozess 'AvmObex.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'AvmObex.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'bluefritz.exe' - '39' Modul(e) wurden durchsucht
Durchsuche Prozess 'GrooveMonitor.exe' - '51' Modul(e) wurden durchsucht
Durchsuche Prozess 'SetPoint.exe' - '74' Modul(e) wurden durchsucht
Durchsuche Prozess 'VDeck.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'WLanGUI.exe' - '37' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvtray.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'WUDFHost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'avshadow.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '64' Modul(e) wurden durchsucht
Durchsuche Prozess 'PnkBstrA.exe' - '25' Modul(e) wurden durchsucht
Durchsuche Prozess 'NMSAccessU.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'taskhost.exe' - '56' Modul(e) wurden durchsucht
Durchsuche Prozess 'WlanNetService.exe' - '46' Modul(e) wurden durchsucht
Durchsuche Prozess 'avmbtservice.exe' - '24' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '71' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '23' Modul(e) wurden durchsucht
Durchsuche Prozess 'Explorer.EXE' - '183' Modul(e) wurden durchsucht
Durchsuche Prozess 'Dwm.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '66' Modul(e) wurden durchsucht
Durchsuche Prozess 'brss01a.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '40' Modul(e) wurden durchsucht
Durchsuche Prozess 'spoolsv.exe' - '93' Modul(e) wurden durchsucht
Durchsuche Prozess 'brsvc01a.exe' - '15' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '155' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '85' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '123' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '95' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '47' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvxdsync.exe' - '50' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '28' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvvsvc.exe' - '35' Modul(e) wurden durchsucht
Durchsuche Prozess 'FusionSVC.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '75' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '34' Modul(e) wurden durchsucht
Durchsuche Prozess 'svchost.exe' - '52' Modul(e) wurden durchsucht
Durchsuche Prozess 'winlogon.exe' - '31' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsm.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'lsass.exe' - '68' Modul(e) wurden durchsucht
Durchsuche Prozess 'services.exe' - '33' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '16' Modul(e) wurden durchsucht
Durchsuche Prozess 'wininit.exe' - '26' Modul(e) wurden durchsucht
Durchsuche Prozess 'csrss.exe' - '18' Modul(e) wurden durchsucht
Durchsuche Prozess 'smss.exe' - '2' Modul(e) wurden durchsucht
Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
Die Registry wurde durchsucht ( '2845' Dateien ).
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:'
[0] Archivtyp: Runtime Packed
--> C:\$Recycle.Bin\S-1-5-21-154391645-2589312494-2914735315-1000\$RXCUN5U.zip
[1] Archivtyp: ZIP
--> African elephants Clock.exe
[2] Archivtyp: Inno Setup
--> {app}\Info\License.txt
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.X.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {tmp}\rkinstaller.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.Q
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {tmp}\rkverify.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.G.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Analogy.exe
[2] Archivtyp: OVL
--> Astro Clock 3D 1.1.exe
[3] Archivtyp: Inno Setup
--> {tmp}\License_Adparatus.rtf
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Adparatus.A.63
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {win}\3D Astro Clock.scr
[4] Archivtyp: RSRC
--> {win}\3D Astro Clock.scr
[5] Archivtyp: OVL
--> Blot Clock 2.3.exe
[6] Archivtyp: Inno Setup
--> {app}\Info\License.txt
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.X.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {tmp}\rkinstaller.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.Q
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {tmp}\rkverify.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.G.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> Polarclock 3.exe
[6] Archivtyp: OVL
--> Water Color Clock.exe
[7] Archivtyp: Inno Setup
--> {app}\Info\License.txt
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.X.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {tmp}\rkinstaller.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.Q
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
--> {tmp}\rkverify.exe
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.G.1
[WARNUNG] Infizierte Dateien in Archiven können nicht repariert werden
C:\$Recycle.Bin\S-1-5-21-154391645-2589312494-2914735315-1000\$RXCUN5U.zip
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.G.1
Beginne mit der Desinfektion:
C:\$Recycle.Bin\S-1-5-21-154391645-2589312494-2914735315-1000\$RXCUN5U.zip
[FUND] Enthält Erkennungsmuster der Adware ADWARE/Relevant.G.1
[HINWEIS] Die Datei wurde gelöscht.
Ende des Suchlaufs: Montag, 17. Juni 2013 06:16
Benötigte Zeit: 2:01:33 Stunde(n)
Der Suchlauf wurde vollständig durchgeführt.
34745 Verzeichnisse wurden überprüft
768893 Dateien wurden geprüft
11 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
1 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
0 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
768882 Dateien ohne Befall
5797 Archive wurden durchsucht
10 Warnungen
1 Hinweise
742213 Objekte wurden beim Rootkitscan durchsucht
0 Versteckte Objekte wurden gefunden
OTL MALWAREBYTES GMER aswMBR TDSS_Killer Die Logs habe ich angehängt. Leider kann ich jetzt nicht sagen, wie der aktuelle Stand meines Systems ist und würde mich über Hilfe sehr freuen. |
|
17.06.2013, 18:52
| #2 |
| /// the machine /// TB-Ausbilder    | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN Hi,
__________________Systemscan mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit (Wenn du nicht sicher bist: Start > Computer (Rechtsklick) > Eigenschaften)
__________________ |
|
17.06.2013, 19:06
| #3 |
| | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN FRST
__________________FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-06-2013 01
Ran by R1 (administrator) on 17-06-2013 19:55:37
Running from C:\Users\R1\Desktop
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Advanced Micro Devices) C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(brother Industries Ltd) C:\Windows\system32\brsvc01a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(brother Industries Ltd) C:\Windows\system32\brss01a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\avmclient\avmbtservice.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WlanNetService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
() C:\Windows\system32\PnkBstrA.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(AVM Berlin) C:\Program Files\avmclient\bluefritz.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Ask) C:\Program Files\Ask.com\Updater\Updater.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(NTeWORKS) C:\Program Files\PicPick\picpick.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
() C:\Users\R1\AppData\Local\Temp\Temp1_DefaultAudioChanger_1.0.3.zip\DefaultAudioChanger.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\program files\avira\antivir desktop\avcenter.exe
(Microsoft Corporation) C:\Windows\system32\StikyNot.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [1904640 2009-05-07] (AVM Berlin)
HKLM\...\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r [1681408 2009-09-21] (VIA)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1311312 2010-06-26] (Logitech, Inc.)
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [AVMBlueClient] C:\Program Files\avmclient\bluefritz.exe [1859584 2007-07-03] (AVM Berlin)
HKLM\...\Run: [AVMBLUEOBEX] C:\Program Files\avmclient\AvmObex.exe -pushclient -ftpclient [491520 2007-07-03] (AVM Berlin)
HKLM\...\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-29] ()
HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM\...\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui [153672 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [ApnUpdater] "C:\Program Files\Ask.com\Updater\Updater.exe" [1648264 2013-04-30] (Ask)
HKLM\...\Run: [] [x]
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-04-04] (Avira Operations GmbH & Co. KG)
HKLM\...\Winlogon: [Userinit] c:\windows\system32\userinit.exe, [x]
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Run: [Google Update] "C:\Users\R1\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-09-25] (Google Inc.)
HKCU\...\Run: [PicPick Start] C:\Program Files\PicPick\picpick.exe [10858496 2011-12-16] (NTeWORKS)
HKCU\...\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe" [x]
HKCU\...\Run: [Rainlendar2] C:\Program Files\Rainlendar2\Rainlendar2.exe [x]
HKCU\...\Run: [ASRockOCTuner] [x]
HKCU\...\Run: [GoogleDriveSync] "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart [19662744 2013-04-16] (Google)
HKCU\...\Run: [DefaultAudioChanger] C:\Users\R1\AppData\Local\Temp\Temp1_DefaultAudioChanger_1.0.3.zip\DefaultAudioChanger.exe [119296 2011-12-01] ()
HKCU\...\Run: [RESTART_STICKY_NOTES] C:\Windows\system32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
MountPoints2: {7620226b-9e51-11df-b6ff-806e6f6e6963} - H:\AutoRun.exe
MountPoints2: {999241f4-d94a-11de-b53a-0025223258b2} - H:\pushinst.exe
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
URLSearchHook: UrlSearchHook Class - {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
SearchScopes: HKCU - {4C028E97-244A-4090-9B5C-35BC25F65048} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=AVR-4&o=APN10261&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=^AGS&apn_dtid=^YYYYYY^YY^DE&apn_uid=08c8a9f5-a300-4a14-a695-3ae27b7d458f&apn_sauid=89914782-6F34-41A4-A03B-6E9CE7C0ADA9
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No File
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKCU -No Name - {DFEFCDEE-CF1A-4FC8-88AD-129872198372} - No File
Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Google Update) - C:\Users\R1\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Drive) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (AdBlock) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.64_0
CHR Extension: (Wolfram|Alpha (Official)) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\icncamkooinmbehmkeilcccmoljfkdhp\1.2.2_0
CHR Extension: (Gmail) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
========================== Services (Whitelisted) =================
R2 AMDFusionSVC; C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [383544 2009-09-08] (Advanced Micro Devices)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86752 2013-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110816 2013-02-25] (Avira Operations GmbH & Co. KG)
S2 AODService; C:\Program Files\AMD\OverDrive\AODAssist.exe [124256 2009-05-05] ()
R2 AVM BT Connection Service; C:\Program Files\avmclient\avmbtservice.exe [405504 2007-07-03] (AVM Berlin)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [368640 2009-05-07] (AVM Berlin)
S2 AvmObexService; C:\Program Files\avmclient\AvmObexService.exe [221184 2007-07-03] (AVM Berlin)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2010-08-29] ()
==================== Drivers (Whitelisted) ====================
R3 AmdLLD; C:\Windows\System32\DRIVERS\AmdLLD.sys [42552 2009-04-22] (Advanced Micro Devices)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-11-19] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-06] (Avira Operations GmbH & Co. KG)
R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH)
R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2009-05-07] (AVM Berlin)
S3 bfhubase; C:\Windows\System32\DRIVERS\bfhubase.sys [851712 2007-07-03] (AVM Berlin)
R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin)
R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2009-05-07] (AVM GmbH)
S3 gpslc; C:\Windows\System32\Drivers\gpslc.sys [56832 2009-03-16] (Mobile Action Technology Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-11-19] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37328 2010-03-18] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 Pnp680r; C:\Windows\System32\DRIVERS\pnp680r.sys [110120 2007-07-20] (Silicon Image, Inc)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1086976 2009-09-17] (VIA Technologies, Inc.)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [174592 2012-12-12] (VIA Technologies, Inc.)
R3 WmBEnum; C:\Windows\System32\drivers\WmBEnum.sys [22856 2010-04-27] (Logitech Inc.)
R3 WmFilter; C:\Windows\System32\drivers\WmFilter.sys [37704 2010-04-27] (Logitech Inc.)
R3 WmHidLo; C:\Windows\System32\drivers\WmHidLo.sys [31816 2010-04-27] (Logitech Inc.)
S3 WmUsbHid; C:\Windows\System32\drivers\WmUsbHid.sys [23040 2003-05-14] (Logitech Inc.)
R3 WmVirHid; C:\Windows\System32\drivers\WmVirHid.sys [15048 2010-04-27] (Logitech Inc.)
R3 WmXlCore; C:\Windows\System32\drivers\WmXlCore.sys [66632 2010-04-27] (Logitech Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [210432 2012-12-12] (VIA Technologies, Inc.)
