Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
GVU-Trojaner

GVU-Trojaner


Plagegeister aller Art und deren Bekämpfung: GVU-Trojaner

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 22.06.2013, 01:35   #1
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Hallo,

ich habe mir den GVU-Trojaner eingefangen. Das Starten aus dem abgesicherten Modus funktioniert überhaupt nicht und die Kaspersky Rettungs-CD (WindowsUnlocker) nimmt er nicht an. Das Scannen des nicht bootbares System mit OTLPE Network schlug fehl, da ich nicht auf den OTLPE-Desktop gelange. Eine Verbindung zum Internet habe ich mit dem Rechner auch nicht mehr. Es ist als wenn alles gekappt wurde ...


Wie komme ich an meine Daten zur Überprüfung der Sicherung wieder ran? Ich bin mir nicht sicher, ob alles gesichert ist und würde dieses gerne prüfen bzw. sichern wollen, bevor ich das System neu aufsetze.

Kann mir jemand helfen?

Danke im Voraus!

Matthias

Alt 22.06.2013, 01:37   #2
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Hallo Matthias,

was hast du denn für ein Betriebssystem? Windows XP, Vista, 7? 32-bit oder 64-bit?
__________________

__________________
Alt 22.06.2013, 01:40   #3
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Hallo Leo,

läuft unter Windows 7, glaube 32 Bit.
__________________
Alt 22.06.2013, 01:41   #4
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Downloade dir bitte Farbar Recovery Scan Tool 32-Bit und speichere diese auf einen USB Stick (nicht in einen Unterordner!).
Schliesse den USB Stick an den infizierten Rechner an.

Du musst das System nun in die System Reparatur Option booten:
Variante 1 - Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während des Hochfahrens drücke mehrmals die F8 Taste.
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils Weiter.

oder

Variante 2 - Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und boote von der CD.
  • Wähle die Spracheinstellungen und klicke Weiter.
  • Klicke auf Computerreparaturoptionen.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils Weiter.

Wenn du jetzt in den Reparaturoptionen bist, wähle Eingabeaufforderung.
  • Gib nun bitte notepad ein und drücke Enter.
    • Es öffnet sich ein Textdokument. Klicke auf Datei -> Speichern unter und wähle Computer.
    • Lese hier nun den Laufwerksbuchstaben deines USB Sticks (z.B. e:\) ab.
    • Schliesse Notepad wieder.
  • Gib nun bitte folgenden Befehl ein und drücke Enter:
    e:\frst.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Wenn es bei dir ein anderer Buchstabe ist, dann passe den Befehl entsprechend an.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan.
Das Tool erstellt eine Datei FRST.txt auf deinem USB Stick. Poste dessen Inhalt bitte hier.
__________________
cheers,
Leo

Alt 22.06.2013, 01:55   #5
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Bei mir erscheint die Meldung: "Das zum Unterstützen des Abbildtyps erforderliche Subsystem ist nicht vorhanden", obwohl der Stick mit Laufwerk H identifiziert wurde. Mach ich was falsch?


Alt 22.06.2013, 02:03   #6
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Versuchs mal mit der 64-bit-Version:


Downloade dir bitte Farbar Recovery Scan Tool 64-Bit und speichere diese auf einen USB Stick (nicht in einen Unterordner!).
Schliesse den USB Stick an den infizierten Rechner an.

Du musst das System nun in die System Reparatur Option booten:
Variante 1 - Über den Boot Manager
  • Starte den Rechner neu auf.
  • Während des Hochfahrens drücke mehrmals die F8 Taste.
  • Wähle nun Computer reparieren.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils Weiter.

oder

Variante 2 - Mit Windows CD/DVD
  • Lege die Windows CD in dein Laufwerk.
  • Starte den Rechner neu auf und boote von der CD.
  • Wähle die Spracheinstellungen und klicke Weiter.
  • Klicke auf Computerreparaturoptionen.
  • Wähle dein Betriebssystem und Benutzerkonto und klicke jeweils Weiter.