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
U3 aswMBR; \??\C:\Users\R1\AppData\Local\Temp\aswMBR.sys [x]
U3 fftyypog; \??\C:\Users\R1\AppData\Local\Temp\fftyypog.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:53 - 2013-06-17 19:54 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:42 - 2013-06-17 19:42 - 314110888 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-17 06:21 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:34 - 2013-06-16 22:36 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:32 - 2013-06-16 22:33 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:31 - 2013-06-16 22:32 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:33 - 2013-06-16 21:34 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:05 - 2013-06-16 21:05 - 00000000 ____D C:\Users\R1\AppData\Local\APN
2013-06-16 21:04 - 2013-03-06 16:13 - 00037352 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00135136 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00084744 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-06-16 21:04 - 2012-08-27 15:50 - 00028520 ____A (Avira GmbH) C:\Windows\System32\Drivers\ssmdrv.sys
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 20:56 - 2013-06-16 21:00 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-14 19:53 - 2013-06-16 20:37 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-14 01:10 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 01:10 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 01:08 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 01:08 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 01:08 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 18:22 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 18:22 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 18:22 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 18:22 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 18:22 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 18:22 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-13 18:22 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-13 18:22 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 18:22 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-13 18:22 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
==================== One Month Modified Files and Folders ========
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:54 - 2013-06-17 19:53 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:53 - 2013-01-13 19:06 - 00031080 ____A C:\Windows\setupact.log
2013-06-17 19:42 - 2013-06-17 19:42 - 314110888 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 19:40 - 2012-04-01 10:22 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-17 19:30 - 2011-09-25 11:37 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000UA.job
2013-06-17 19:08 - 2012-12-06 22:53 - 00001090 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 15:54 - 2010-08-02 18:20 - 01535015 ____A C:\Windows\WindowsUpdate.log
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:57 - 2012-12-06 22:55 - 00000000 ___SD C:\Users\R1\Google Drive
2013-06-17 07:24 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-17 07:24 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-17 07:22 - 2010-08-02 18:34 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:17 - 2012-12-06 22:53 - 00001086 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-17 07:17 - 2010-08-09 13:20 - 00000000 ____D C:\Windows\Minidump
2013-06-17 07:17 - 2010-08-03 22:36 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-17 07:17 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:44 - 2013-01-13 20:31 - 00099782 ____A C:\Windows\PFRO.log
2013-06-17 06:43 - 2010-08-02 12:44 - 00000000 ____D C:\users\R1
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-16 23:30 - 2011-09-25 11:37 - 00001056 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000Core.job
2013-06-16 23:01 - 2012-04-25 10:14 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:36 - 2013-06-16 22:34 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:33 - 2013-06-16 22:32 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:32 - 2013-06-16 22:31 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:34 - 2013-06-16 21:33 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:06 - 2013-02-17 00:49 - 00001912 ____A C:\Windows\epplauncher.mif
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:05 - 2013-06-16 21:05 - 00000000 ____D C:\Users\R1\AppData\Local\APN
2013-06-16 21:05 - 2013-04-27 12:54 - 00000000 ____D C:\Program Files\Ask.com
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 21:03 - 2012-05-26 06:56 - 00000000 ____D C:\ProgramData\Avira
2013-06-16 21:00 - 2013-06-16 20:56 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-16 20:49 - 2013-05-12 23:34 - 00000032 ____A C:\Windows\Menu.INI
2013-06-16 20:37 - 2013-06-14 19:53 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-16 10:20 - 2012-04-29 14:15 - 00000000 ____D C:\Users\R1\AppData\Roaming\TS3Client
2013-06-14 20:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 19:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 01:11 - 2010-08-05 15:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-14 01:09 - 2010-10-08 22:04 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 19:41 - 2012-04-01 10:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 19:41 - 2011-06-25 09:19 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 21:50 - 2012-12-12 21:11 - 00000981 ____A C:\Users\R1\Desktop\rFactor - Bockbierbude.lnk
2013-06-08 13:42 - 2013-06-14 01:10 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 01:10 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
2013-06-01 18:36 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Steam
2013-06-01 18:31 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-05-26 10:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-13 19:09
==================== End Of Log ============================
--- --- --- Addition Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 16-06-2013 01 Ran by R1 at 2013-06-17 20:01:19 Run: Running from C:\Users\R1\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) 7-Zip 4.65 Adobe Flash Player 11 ActiveX (Version: 11.7.700.224) Adobe Flash Player 11 Plugin (Version: 11.7.700.224) Adobe Reader X (10.1.7) - Deutsch (Version: 10.1.7) Amazon MP3-Downloader 1.0.17 (Version: 1.0.17) AMD Fusion Utility for Desktops (Version: 1.1.1) AMD OverDrive (Version: 3.0.2.0289) ANNO 1503 Ask Toolbar (Version: 1.15.26.0) ASRock OC Tuner v2.2.96 Avira Free Antivirus (Version: 13.0.0.3640) Avira SearchFree Toolbar plus Web Protection Updater (Version: 1.2.6.45268) AVM BlueFRITZ! USB AVM FRITZ!WLAN Bierbuden Autoupdate (remove only) Brother MFL-Pro Suite DCP-J715W (Version: 1.0.4.0) CCleaner (Version: 3.26) CDBurnerXP (Version: 4.3.7.2316) Colin McRae Rally 3 (Version: 1.00.000) Crysis(R) (Version: 1.00.0000) DHTML Editing Component (Version: 6.02.0001) DivX-Setup (Version: 2.6.1.8) eReg (Version: 1.20.138.34) EVGA Precision X 3.0.4 (Version: 3.0.4) ffdshow v1.2.4422 [2012-04-09] (Version: 1.2.4422.0) FileZilla Client 3.3.4 (Version: 3.3.4) FreeCommander 2009.02b (Version: 2009.02) Google Chrome (Version: 27.0.1453.110) Google Drive (Version: 1.9.4536.8202) Google Update Helper (Version: 1.3.21.145) GT Legends GTR 2 1.0.0.0 (Version: v1.0.0.0) GTR Evolution Internet-TV für Windows Media Center (Version: 4.2.2.0) Java 7 Update 21 (Version: 7.0.210) Java Auto Updater (Version: 2.1.9.5) Logitech Gaming Software 5.10 (Version: 5.10.127) Logitech SetPoint 6.15 (Version: 6.15.25) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30320) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Access MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000) Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Groove MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office InfoPath MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Publisher MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20125.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Mozilla Maintenance Service (Version: 17.0.6) Mozilla Thunderbird 17.0.6 (x86 de) (Version: 17.0.6) MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0) NVIDIA 3D Vision Treiber 311.06 (Version: 311.06) NVIDIA Display Control Panel (Version: 6.14.12.5896) NVIDIA Grafiktreiber 311.06 (Version: 311.06) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA PhysX (Version: 9.10.0224) NVIDIA Stereoscopic 3D Driver (Version: 7.17.13.1106) NVIDIA Systemsteuerung 311.06 (Version: 311.06) NVIDIA Update 1.11.3 (Version: 1.11.3) NVIDIA Update Components (Version: 1.11.3) OpenAL Paint.NET v3.5.10 (Version: 3.60.0) PDFCreator (Version: 1.2.0) PicPick (Version: 3.1.0) Platform (Version: 1.34) PunkBuster Services (Version: 0.986) Python 2.7.2 (Version: 2.7.2150) RACE 07 RACE 07 Dedicated Server RACE On Race On Rainmeter Realtek Ethernet Controller Driver (Version: 1.00.0008) rFactor (remove only) rFactorCentral Client 1.04 (Version: 1.04) SAMSUNG USB Driver for Mobile Phones (Version: 1.5.5.0) ScummVM 1.2.0 Serious Sam: Der erste Kontakt STCC: The Game Steam (Version: 1.0.0.0) Talent Editor 2.0.3.0 TeamSpeak 3 Client (Version: 3.0.9.2) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817327) 32-Bit Edition Update für Microsoft Office Excel 2007 Help (KB963678) Update für Microsoft Office Outlook 2007 Help (KB963677) Update für Microsoft Office Powerpoint 2007 Help (KB963669) Update für Microsoft Office Word 2007 Help (KB963665) VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0) VIA Plattform-Geräte-Manager (Version: 1.34) VLC media player 2.0.1 (Version: 2.0.1) Windows Media Center Add-in for Silverlight (Version: 4.7.3.0) Windows Media Player Firefox Plugin (Version: 1.0.0.8) Windows Mobile-Gerätecenter (Version: 6.1.6965.0) Wing Commander Saga 1.0.2.7795 (Version: 1.0.2.7795) wxPython 2.8.12.1 (unicode) for Python 2.7 (Version: 2.8.12.1-unicode) ==================== Restore Points ========================= 30-05-2013 09:17:37 Windows Update 03-06-2013 17:01:05 Windows Update 06-06-2013 18:04:25 Windows Update 13-06-2013 16:39:35 Windows Update 13-06-2013 23:08:02 Windows Update 17-06-2013 03:07:18 Windows Update ==================== Scheduled Tasks (whitelisted) ============= Task: {0AA4492C-081E-450D-A49E-0C71E109A235} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe [2010-11-20] (Microsoft Corporation) Task: {0F948D33-679E-471C-B31E-286F5C9653D5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-06] (Google Inc.) Task: {1617CA45-BA07-45CA-A21F-15AD74F2AF39} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files\Ask.com\UpdateTask.exe [2013-04-30] () Task: {248D046B-D28E-4A51-BA93-E3E80E8C0A96} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000Core => C:\Users\R1\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25] (Google Inc.) Task: {27E7C74B-123D-4288-9644-0111C5E9B3B1} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-12-19] (Piriform Ltd) Task: {2D8ED7E3-3E5E-41A1-AD07-BBB90C759240} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {62349B3B-0C88-496E-9C27-049EC5F6262F} - System32\Tasks\WPD\SqmUpload_S-1-5-21-154391645-2589312494-2914735315-1000 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {763AF69F-37BE-4B60-830D-A6588DA45F87} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {AFC5CD69-B1FB-4965-BD0B-B18C578ADCEA} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-11] (Microsoft Corporation) Task: {B4A75C03-AF7A-4674-837B-BC61A203B504} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation) Task: {C0B1A450-94B3-4058-A2D8-91E2CCD07D9F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-13] (Adobe Systems Incorporated) Task: {DD14E1BC-4BF8-4440-B14B-7B965338BBB2} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2012-12-06] (Google Inc.) Task: {E40DE313-DF06-410D-AFAE-8CB5815EB41E} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000UA => C:\Users\R1\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25] (Google Inc.) Task: {E8164C0D-216C-4B6B-9EB8-31BF958B8014} - System32\Tasks\Microsoft\Windows\NetTrace\GatherNetworkInfo => C:\Windows\system32\gatherNetworkInfo.vbs [2009-06-10] () Task: {FFE2AA73-F0AF-4122-80F3-DEB9CCB0DA3E} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (06/17/2013 04:29:20 PM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 16:29:20.552]: [00002320]: SendSKeySettingToDevice:: Snmp Load Error[0] To[192.168.178.30] Error: (06/17/2013 08:37:33 AM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: AvmObexService.exe, Version: 1.0.13.0, Zeitstempel: 0x4564a69d Name des fehlerhaften Moduls: AVMCCDI.DLL_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4211aef4 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00263d9a ID des fehlerhaften Prozesses: 0x49c Startzeit der fehlerhaften Anwendung: 0xAvmObexService.exe0 Pfad der fehlerhaften Anwendung: AvmObexService.exe1 Pfad des fehlerhaften Moduls: AvmObexService.exe2 Berichtskennung: AvmObexService.exe3 Error: (06/17/2013 08:10:01 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 08:10:01.613]: [00002320]: SendSKeySettingToDevice:: Snmp Load Error[0] To[192.168.178.30] Error: (06/17/2013 07:55:51 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:55:51.781]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error Error: (06/17/2013 07:55:21 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:55:21.746]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error Error: (06/17/2013 07:54:51 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:54:51.722]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error Error: (06/17/2013 07:54:21 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:54:21.699]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error Error: (06/17/2013 07:53:51 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:53:51.675]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error Error: (06/17/2013 07:53:21 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:53:21.652]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error Error: (06/17/2013 07:52:51 AM) (Source: Brother BrLog) (User: ) Description: STI BrtSTI: [2013/06/17 07:52:51.627]: [00002320]: GetDeviceIpAddress: GetAddressByName [BRW0022581BE1DE] Error System errors: ============= Error: (06/17/2013 08:37:36 AM) (Source: Service Control Manager) (User: ) Description: Dienst "AVM BT OBEX Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error: (06/17/2013 08:04:56 AM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk2\DR2. Error: (06/17/2013 07:19:44 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (06/17/2013 07:19:44 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (06/17/2013 07:17:07 AM) (Source: BugCheck) (User: ) Description: 0x00000050 (0xc951900b, 0x00000000, 0xb6cb0955, 0x00000000)C:\Windows\MEMORY.DMP061713-21109-01 Error: (06/17/2013 07:17:06 AM) (Source: EventLog) (User: ) Description: Das System wurde zuvor am ?17.?06.?2013 um 07:14:19 unerwartet heruntergefahren. Error: (06/17/2013 06:46:40 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: %%1069 Error: (06/17/2013 06:46:40 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC). Error: (06/17/2013 06:44:59 AM) (Source: NetBT) (User: ) Description: Der Name "WORKGROUP :1d" konnte nicht auf der Schnittstelle mit IP-Adresse 192.168.178.20 registriert werden. Der Computer mit IP-Adresse 192.168.178.1 hat nicht zugelassen, dass dieser Computer diesen Namen verwendet. Error: (06/17/2013 05:09:30 AM) (Source: Disk) (User: ) Description: Fehlerhafter Block bei Gerät \Device\Harddisk2\DR2. Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 72% Total physical RAM: 3071.3 MB Available physical RAM: 836.25 MB Total Pagefile: 6140.9 MB Available Pagefile: 3032.66 MB Total Virtual: 2047.88 MB Available Virtual: 1903.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:146.39 GB) (Free:61.24 GB) NTFS Drive d: () (Fixed) (Total:151.6 GB) (Free:75.94 GB) NTFS Drive e: (GTR) (Fixed) (Total:74.53 GB) (Free:30.81 GB) NTFS Drive f: (rFactor) (Fixed) (Total:69.46 GB) (Free:2.85 GB) NTFS Drive j: (USB DISK) (Removable) (Total:3.73 GB) (Free:0.54 GB) FAT32 Drive m: (USB-HDD) (Fixed) (Total:596.17 GB) (Free:213.99 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: E151F3F5) Partition 1: (Not Active) - (Size=75 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: E151F3F4) Partition 1: (Not Active) - (Size=69 GB) - (Type=07 NTFS) ======================================================== Disk: 2 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 00000001) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=146 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=152 GB) - (Type=07 NTFS) ======================================================== Disk: 3 (Size: 596 GB) (Disk ID: E078E005) Partition 1: (Not Active) - (Size=596 GB) - (Type=07 NTFS) ======================================================== Disk: 8 (MBR Code: Windows XP) (Size: 4 GB) (Disk ID: B115A667) Partition 1: (Not Active) - (Size=4 GB) - (Type=0C) ==================== End Of Log ============================ |
|
17.06.2013, 19:14
| #4 | |
| /// the machine /// TB-Ausbilder | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GENCombofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.06.2013, 19:35
| #5 |
| | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN ComboFix Log : Code:
ATTFilter ComboFix 13-06-17.01 - R1 17.06.2013 20:20:27.1.2 - x86
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3071.1532 [GMT 2:00]
ausgeführt von:: c:\users\R1\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\R1\AppData\Local\Temp\_MEI39562\_ctypes.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\_elementtree.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\_hashlib.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\_multiprocessing.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\_socket.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\_ssl.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\pyexpat.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\pysqlite2._sqlite.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\python27.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\pythoncom27.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\PyWinTypes27.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\select.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\unicodedata.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32api.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32com.shell.shell.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32crypt.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32event.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32file.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32inet.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32pdh.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32process.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32profile.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32security.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\win32ts.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\windows._cacheinvalidation.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._controls_.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._core_.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._gdi_.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._html2.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._misc_.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._windows_.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wx._wizard.pyd
c:\users\R1\AppData\Local\Temp\_MEI39562\wxbase294u_net_vc90.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\wxbase294u_vc90.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\wxmsw294u_adv_vc90.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\wxmsw294u_core_vc90.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\wxmsw294u_html_vc90.dll
c:\users\R1\AppData\Local\Temp\_MEI39562\wxmsw294u_webview_vc90.dll
c:\users\R1\AppData\Local\Temp\Temp1_DefaultAudioChanger_1.0.3.zip\DefaultAudioChanger.exe
c:\windows\IsUn0407.exe
c:\windows\system32\drivers\etc\hosts.ics
c:\windows\system32\muzapp.exe
c:\windows\system32\System32\MASetupCleaner.exe
c:\windows\system32\System32\muzapp.exe
c:\windows\system32\tmp3090.tmp
c:\windows\system32\tmp30C0.tmp
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-05-17 bis 2013-06-17 ))))))))))))))))))))))))))))))
.
.
2013-06-17 17:55 . 2013-06-17 17:55 -------- d-----w- C:\FRST
2013-06-17 04:21 . 2013-06-17 04:21 -------- d-----w- c:\users\R1\AppData\Roaming\Malwarebytes
2013-06-17 04:21 . 2013-06-17 04:21 -------- d-----w- c:\programdata\Malwarebytes
2013-06-17 04:21 . 2013-06-17 04:21 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2013-06-17 04:21 . 2013-04-04 12:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-06-17 04:20 . 2013-06-17 04:20 -------- d-----w- c:\users\R1\AppData\Local\Programs
2013-06-17 03:07 . 2013-06-10 22:59 7016152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{FAD6D36D-EBEB-4D95-99B1-A2741CDC9037}\mpengine.dll
2013-06-16 19:11 . 2013-06-16 19:11 -------- d-----w- c:\users\R1\AppData\Roaming\Avira
2013-06-16 19:07 . 2013-06-16 19:07 66656 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-06-16 19:05 . 2013-06-16 19:05 -------- d-----w- c:\users\R1\AppData\Local\APN
2013-06-16 19:04 . 2013-03-06 14:13 37352 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-06-16 19:04 . 2013-02-27 11:22 84744 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-06-16 19:04 . 2013-02-27 11:22 135136 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-06-16 19:03 . 2013-06-16 19:03 -------- d-----w- c:\program files\Avira
2013-06-14 17:53 . 2013-06-16 18:37 -------- d-----w- c:\program files\Mozilla Thunderbird
2013-06-13 23:10 . 2013-06-08 11:13 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-06-13 23:10 . 2013-06-08 11:41 218112 ----a-w- c:\program files\Internet Explorer\sqmapi.dll
2013-06-13 16:22 . 2013-04-26 04:55 492544 ----a-w- c:\windows\system32\win32spl.dll
2013-06-13 16:22 . 2013-05-10 03:20 24576 ----a-w- c:\windows\system32\cryptdlg.dll
2013-06-13 16:22 . 2013-04-25 23:30 1505280 ----a-w- c:\windows\system32\d3d11.dll
2013-06-13 16:22 . 2013-05-13 03:08 903168 ----a-w- c:\windows\system32\certutil.exe
2013-06-13 16:22 . 2013-05-13 04:45 140288 ----a-w- c:\windows\system32\cryptsvc.dll
2013-06-13 16:22 . 2013-05-13 04:45 1160192 ----a-w- c:\windows\system32\crypt32.dll
2013-06-13 16:22 . 2013-05-13 04:45 103936 ----a-w- c:\windows\system32\cryptnet.dll
2013-06-13 16:22 . 2013-05-13 03:08 43008 ----a-w- c:\windows\system32\certenc.dll
2013-06-13 16:22 . 2013-04-17 07:02 1230336 ----a-w- c:\windows\system32\WindowsCodecs.dll
2013-06-13 16:22 . 2013-05-06 05:06 3968872 ----a-w- c:\windows\system32\ntkrnlpa.exe
2013-06-13 16:22 . 2013-05-06 05:06 3913576 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-06-13 16:22 . 2013-05-08 05:38 1293672 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-13 17:41 . 2012-04-01 08:22 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2013-06-13 17:41 . 2011-06-25 07:19 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-05-02 00:06 . 2010-08-05 13:53 238872 ------w- c:\windows\system32\MpSigStub.exe
2013-04-13 04:45 . 2013-05-16 07:19 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 07:19 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 13:45 . 2013-04-27 09:38 1211752 ----a-w- c:\windows\system32\drivers\ntfs.sys
2013-04-10 05:18 . 2013-05-16 07:19 728424 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2013-04-10 05:18 . 2013-05-16 07:19 218984 ----a-w- c:\windows\system32\drivers\dxgmms1.sys
2013-04-10 03:14 . 2013-05-16 07:19 2347520 ----a-w- c:\windows\system32\win32k.sys
2013-04-04 03:35 . 2013-04-27 10:41 94112 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-03-29 02:03 . 2013-03-29 02:03 745472 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-03-29 02:03 . 2013-03-29 02:03 185344 ----a-w- c:\windows\system32\elshyph.dll
2013-03-29 02:03 . 2013-03-29 02:03 158720 ----a-w- c:\windows\system32\msls31.dll
2013-03-29 02:03 . 2013-03-29 02:03 523264 ----a-w- c:\windows\system32\vbscript.dll
2013-03-29 02:03 . 2013-03-29 02:03 38400 ----a-w- c:\windows\system32\imgutil.dll
2013-03-29 02:03 . 2013-03-29 02:03 150528 ----a-w- c:\windows\system32\iexpress.exe
2013-03-29 02:03 . 2013-03-29 02:03 138752 ----a-w- c:\windows\system32\wextract.exe
2013-03-29 02:03 . 2013-03-29 02:03 137216 ----a-w- c:\windows\system32\ieUnatt.exe
2013-03-29 02:03 . 2013-03-29 02:03 12800 ----a-w- c:\windows\system32\mshta.exe
2013-03-29 02:03 . 2013-03-29 02:03 110592 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-03-29 02:03 . 2013-03-29 02:03 73728 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-03-29 02:03 . 2013-03-29 02:03 719360 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-03-29 02:03 . 2013-03-29 02:03 61952 ----a-w- c:\windows\system32\tdc.ocx
2013-03-29 02:03 . 2013-03-29 02:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-03-29 02:03 . 2013-03-29 02:03 361984 ----a-w- c:\windows\system32\html.iec
2013-03-29 02:03 . 2013-03-29 02:03 23040 ----a-w- c:\windows\system32\licmgr10.dll
2013-03-29 02:03 . 2013-03-29 02:03 1441280 ----a-w- c:\windows\system32\inetcpl.cpl
2013-03-29 02:02 . 2013-03-29 02:02 9728 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 906240 ----a-w- c:\windows\system32\FntCache.dll
2013-03-29 02:02 . 2013-03-29 02:02 604160 ----a-w- c:\windows\system32\d3d10level9.dll
2013-03-29 02:02 . 2013-03-29 02:02 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 5632 ---ha-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 417792 ----a-w- c:\windows\system32\WMPhoto.dll
2013-03-29 02:02 . 2013-03-29 02:02 4096 ---ha-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 364544 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-03-29 02:02 . 2013-03-29 02:02 3584 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 3419136 ----a-w- c:\windows\system32\d2d1.dll
2013-03-29 02:02 . 2013-03-29 02:02 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 3072 ---ha-w- c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 2560 ---ha-w- c:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 249856 ----a-w- c:\windows\system32\d3d10_1core.dll
2013-03-29 02:02 . 2013-03-29 02:02 2284544 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2013-03-29 02:02 . 2013-03-29 02:02 220160 ----a-w- c:\windows\system32\d3d10core.dll
2013-03-29 02:02 . 2013-03-29 02:02 207872 ----a-w- c:\windows\system32\WindowsCodecsExt.dll
2013-03-29 02:02 . 2013-03-29 02:02 1988096 ----a-w- c:\windows\system32\d3d10warp.dll
2013-03-29 02:02 . 2013-03-29 02:02 161792 ----a-w- c:\windows\system32\d3d10_1.dll
2013-03-29 02:02 . 2013-03-29 02:02 1247744 ----a-w- c:\windows\system32\DWrite.dll
2013-03-29 02:02 . 2013-03-29 02:02 1158144 ----a-w- c:\windows\system32\XpsPrint.dll
2013-03-29 02:02 . 2013-03-29 02:02 1080832 ----a-w- c:\windows\system32\d3d10.dll
2013-03-29 02:02 . 2013-03-29 02:02 10752 ---ha-w- c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-29 02:02 . 2013-03-29 02:02 293376 ----a-w- c:\windows\system32\dxgi.dll
2013-03-29 02:02 . 2013-03-29 02:02 187392 ----a-w- c:\windows\system32\UIAnimation.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2013-04-30 1521800]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-04-16 14:10 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-04-16 14:10 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-04-16 14:10 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-04-16 14:10 576976 ----a-w- c:\program files\Google\Drive\googledrivesync32.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PicPick Start"="c:\program files\PicPick\picpick.exe" [2011-12-16 10858496]
"GoogleDriveSync"="c:\program files\Google\Drive\googledrivesync.exe" [2013-04-16 19662744]
"RESTART_STICKY_NOTES"="c:\windows\system32\StikyNot.exe" [2009-07-14 354304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVMWlanClient"="c:\program files\avmwlanstick\wlangui.exe" [2009-05-07 1904640]
"HDAudDeck"="c:\program files\VIA\VIAudioi\VDeck\VDeck.exe" [2009-09-21 1681408]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"AVMBlueClient"="c:\program files\avmclient\bluefritz.exe" [2007-07-03 1859584]
"AVMBLUEOBEX"="c:\program files\avmclient\AvmObex.exe" [2007-07-03 491520]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"BrStsMon00"="c:\program files\Browny02\Brother\BrStMonW.exe" [2010-02-09 2621440]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2010-06-14 153672]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"ApnUpdater"="c:\program files\Ask.com\Updater\Updater.exe" [2013-04-30 1648264]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2013-04-04 345312]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKLM\~\startupfolder\C:^Users^R1^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk]
path=c:\users\R1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
backup=c:\windows\pss\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk.Startup
backupExtension=.Startup
.
R2 AODService;AODService;c:\program files\AMD\OverDrive\AODAssist.exe [2009-05-05 124256]
R3 avmeject;AVM Eject;c:\windows\system32\drivers\avmeject.sys [2009-05-07 4352]
R3 bfhubase;BlueFRITZ! USB 2.5;c:\windows\system32\DRIVERS\bfhubase.sys [2007-07-03 851712]
R3 BrYNSvc;BrYNSvc;c:\program files\Browny02\BrYNSvc.exe [2010-01-25 245760]
R3 dgderdrv;dgderdrv;c:\windows\system32\drivers\dgderdrv.sys [x]
R3 gpslc;gpslc;c:\windows\system32\Drivers\gpslc.sys [2009-03-16 56832]
R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2011-06-02 121064]
R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2011-06-02 12776]
R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2011-06-02 136808]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 52224]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-03-06 37352]
S2 AMDFusionSVC;AMD Fusion Utility Service;c:\program files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [2009-09-08 383544]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2013-02-25 86752]
S2 AVM BT Connection Service;AVM BT Connection Service;c:\program files\avmclient\avmbtservice.exe [2007-07-03 405504]
S2 AvmObexService;AVM BT OBEX Service;c:\program files\avmclient\AvmObexService.exe [2007-07-03 221184]
S2 MBAMScheduler;MBAMScheduler;c:\program files\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-01-18 383264]
S3 AVMBTPARALLEL;AVM Bluetooth Druckeranschluss;c:\windows\system32\DRIVERS\avmbtpar.sys [2007-07-03 61952]
S3 AVMBTSERIAL;AVM Bluetooth Kommunikationsanschluss;c:\windows\system32\DRIVERS\avmbtser.sys [2007-07-03 60928]
S3 AVMCOWAN;AVMCOWAN;c:\windows\system32\DRIVERS\AVMCOWAN.sys [2007-07-03 64512]
S3 BFHU_CFG;AVM BlueFRITZ!USB 2.0 HCI Config Switch Driver;c:\windows\system32\DRIVERS\bfhu_cfg.sys [2007-07-03 6656]
S3 CAPI_CIP;AVM Bluetooth CAPI-Controller;c:\windows\system32\DRIVERS\capi_cip.sys [2007-07-03 374144]
S3 FWLANUSB;AVM FRITZ!WLAN;c:\windows\system32\DRIVERS\fwlanusb.sys [2009-05-07 265088]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 22856]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2009-07-30 187392]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys [2009-09-17 1086976]
S3 VUSB3HUB;VIA USB 3 Root Hub Service;c:\windows\system32\DRIVERS\ViaHub3.sys [2012-12-12 174592]
S3 xhcdrv;VIA USB eXtensible Host Controller Service;c:\windows\system32\DRIVERS\xhcdrv.sys [2012-12-12 210432]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Inhalt des "geplante Tasks" Ordners
.
2013-06-17 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-01 17:41]
.
2013-06-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-06 20:53]
.
2013-06-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-12-06 20:53]
.
2013-06-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000Core.job
- c:\users\R1\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25 09:37]
.
2013-06-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000UA.job
- c:\users\R1\AppData\Local\Google\Update\GoogleUpdate.exe [2011-09-25 09:37]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKCU-Run-RocketDock - c:\program files\RocketDock\RocketDock.exe
HKCU-Run-Rainlendar2 - c:\program files\Rainlendar2\Rainlendar2.exe
HKCU-Run-ASRockOCTuner - (no file)
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
AddRemove-26_VIA_driver2 - c:\program files\Samsung\USB Drivers\26_VIA_driver2\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\NVIDIA Corporation\Display\nvxdsync.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\brsvc01a.exe
c:\windows\system32\brss01a.exe
c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\avmwlanstick\WlanNetService.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\windows\system32\PnkBstrA.exe
c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe
c:\windows\system32\taskhost.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\NVIDIA Corporation\Display\nvtray.exe
c:\windows\System32\WUDFHost.exe
c:\windows\system32\conhost.exe
c:\windows\system32\sppsvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-06-17 20:33:27 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-06-17 18:33
.
Vor Suchlauf: 14 Verzeichnis(se), 66.962.522.112 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 70.044.209.152 Bytes frei
.
- - End Of File - - 7B2A5A480270E2FC6380578B6633659C
A36C5E4F47E84449FF07ED3517B43A31
|
|
17.06.2013, 19:55
| #6 |
| /// the machine /// TB-Ausbilder | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN Hi, Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
frisches FRST Log bitte 
__________________ --> Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN |
|
17.06.2013, 20:10
| #7 |
| | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN ADW Cleaner Code:
ATTFilter # AdwCleaner v2.303 - Datei am 17/06/2013 um 20:59:36 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (32 bits)
# Benutzer : R1 - FAHRENHEIT0812
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\R1\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\Program Files\Ask.com
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\ProgramData\InstallMate
Ordner Gelöscht : C:\ProgramData\Trymedia
Ordner Gelöscht : C:\Users\R1\AppData\Local\APN
Ordner Gelöscht : C:\Users\R1\AppData\Local\PackageAware
Ordner Gelöscht : C:\Users\R1\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\UpdatusUser\AppData\Local\AskToolbar
Ordner Gelöscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F994E0D9-8335-48F1-99C2-A712C21F8D5F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apntoolbarinstaller_RASMANCS
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0CFE535C35F99574E8340BFA75BF92C2
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0E12F736682067FDE4D1158D5940A82E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\120DFADEB50841F408F04D2A278F9509
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1A24B5BB8521B03E0C8D908F5ABC0AE6
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\261F213D1F55267499B1F87D0CC3BCF7
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2B0D56C4F4C46D844A57FFED6F0D2852
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2BDF3E992C0908741B7C11F4B4E0F775
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\49D4375FE41653242AEA4C969E4E65E0
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6AA0923513360135B272E8289C5F13FA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6B3BC4CF5ECE1F54BBA174C13A1AB907
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\6F7467AF8F29C134CBBAB394ECCFDE96
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\741B4ADF27276464790022C965AB6DA8
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\7DE196B10195F5647A2B21B761F3DE01
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\922525DCC5199162F8935747CA3D8E59
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D0E499F53381f84992C7A212CF1D8F5
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\9D4F5849367142E4685ED8C25E44C5ED
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A5875B04372C19545BEB90D4D606C472
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A876D9E80B896EC44A8620248CC79296
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B5BAE2ED018083A4C8DA86D6E3F4B024
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\B66FFAB725B92594C986DE826A867888
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BCDA179D619B91648538E3394CAC94CC
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BEABAA33A5E68374DBF197F2A00CD011
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB61AF52AD64B6B45930BE969F316720
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D677B1A9671D4D4004F6F2A4469E86EA
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DD1402A9DD4215A43ABDE169A41AFA0E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\E36E114A0EAD2AD46B381D23AD69CDDF
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\EF8E618DB3AEDFBB384561B5C548F65E
Schlüssel Gelöscht : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{DFEFCDEE-CF1A-4FC8-88AD-129872198372}]
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{DFEFCDEE-CF1A-4FC8-88AD-129872198372}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16611
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://search.avira.com/?l=dis&o=APN10261&gct=hp&dc=EU&locale=de_DE --> hxxp://www.google.com
-\\ Google Chrome v27.0.1453.110
Datei : C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[R1].txt - [7783 octets] - [17/06/2013 20:56:54]
AdwCleaner[R2].txt - [7843 octets] - [17/06/2013 20:58:04]
AdwCleaner[S1].txt - [7683 octets] - [17/06/2013 20:59:36]
########## EOF - C:\AdwCleaner[S1].txt - [7743 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x86
Ran by R1 on 17.06.2013 at 21:04:32,76
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\installer\upgradecodes\f928123a039649549966d4c29d35b1c9
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4C028E97-244A-4090-9B5C-35BC25F65048}
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 17.06.2013 at 21:05:34,33
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-06-2013 01
Ran by R1 (administrator) on 17-06-2013 21:06:03
Running from C:\Users\R1\Desktop
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Advanced Micro Devices) C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(brother Industries Ltd) C:\Windows\system32\brsvc01a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(brother Industries Ltd) C:\Windows\system32\brss01a.exe
(AVM Berlin) C:\Program Files\avmclient\avmbtservice.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WlanNetService.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObexService.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(AVM Berlin) C:\Program Files\avmclient\bluefritz.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
() C:\Windows\system32\PnkBstrA.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(NTeWORKS) C:\Program Files\PicPick\picpick.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Microsoft Corporation) \\?\C:\Windows\system32\wbem\WMIADAP.EXE
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [1904640 2009-05-07] (AVM Berlin)
HKLM\...\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r [1681408 2009-09-21] (VIA)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1311312 2010-06-26] (Logitech, Inc.)
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [AVMBlueClient] C:\Program Files\avmclient\bluefritz.exe [1859584 2007-07-03] (AVM Berlin)
HKLM\...\Run: [AVMBLUEOBEX] C:\Program Files\avmclient\AvmObex.exe -pushclient -ftpclient [491520 2007-07-03] (AVM Berlin)
HKLM\...\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-29] ()
HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM\...\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui [153672 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-04-04] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Run: [PicPick Start] C:\Program Files\PicPick\picpick.exe [10858496 2011-12-16] (NTeWORKS)
HKCU\...\Run: [GoogleDriveSync] "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart [19662744 2013-04-16] (Google)
HKCU\...\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Google Update) - C:\Users\R1\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Drive) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (AdBlock) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.64_0
CHR Extension: (Wolfram|Alpha (Official)) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\icncamkooinmbehmkeilcccmoljfkdhp\1.2.2_0
CHR Extension: (Gmail) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
========================== Services (Whitelisted) =================
R2 AMDFusionSVC; C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [383544 2009-09-08] (Advanced Micro Devices)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86752 2013-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110816 2013-02-25] (Avira Operations GmbH & Co. KG)
S2 AODService; C:\Program Files\AMD\OverDrive\AODAssist.exe [124256 2009-05-05] ()
R2 AVM BT Connection Service; C:\Program Files\avmclient\avmbtservice.exe [405504 2007-07-03] (AVM Berlin)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [368640 2009-05-07] (AVM Berlin)
R2 AvmObexService; C:\Program Files\avmclient\AvmObexService.exe [221184 2007-07-03] (AVM Berlin)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2010-08-29] ()
==================== Drivers (Whitelisted) ====================
R3 AmdLLD; C:\Windows\System32\DRIVERS\AmdLLD.sys [42552 2009-04-22] (Advanced Micro Devices)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-11-19] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-06] (Avira Operations GmbH & Co. KG)
R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH)
R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2009-05-07] (AVM Berlin)
S3 bfhubase; C:\Windows\System32\DRIVERS\bfhubase.sys [851712 2007-07-03] (AVM Berlin)
R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin)
R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2009-05-07] (AVM GmbH)
S3 gpslc; C:\Windows\System32\Drivers\gpslc.sys [56832 2009-03-16] (Mobile Action Technology Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-11-19] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37328 2010-03-18] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 Pnp680r; C:\Windows\System32\DRIVERS\pnp680r.sys [110120 2007-07-20] (Silicon Image, Inc)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1086976 2009-09-17] (VIA Technologies, Inc.)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [174592 2012-12-12] (VIA Technologies, Inc.)
R3 WmBEnum; C:\Windows\System32\drivers\WmBEnum.sys [22856 2010-04-27] (Logitech Inc.)
R3 WmFilter; C:\Windows\System32\drivers\WmFilter.sys [37704 2010-04-27] (Logitech Inc.)
R3 WmHidLo; C:\Windows\System32\drivers\WmHidLo.sys [31816 2010-04-27] (Logitech Inc.)
S3 WmUsbHid; C:\Windows\System32\drivers\WmUsbHid.sys [23040 2003-05-14] (Logitech Inc.)
R3 WmVirHid; C:\Windows\System32\drivers\WmVirHid.sys [15048 2010-04-27] (Logitech Inc.)
R3 WmXlCore; C:\Windows\System32\drivers\WmXlCore.sys [66632 2010-04-27] (Logitech Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [210432 2012-12-12] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\R1\AppData\Local\Temp\catchme.sys [x]
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-17 21:05 - 2013-06-17 21:05 - 00000899 ____A C:\Users\R1\Desktop\JRT.txt
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\JRT
2013-06-17 20:59 - 2013-06-17 21:00 - 00007812 ____A C:\AdwCleaner[S1].txt
2013-06-17 20:59 - 2013-06-17 20:59 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\R1\Desktop\JRT.exe
2013-06-17 20:58 - 2013-06-17 20:58 - 00007843 ____A C:\AdwCleaner[R2].txt
2013-06-17 20:56 - 2013-06-17 20:57 - 00007783 ____A C:\AdwCleaner[R1].txt
2013-06-17 20:56 - 2013-06-17 20:56 - 00648201 ____A C:\Users\R1\Desktop\adwcleaner.exe
2013-06-17 20:33 - 2013-06-17 20:33 - 00023166 ____A C:\ComboFix.txt
2013-06-17 20:18 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-17 20:18 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-17 20:18 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-17 20:17 - 2013-06-17 20:33 - 00000000 ____D C:\Qoobox
2013-06-17 20:17 - 2013-06-17 20:32 - 00000000 ____D C:\Windows\erdnt
2013-06-17 20:15 - 2013-06-17 20:16 - 05079999 ____R (Swearware) C:\Users\R1\Desktop\ComboFix.exe
2013-06-17 20:01 - 2013-06-17 20:01 - 00016497 ____A C:\Users\R1\Desktop\Addition.txt
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:53 - 2013-06-17 19:54 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:42 - 2013-06-17 20:17 - 806559208 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-17 06:21 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:34 - 2013-06-16 22:36 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:32 - 2013-06-16 22:33 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:31 - 2013-06-16 22:32 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:33 - 2013-06-16 21:34 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:04 - 2013-03-06 16:13 - 00037352 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00135136 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00084744 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-06-16 21:04 - 2012-08-27 15:50 - 00028520 ____A (Avira GmbH) C:\Windows\System32\Drivers\ssmdrv.sys
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 20:56 - 2013-06-16 21:00 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-14 19:53 - 2013-06-16 20:37 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-14 01:10 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 01:10 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 01:08 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 01:08 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 01:08 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 18:22 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 18:22 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 18:22 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 18:22 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 18:22 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 18:22 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-13 18:22 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-13 18:22 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 18:22 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-13 18:22 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
==================== One Month Modified Files and Folders ========
2013-06-17 21:05 - 2013-06-17 21:05 - 00000899 ____A C:\Users\R1\Desktop\JRT.txt
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\JRT
2013-06-17 21:02 - 2012-12-06 22:55 - 00000000 ___SD C:\Users\R1\Google Drive
2013-06-17 21:01 - 2013-01-13 19:06 - 00031528 ____A C:\Windows\setupact.log
2013-06-17 21:01 - 2012-12-06 22:53 - 00001086 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-17 21:01 - 2010-08-03 22:36 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-17 21:01 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-17 21:00 - 2013-06-17 20:59 - 00007812 ____A C:\AdwCleaner[S1].txt
2013-06-17 21:00 - 2010-08-02 18:20 - 01560096 ____A C:\Windows\WindowsUpdate.log
2013-06-17 20:59 - 2013-06-17 20:59 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\R1\Desktop\JRT.exe
2013-06-17 20:58 - 2013-06-17 20:58 - 00007843 ____A C:\AdwCleaner[R2].txt
2013-06-17 20:57 - 2013-06-17 20:56 - 00007783 ____A C:\AdwCleaner[R1].txt
2013-06-17 20:56 - 2013-06-17 20:56 - 00648201 ____A C:\Users\R1\Desktop\adwcleaner.exe
2013-06-17 20:40 - 2012-04-01 10:22 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-17 20:36 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-17 20:36 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-17 20:33 - 2013-06-17 20:33 - 00023166 ____A C:\ComboFix.txt
2013-06-17 20:33 - 2013-06-17 20:17 - 00000000 ____D C:\Qoobox
2013-06-17 20:33 - 2010-08-02 18:34 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 20:33 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-06-17 20:33 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-06-17 20:32 - 2013-06-17 20:17 - 00000000 ____D C:\Windows\erdnt
2013-06-17 20:30 - 2011-09-25 11:37 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000UA.job
2013-06-17 20:29 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-06-17 20:28 - 2013-01-13 20:31 - 00100334 ____A C:\Windows\PFRO.log
2013-06-17 20:17 - 2013-06-17 19:42 - 806559208 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 20:16 - 2013-06-17 20:15 - 05079999 ____R (Swearware) C:\Users\R1\Desktop\ComboFix.exe
2013-06-17 20:08 - 2012-12-06 22:53 - 00001090 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-17 20:01 - 2013-06-17 20:01 - 00016497 ____A C:\Users\R1\Desktop\Addition.txt
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:54 - 2013-06-17 19:53 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:17 - 2010-08-09 13:20 - 00000000 ____D C:\Windows\Minidump
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:43 - 2010-08-02 12:44 - 00000000 ____D C:\users\R1
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-16 23:30 - 2011-09-25 11:37 - 00001056 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000Core.job
2013-06-16 23:01 - 2012-04-25 10:14 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:36 - 2013-06-16 22:34 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:33 - 2013-06-16 22:32 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:32 - 2013-06-16 22:31 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:34 - 2013-06-16 21:33 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:06 - 2013-02-17 00:49 - 00001912 ____A C:\Windows\epplauncher.mif
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 21:03 - 2012-05-26 06:56 - 00000000 ____D C:\ProgramData\Avira
2013-06-16 21:00 - 2013-06-16 20:56 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-16 20:49 - 2013-05-12 23:34 - 00000032 ____A C:\Windows\Menu.INI
2013-06-16 20:37 - 2013-06-14 19:53 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-16 10:20 - 2012-04-29 14:15 - 00000000 ____D C:\Users\R1\AppData\Roaming\TS3Client
2013-06-14 20:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 19:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 01:11 - 2010-08-05 15:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-14 01:09 - 2010-10-08 22:04 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 19:41 - 2012-04-01 10:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 19:41 - 2011-06-25 09:19 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 21:50 - 2012-12-12 21:11 - 00000981 ____A C:\Users\R1\Desktop\rFactor - Bockbierbude.lnk
2013-06-08 13:42 - 2013-06-14 01:10 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 01:10 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
2013-06-01 18:36 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Steam
2013-06-01 18:31 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-05-26 10:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-13 19:09
==================== End Of Log ============================
--- --- --- |
|
17.06.2013, 20:17
| #8 |
| /// the machine /// TB-Ausbilder | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN Besser ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log. noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
17.06.2013, 22:40
| #9 |
| | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN ESET : Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=4ff4e95c9130b641856d627d61b79f51
# engine=14097
# end=finished
# remove_checked=false
# archives_checked=false
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-06-17 09:25:00
# local_time=2013-06-17 11:25:00 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 97 8281 236927590 1064 0
# compatibility_mode=5893 16776573 100 94 7972 123135491 0 0
# scanned=380066
# found=3
# cleaned=0
# scan_time=7276
sh=44E74B2EDE738175612E836E182F06E523670086 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\Ablage\WordPress Themes\ansiy\footer.php"
sh=7CCDAD199F53FEF56395B92103275986A6BD7944 ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\Ablage\WordPress Themes\mimbo2.2\footer.php"
sh=7E456D787F1A2B77159C84D74AE9C277E04242DB ft=0 fh=0000000000000000 vn="PHP/Kryptik.AB trojan" ac=I fn="D:\Ablage\WordPress Themes\PRiNZ_BranfordMagazine_latest\footer.php"
FRST : FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-06-2013 01
Ran by R1 (administrator) on 17-06-2013 23:36:14
Running from C:\Users\R1\Desktop
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Advanced Micro Devices) C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(brother Industries Ltd) C:\Windows\system32\brsvc01a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(brother Industries Ltd) C:\Windows\system32\brss01a.exe
(AVM Berlin) C:\Program Files\avmclient\avmbtservice.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WlanNetService.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObexService.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(AVM Berlin) C:\Program Files\avmclient\bluefritz.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
() C:\Windows\system32\PnkBstrA.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(NTeWORKS) C:\Program Files\PicPick\picpick.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [1904640 2009-05-07] (AVM Berlin)
HKLM\...\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r [1681408 2009-09-21] (VIA)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1311312 2010-06-26] (Logitech, Inc.)
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [AVMBlueClient] C:\Program Files\avmclient\bluefritz.exe [1859584 2007-07-03] (AVM Berlin)
HKLM\...\Run: [AVMBLUEOBEX] C:\Program Files\avmclient\AvmObex.exe -pushclient -ftpclient [491520 2007-07-03] (AVM Berlin)
HKLM\...\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-29] ()
HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM\...\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui [153672 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-04-04] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Run: [PicPick Start] C:\Program Files\PicPick\picpick.exe [10858496 2011-12-16] (NTeWORKS)
HKCU\...\Run: [GoogleDriveSync] "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart [19662744 2013-04-16] (Google)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Google Update) - C:\Users\R1\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Drive) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (AdBlock) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.64_0
CHR Extension: (Wolfram|Alpha (Official)) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\icncamkooinmbehmkeilcccmoljfkdhp\1.2.2_0
CHR Extension: (Gmail) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
========================== Services (Whitelisted) =================
R2 AMDFusionSVC; C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [383544 2009-09-08] (Advanced Micro Devices)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86752 2013-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110816 2013-02-25] (Avira Operations GmbH & Co. KG)
S2 AODService; C:\Program Files\AMD\OverDrive\AODAssist.exe [124256 2009-05-05] ()
R2 AVM BT Connection Service; C:\Program Files\avmclient\avmbtservice.exe [405504 2007-07-03] (AVM Berlin)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [368640 2009-05-07] (AVM Berlin)
R2 AvmObexService; C:\Program Files\avmclient\AvmObexService.exe [221184 2007-07-03] (AVM Berlin)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.)
S2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2010-08-29] ()
==================== Drivers (Whitelisted) ====================
R3 AmdLLD; C:\Windows\System32\DRIVERS\AmdLLD.sys [42552 2009-04-22] (Advanced Micro Devices)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-11-19] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-06] (Avira Operations GmbH & Co. KG)
R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH)
R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2009-05-07] (AVM Berlin)
S3 bfhubase; C:\Windows\System32\DRIVERS\bfhubase.sys [851712 2007-07-03] (AVM Berlin)
R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin)
R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2009-05-07] (AVM GmbH)
S3 gpslc; C:\Windows\System32\Drivers\gpslc.sys [56832 2009-03-16] (Mobile Action Technology Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-11-19] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37328 2010-03-18] (Logitech, Inc.)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 Pnp680r; C:\Windows\System32\DRIVERS\pnp680r.sys [110120 2007-07-20] (Silicon Image, Inc)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1086976 2009-09-17] (VIA Technologies, Inc.)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [174592 2012-12-12] (VIA Technologies, Inc.)
R3 WmBEnum; C:\Windows\System32\drivers\WmBEnum.sys [22856 2010-04-27] (Logitech Inc.)
R3 WmFilter; C:\Windows\System32\drivers\WmFilter.sys [37704 2010-04-27] (Logitech Inc.)
R3 WmHidLo; C:\Windows\System32\drivers\WmHidLo.sys [31816 2010-04-27] (Logitech Inc.)
S3 WmUsbHid; C:\Windows\System32\drivers\WmUsbHid.sys [23040 2003-05-14] (Logitech Inc.)
R3 WmVirHid; C:\Windows\System32\drivers\WmVirHid.sys [15048 2010-04-27] (Logitech Inc.)
R3 WmXlCore; C:\Windows\System32\drivers\WmXlCore.sys [66632 2010-04-27] (Logitech Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [210432 2012-12-12] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\R1\AppData\Local\Temp\catchme.sys [x]
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-17 23:33 - 2013-06-17 23:33 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck (1).exe
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Downloads\SecurityCheck.exe
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck.exe
2013-06-17 21:18 - 2013-06-17 21:18 - 02347384 ____A (ESET) C:\Users\R1\Desktop\esetsmartinstaller_enu.exe
2013-06-17 21:05 - 2013-06-17 21:05 - 00000899 ____A C:\Users\R1\Desktop\JRT.txt
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\JRT
2013-06-17 20:59 - 2013-06-17 21:00 - 00007812 ____A C:\AdwCleaner[S1].txt
2013-06-17 20:59 - 2013-06-17 20:59 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\R1\Desktop\JRT.exe
2013-06-17 20:58 - 2013-06-17 20:58 - 00007843 ____A C:\AdwCleaner[R2].txt
2013-06-17 20:56 - 2013-06-17 20:57 - 00007783 ____A C:\AdwCleaner[R1].txt
2013-06-17 20:56 - 2013-06-17 20:56 - 00648201 ____A C:\Users\R1\Desktop\adwcleaner.exe
2013-06-17 20:33 - 2013-06-17 20:33 - 00023166 ____A C:\ComboFix.txt
2013-06-17 20:18 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-17 20:18 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-17 20:18 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-17 20:17 - 2013-06-17 20:33 - 00000000 ____D C:\Qoobox
2013-06-17 20:17 - 2013-06-17 20:32 - 00000000 ____D C:\Windows\erdnt
2013-06-17 20:15 - 2013-06-17 20:16 - 05079999 ____R (Swearware) C:\Users\R1\Desktop\ComboFix.exe
2013-06-17 20:01 - 2013-06-17 20:01 - 00016497 ____A C:\Users\R1\Desktop\Addition.txt
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:53 - 2013-06-17 19:54 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:42 - 2013-06-17 20:17 - 806559208 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-17 06:21 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:34 - 2013-06-16 22:36 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:32 - 2013-06-16 22:33 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:31 - 2013-06-16 22:32 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:33 - 2013-06-16 21:34 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:04 - 2013-03-06 16:13 - 00037352 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00135136 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00084744 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-06-16 21:04 - 2012-08-27 15:50 - 00028520 ____A (Avira GmbH) C:\Windows\System32\Drivers\ssmdrv.sys
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 20:56 - 2013-06-16 21:00 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-14 19:53 - 2013-06-16 20:37 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-14 01:10 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 01:10 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 01:08 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 01:08 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 01:08 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 18:22 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 18:22 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 18:22 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 18:22 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 18:22 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 18:22 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-13 18:22 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-13 18:22 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 18:22 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-13 18:22 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
==================== One Month Modified Files and Folders ========
2013-06-17 23:33 - 2013-06-17 23:33 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck (1).exe
2013-06-17 23:30 - 2011-09-25 11:37 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000UA.job
2013-06-17 23:30 - 2011-09-25 11:37 - 00001056 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000Core.job
2013-06-17 23:19 - 2013-01-13 19:06 - 00032088 ____A C:\Windows\setupact.log
2013-06-17 23:08 - 2012-12-06 22:53 - 00001090 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-17 22:40 - 2012-04-01 10:22 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Downloads\SecurityCheck.exe
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck.exe
2013-06-17 21:18 - 2013-06-17 21:18 - 02347384 ____A (ESET) C:\Users\R1\Desktop\esetsmartinstaller_enu.exe
2013-06-17 21:09 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-17 21:09 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-17 21:07 - 2010-08-02 18:34 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 21:05 - 2013-06-17 21:05 - 00000899 ____A C:\Users\R1\Desktop\JRT.txt
2013-06-17 21:05 - 2010-08-02 18:20 - 01563152 ____A C:\Windows\WindowsUpdate.log
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\JRT
2013-06-17 21:02 - 2012-12-06 22:55 - 00000000 ___SD C:\Users\R1\Google Drive
2013-06-17 21:01 - 2012-12-06 22:53 - 00001086 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-17 21:01 - 2010-08-03 22:36 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-17 21:01 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-17 21:00 - 2013-06-17 20:59 - 00007812 ____A C:\AdwCleaner[S1].txt
2013-06-17 20:59 - 2013-06-17 20:59 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\R1\Desktop\JRT.exe
2013-06-17 20:58 - 2013-06-17 20:58 - 00007843 ____A C:\AdwCleaner[R2].txt
2013-06-17 20:57 - 2013-06-17 20:56 - 00007783 ____A C:\AdwCleaner[R1].txt
2013-06-17 20:56 - 2013-06-17 20:56 - 00648201 ____A C:\Users\R1\Desktop\adwcleaner.exe
2013-06-17 20:33 - 2013-06-17 20:33 - 00023166 ____A C:\ComboFix.txt
2013-06-17 20:33 - 2013-06-17 20:17 - 00000000 ____D C:\Qoobox
2013-06-17 20:33 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-06-17 20:33 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-06-17 20:32 - 2013-06-17 20:17 - 00000000 ____D C:\Windows\erdnt
2013-06-17 20:29 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-06-17 20:28 - 2013-01-13 20:31 - 00100334 ____A C:\Windows\PFRO.log
2013-06-17 20:17 - 2013-06-17 19:42 - 806559208 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 20:16 - 2013-06-17 20:15 - 05079999 ____R (Swearware) C:\Users\R1\Desktop\ComboFix.exe
2013-06-17 20:01 - 2013-06-17 20:01 - 00016497 ____A C:\Users\R1\Desktop\Addition.txt
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:54 - 2013-06-17 19:53 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:17 - 2010-08-09 13:20 - 00000000 ____D C:\Windows\Minidump
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:43 - 2010-08-02 12:44 - 00000000 ____D C:\users\R1
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-16 23:01 - 2012-04-25 10:14 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:36 - 2013-06-16 22:34 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:33 - 2013-06-16 22:32 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:32 - 2013-06-16 22:31 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:34 - 2013-06-16 21:33 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:06 - 2013-02-17 00:49 - 00001912 ____A C:\Windows\epplauncher.mif
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 21:03 - 2012-05-26 06:56 - 00000000 ____D C:\ProgramData\Avira
2013-06-16 21:00 - 2013-06-16 20:56 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-16 20:49 - 2013-05-12 23:34 - 00000032 ____A C:\Windows\Menu.INI
2013-06-16 20:37 - 2013-06-14 19:53 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-16 10:20 - 2012-04-29 14:15 - 00000000 ____D C:\Users\R1\AppData\Roaming\TS3Client
2013-06-14 20:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 19:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 01:11 - 2010-08-05 15:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-14 01:09 - 2010-10-08 22:04 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 19:41 - 2012-04-01 10:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 19:41 - 2011-06-25 09:19 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 21:50 - 2012-12-12 21:11 - 00000981 ____A C:\Users\R1\Desktop\rFactor - Bockbierbude.lnk
2013-06-08 13:42 - 2013-06-14 01:10 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 01:10 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
2013-06-01 18:36 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Steam
2013-06-01 18:31 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-05-26 10:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-13 19:09
==================== End Of Log ============================
--- --- --- --- --- --- UPDATE : Nach einem Neustart läuft SecurityCheck : Code:
ATTFilter Results of screen317's Security Check version 0.99.64 Windows 7 Service Pack 1 x86 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 CCleaner Java 7 Update 21 Adobe Flash Player 11.7.700.224 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Thunderbird (17.0.6) Google Chrome 27.0.1453.110 Google Chrome 27.0.1453.94 Google Chrome SoftTH.log.. ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 16-06-2013 01
Ran by R1 (administrator) on 18-06-2013 00:04:38
Running from C:\Users\R1\Desktop
Windows 7 Home Premium Service Pack 1 (X86) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(Advanced Micro Devices) C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\AUDIODG.EXE
(brother Industries Ltd) C:\Windows\system32\brsvc01a.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(AVM Berlin) C:\Program Files\avmclient\avmbtservice.exe
(brother Industries Ltd) C:\Windows\system32\brss01a.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WlanNetService.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObexService.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
() C:\Program Files\CDBurnerXP\NMSAccessU.exe
() C:\Windows\system32\PnkBstrA.exe
(Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
(AVM Berlin) C:\Program Files\avmwlanstick\WLanGUI.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(VIA) C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(AVM Berlin) C:\Program Files\avmclient\bluefritz.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Microsoft Corporation) C:\Windows\WindowsMobile\wmdc.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\Brother\BrStMonW.exe
(Logitech Inc.) C:\Program Files\Logitech\Gaming Software\LWEMon.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(NTeWORKS) C:\Program Files\PicPick\picpick.exe
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(AVM Berlin) C:\Program Files\avmclient\AvmObex.exe
(Brother Industries, Ltd.) C:\Program Files\Brother\ControlCenter3\brccMCtl.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Google) C:\Program Files\Google\Drive\googledrivesync.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Brother Industries, Ltd.) C:\Program Files\Browny02\BrYNSvc.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
(Mozilla Corporation) C:\Program Files\Mozilla Thunderbird\thunderbird.exe
(Google Inc.) C:\Users\R1\AppData\Local\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\wlangui.exe [1904640 2009-05-07] (AVM Berlin)
HKLM\...\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe -r [1681408 2009-09-21] (VIA)
HKLM\...\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming [1311312 2010-06-26] (Logitech, Inc.)
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [AVMBlueClient] C:\Program Files\avmclient\bluefritz.exe [1859584 2007-07-03] (AVM Berlin)
HKLM\...\Run: [AVMBLUEOBEX] C:\Program Files\avmclient\AvmObex.exe -pushclient -ftpclient [491520 2007-07-03] (AVM Berlin)
HKLM\...\Run: [DivXUpdate] "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW [1259376 2011-07-29] ()
HKLM\...\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe [648072 2007-05-31] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe /autorun [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-02-09] (Brother Industries, Ltd.)
HKLM\...\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui [153672 2010-06-14] (Logitech Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation)
HKLM\...\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min [345312 2013-04-04] (Avira Operations GmbH & Co. KG)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll [X]
HKCU\...\Run: [PicPick Start] C:\Program Files\PicPick\picpick.exe [10858496 2011-12-16] (NTeWORKS)
HKCU\...\Run: [GoogleDriveSync] "C:\Program Files\Google\Drive\googledrivesync.exe" /autostart [19662744 2013-04-16] (Google)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR RestoreOnStartup: "hxxp://www.google.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll No File
CHR Plugin: (Microsoft\u00AE Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (2007 Microsoft Office system) - C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\R1\AppData\Local\Google\Chrome\Application\27.0.1453.110\pdf.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll No File
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Google Update) - C:\Users\R1\AppData\Local\Google\Update\1.3.21.69\npGoogleUpdate3.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (Google Drive) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (AdBlock) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.64_0
CHR Extension: (Wolfram|Alpha (Official)) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\icncamkooinmbehmkeilcccmoljfkdhp\1.2.2_0
CHR Extension: (Gmail) - C:\Users\R1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
========================== Services (Whitelisted) =================
R2 AMDFusionSVC; C:\Program Files\AMD\AMD Fusion Utility for Desktops\FusionSVC.exe [383544 2009-09-08] (Advanced Micro Devices)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [86752 2013-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [110816 2013-02-25] (Avira Operations GmbH & Co. KG)
S2 AODService; C:\Program Files\AMD\OverDrive\AODAssist.exe [124256 2009-05-05] ()
R2 AVM BT Connection Service; C:\Program Files\avmclient\avmbtservice.exe [405504 2007-07-03] (AVM Berlin)
R2 AVM WLAN Connection Service; C:\Program Files\avmwlanstick\WlanNetService.exe [368640 2009-05-07] (AVM Berlin)
R2 AvmObexService; C:\Program Files\avmclient\AvmObexService.exe [221184 2007-07-03] (AVM Berlin)
R2 Brother XP spl Service; C:\Windows\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R3 BrYNSvc; C:\Program Files\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.)
R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NMSAccess; C:\Program Files\CDBurnerXP\NMSAccessU.exe [71096 2010-03-04] ()
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [66872 2010-08-29] ()
==================== Drivers (Whitelisted) ====================
R3 AmdLLD; C:\Windows\System32\DRIVERS\AmdLLD.sys [42552 2009-04-22] (Advanced Micro Devices)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2011-11-19] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-02-27] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-06] (Avira Operations GmbH & Co. KG)
R3 AVMBTPARALLEL; C:\Windows\System32\DRIVERS\avmbtpar.sys [61952 2007-07-03] (AVM GmbH)
R3 AVMBTSERIAL; C:\Windows\System32\DRIVERS\avmbtser.sys [60928 2007-07-03] (AVM GmbH)
R3 AVMCOWAN; C:\Windows\System32\DRIVERS\AVMCOWAN.sys [64512 2007-07-03] (AVM GmbH)
S3 avmeject; C:\Windows\System32\drivers\avmeject.sys [4352 2009-05-07] (AVM Berlin)
S3 bfhubase; C:\Windows\System32\DRIVERS\bfhubase.sys [851712 2007-07-03] (AVM Berlin)
R3 BFHU_CFG; C:\Windows\System32\DRIVERS\bfhu_cfg.sys [6656 2007-07-03] (AVM Berlin)
R3 CAPI_CIP; C:\Windows\System32\DRIVERS\capi_cip.sys [374144 2007-07-03] (AVM Berlin)
R3 FWLANUSB; C:\Windows\System32\DRIVERS\fwlanusb.sys [265088 2009-05-07] (AVM GmbH)
S3 gpslc; C:\Windows\System32\Drivers\gpslc.sys [56832 2009-03-16] (Mobile Action Technology Inc.)
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2011-11-19] ()
R3 LMouFilt; C:\Windows\System32\DRIVERS\LMouFilt.Sys [37328 2010-03-18] (Logitech, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation)
R0 Pnp680r; C:\Windows\System32\DRIVERS\pnp680r.sys [110120 2007-07-20] (Silicon Image, Inc)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH)
S3 StarOpen; C:\Windows\System32\Drivers\StarOpen.sys [7168 2009-11-12] ()
R3 VIAHdAudAddService; C:\Windows\System32\drivers\viahduaa.sys [1086976 2009-09-17] (VIA Technologies, Inc.)
R3 VUSB3HUB; C:\Windows\System32\DRIVERS\ViaHub3.sys [174592 2012-12-12] (VIA Technologies, Inc.)
R3 WmBEnum; C:\Windows\System32\drivers\WmBEnum.sys [22856 2010-04-27] (Logitech Inc.)
R3 WmFilter; C:\Windows\System32\drivers\WmFilter.sys [37704 2010-04-27] (Logitech Inc.)
R3 WmHidLo; C:\Windows\System32\drivers\WmHidLo.sys [31816 2010-04-27] (Logitech Inc.)
S3 WmUsbHid; C:\Windows\System32\drivers\WmUsbHid.sys [23040 2003-05-14] (Logitech Inc.)
R3 WmVirHid; C:\Windows\System32\drivers\WmVirHid.sys [15048 2010-04-27] (Logitech Inc.)
R3 WmXlCore; C:\Windows\System32\drivers\WmXlCore.sys [66632 2010-04-27] (Logitech Inc.)
R3 xhcdrv; C:\Windows\System32\DRIVERS\xhcdrv.sys [210432 2012-12-12] (VIA Technologies, Inc.)
S3 catchme; \??\C:\Users\R1\AppData\Local\Temp\catchme.sys [x]
S3 dgderdrv; System32\drivers\dgderdrv.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-06-17 23:33 - 2013-06-17 23:33 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck (1).exe
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Downloads\SecurityCheck.exe
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck.exe
2013-06-17 21:18 - 2013-06-17 21:18 - 02347384 ____A (ESET) C:\Users\R1\Desktop\esetsmartinstaller_enu.exe
2013-06-17 21:05 - 2013-06-17 21:05 - 00000899 ____A C:\Users\R1\Desktop\JRT.txt
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\JRT
2013-06-17 20:59 - 2013-06-17 21:00 - 00007812 ____A C:\AdwCleaner[S1].txt
2013-06-17 20:59 - 2013-06-17 20:59 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\R1\Desktop\JRT.exe
2013-06-17 20:58 - 2013-06-17 20:58 - 00007843 ____A C:\AdwCleaner[R2].txt
2013-06-17 20:56 - 2013-06-17 20:57 - 00007783 ____A C:\AdwCleaner[R1].txt
2013-06-17 20:56 - 2013-06-17 20:56 - 00648201 ____A C:\Users\R1\Desktop\adwcleaner.exe
2013-06-17 20:33 - 2013-06-17 20:33 - 00023166 ____A C:\ComboFix.txt
2013-06-17 20:18 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-06-17 20:18 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-06-17 20:18 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-06-17 20:18 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-06-17 20:17 - 2013-06-17 20:33 - 00000000 ____D C:\Qoobox
2013-06-17 20:17 - 2013-06-17 20:32 - 00000000 ____D C:\Windows\erdnt
2013-06-17 20:15 - 2013-06-17 20:16 - 05079999 ____R (Swearware) C:\Users\R1\Desktop\ComboFix.exe
2013-06-17 20:01 - 2013-06-17 20:01 - 00016497 ____A C:\Users\R1\Desktop\Addition.txt
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:53 - 2013-06-17 19:54 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:42 - 2013-06-17 20:17 - 806559208 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-17 06:21 - 2013-04-04 14:50 - 00022856 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:34 - 2013-06-16 22:36 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:32 - 2013-06-16 22:33 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:31 - 2013-06-16 22:32 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:33 - 2013-06-16 21:34 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:04 - 2013-03-06 16:13 - 00037352 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00135136 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-06-16 21:04 - 2013-02-27 13:22 - 00084744 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-06-16 21:04 - 2012-08-27 15:50 - 00028520 ____A (Avira GmbH) C:\Windows\System32\Drivers\ssmdrv.sys
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 20:56 - 2013-06-16 21:00 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-14 19:53 - 2013-06-16 20:37 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-14 01:10 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-14 01:10 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-14 01:10 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-14 01:08 - 2013-05-17 03:26 - 00042496 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-14 01:08 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-14 01:08 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-14 01:08 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-13 18:22 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-13 18:22 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-13 18:22 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-13 18:22 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-13 18:22 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-13 18:22 - 2013-05-08 07:38 - 01293672 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-13 18:22 - 2013-05-06 07:06 - 03968872 ____A (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-13 18:22 - 2013-05-06 07:06 - 03913576 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-13 18:22 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-13 18:22 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-13 18:22 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
==================== One Month Modified Files and Folders ========
2013-06-17 23:55 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-17 23:55 - 2009-07-14 06:34 - 00018608 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-17 23:54 - 2010-08-02 18:34 - 01498742 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-17 23:52 - 2010-08-02 18:20 - 01578147 ____A C:\Windows\WindowsUpdate.log
2013-06-17 23:48 - 2012-12-06 22:55 - 00000000 ___SD C:\Users\R1\Google Drive
2013-06-17 23:47 - 2013-01-13 20:31 - 00101132 ____A C:\Windows\PFRO.log
2013-06-17 23:47 - 2013-01-13 19:06 - 00032256 ____A C:\Windows\setupact.log
2013-06-17 23:47 - 2012-12-06 22:53 - 00001086 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-06-17 23:47 - 2010-08-03 22:36 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-17 23:47 - 2009-07-14 06:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-17 23:40 - 2012-04-01 10:22 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-17 23:33 - 2013-06-17 23:33 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck (1).exe
2013-06-17 23:30 - 2011-09-25 11:37 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000UA.job
2013-06-17 23:30 - 2011-09-25 11:37 - 00001056 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-154391645-2589312494-2914735315-1000Core.job
2013-06-17 23:08 - 2012-12-06 22:53 - 00001090 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Downloads\SecurityCheck.exe
2013-06-17 21:19 - 2013-06-17 21:19 - 00890839 ____A C:\Users\R1\Desktop\SecurityCheck.exe
2013-06-17 21:18 - 2013-06-17 21:18 - 02347384 ____A (ESET) C:\Users\R1\Desktop\esetsmartinstaller_enu.exe
2013-06-17 21:05 - 2013-06-17 21:05 - 00000899 ____A C:\Users\R1\Desktop\JRT.txt
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\Windows\ERUNT
2013-06-17 21:04 - 2013-06-17 21:04 - 00000000 ____D C:\JRT
2013-06-17 21:00 - 2013-06-17 20:59 - 00007812 ____A C:\AdwCleaner[S1].txt
2013-06-17 20:59 - 2013-06-17 20:59 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\R1\Desktop\JRT.exe
2013-06-17 20:58 - 2013-06-17 20:58 - 00007843 ____A C:\AdwCleaner[R2].txt
2013-06-17 20:57 - 2013-06-17 20:56 - 00007783 ____A C:\AdwCleaner[R1].txt
2013-06-17 20:56 - 2013-06-17 20:56 - 00648201 ____A C:\Users\R1\Desktop\adwcleaner.exe
2013-06-17 20:33 - 2013-06-17 20:33 - 00023166 ____A C:\ComboFix.txt
2013-06-17 20:33 - 2013-06-17 20:17 - 00000000 ____D C:\Qoobox
2013-06-17 20:33 - 2009-07-14 04:37 - 00000000 __RHD C:\users\Default
2013-06-17 20:33 - 2009-07-14 04:37 - 00000000 ___RD C:\users\Public
2013-06-17 20:32 - 2013-06-17 20:17 - 00000000 ____D C:\Windows\erdnt
2013-06-17 20:29 - 2009-07-14 04:04 - 00000215 ____A C:\Windows\system.ini
2013-06-17 20:17 - 2013-06-17 19:42 - 806559208 ____A C:\Users\R1\Downloads\X15-65741.iso.crdownload
2013-06-17 20:16 - 2013-06-17 20:15 - 05079999 ____R (Swearware) C:\Users\R1\Desktop\ComboFix.exe
2013-06-17 20:01 - 2013-06-17 20:01 - 00016497 ____A C:\Users\R1\Desktop\Addition.txt
2013-06-17 19:55 - 2013-06-17 19:55 - 00000000 ____D C:\FRST
2013-06-17 19:54 - 2013-06-17 19:53 - 01365333 ____A (Farbar) C:\Users\R1\Desktop\FRST.exe
2013-06-17 19:01 - 2013-06-17 19:01 - 00073988 ____A C:\Users\R1\Desktop\Logs.zip
2013-06-17 18:28 - 2013-06-17 18:28 - 00013874 ____A C:\Users\R1\Desktop\AVSCAN-20130616-211009-87859673.LOG
2013-06-17 18:27 - 2013-06-17 18:27 - 00030518 ____A C:\Users\R1\Desktop\AVSCAN-20130616-230420-221B40B7.LOG
2013-06-17 18:15 - 2013-06-17 18:15 - 00002388 ____A C:\Users\R1\Desktop\aswMBR.txt
2013-06-17 18:15 - 2013-06-17 18:15 - 00000512 ____A C:\Users\R1\Desktop\MBR.dat
2013-06-17 08:11 - 2013-06-17 08:11 - 00003518 ____A C:\Users\R1\Desktop\gmer.log
2013-06-17 07:17 - 2013-06-17 07:17 - 00159792 ____A C:\Windows\Minidump\061713-21109-01.dmp
2013-06-17 07:17 - 2010-08-09 13:20 - 00000000 ____D C:\Windows\Minidump
2013-06-17 07:16 - 2013-06-17 07:16 - 325983433 ____A C:\Windows\MEMORY.DMP
2013-06-17 07:02 - 2013-06-17 07:02 - 00065956 ____A C:\Users\R1\Desktop\Extras.Txt
2013-06-17 07:00 - 2013-06-17 07:00 - 00075724 ____A C:\Users\R1\Desktop\OTL.Txt
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Downloads\OTL.exe
2013-06-17 06:50 - 2013-06-17 06:50 - 00602112 ____A (OldTimer Tools) C:\Users\R1\Desktop\OTL.exe
2013-06-17 06:43 - 2010-08-02 12:44 - 00000000 ____D C:\users\R1
2013-06-17 06:21 - 2013-06-17 06:21 - 00001067 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Users\R1\AppData\Roaming\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-06-17 06:21 - 2013-06-17 06:21 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2013-06-16 23:01 - 2012-04-25 10:14 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-06-16 22:38 - 2013-06-16 22:38 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\R1\Downloads\mbam-setup-1.75.0.1300.exe
2013-06-16 22:36 - 2013-06-16 22:34 - 04745728 ____A (AVAST Software) C:\Users\R1\Desktop\aswMBR.exe
2013-06-16 22:35 - 2013-06-16 22:35 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\R1\Desktop\tdsskiller.exe
2013-06-16 22:33 - 2013-06-16 22:32 - 00377856 ____A C:\Users\R1\Desktop\gmer_2.1.19163.exe
2013-06-16 22:32 - 2013-06-16 22:31 - 13169742 ____A C:\Users\R1\Downloads\mbar-1.06.0.1003.zip
2013-06-16 21:34 - 2013-06-16 21:33 - 05049344 ____A (Crawler.com ) C:\Users\R1\Downloads\SpywareTerminatorSetup_3.0.0.82.exe
2013-06-16 21:11 - 2013-06-16 21:11 - 00000000 ____D C:\Users\R1\AppData\Roaming\Avira
2013-06-16 21:07 - 2013-06-16 21:07 - 00066656 ____A (Avira GmbH) C:\Windows\System32\Drivers\avnetflt.sys
2013-06-16 21:06 - 2013-02-17 00:49 - 00001912 ____A C:\Windows\epplauncher.mif
2013-06-16 21:05 - 2013-06-16 21:05 - 00002012 ____A C:\Users\Public\Desktop\Avira Control Center.lnk
2013-06-16 21:03 - 2013-06-16 21:03 - 00000000 ____D C:\Program Files\Avira
2013-06-16 21:03 - 2012-05-26 06:56 - 00000000 ____D C:\ProgramData\Avira
2013-06-16 21:00 - 2013-06-16 20:56 - 102323272 ____A C:\Users\R1\Downloads\avira_free3640_antivirus_de.exe
2013-06-16 20:49 - 2013-05-12 23:34 - 00000032 ____A C:\Windows\Menu.INI
2013-06-16 20:37 - 2013-06-14 19:53 - 00000000 ____D C:\Program Files\Mozilla Thunderbird
2013-06-16 10:20 - 2012-04-29 14:15 - 00000000 ____D C:\Users\R1\AppData\Roaming\TS3Client
2013-06-14 20:41 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache
2013-06-14 19:29 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-14 01:11 - 2010-08-05 15:54 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-14 01:09 - 2010-10-08 22:04 - 73381792 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-13 19:41 - 2012-04-01 10:22 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-13 19:41 - 2011-06-25 09:19 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-08 21:50 - 2012-12-12 21:11 - 00000981 ____A C:\Users\R1\Desktop\rFactor - Bockbierbude.lnk
2013-06-08 13:42 - 2013-06-14 01:10 - 01141248 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 14327808 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 02046976 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-08 13:40 - 2013-06-14 01:10 - 00391168 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-08 13:13 - 2013-06-14 01:10 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-03 22:52 - 2013-06-03 22:52 - 21966018 ____A C:\Users\R1\Documents\SoftTH_rFactor_000008661515.tga
2013-06-01 18:36 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Steam
2013-06-01 18:31 - 2012-12-31 18:24 - 00000000 ____D C:\Program Files\Common Files\Steam
2013-05-26 10:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-13 19:09
==================== End Of Log ============================
--- --- --- --- --- --- |
|
18.06.2013, 07:02
| #10 |
| /// the machine /// TB-Ausbilder | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN Adobe Reader bitte updaten. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.06.2013, 17:36
| #11 |
| | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN So wie es aussieht keine ! Vielen Dank für die schnelle und unkomplizierte Hilfe (auch wenn ich keine Ahnung habe, was genau wir da getrieben haben  )Also nochmal Daumen hoch für die Unterstützung !  Schönen Gruß ! |
|
18.06.2013, 18:34
| #12 |
| /// the machine /// TB-Ausbilder | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN Gern geschehen Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.06.2013, 18:48
| #13 |
| | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN So, alles erledigt. Wie es aussieht, keine weiteren Probleme mehr. Vielen Dank !  |
|
19.06.2013, 19:50
| #14 |
| /// the machine /// TB-Ausbilder | Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN gern geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Malware vorhanden ? / USB-Stick nur Verknüpfungen / TR/Dropper.GEN |
| adware/adparatus.a.63, adware/relevant.g.1, adware/relevant.q, adware/relevant.x.1, anschluss, infizierte, lsass.exe, malware, php/kryptik.ab, programme, services.exe, svchost.exe, taskhost.exe, tr/dropper.gen, winlogon.exe |
Linear-Darstellung
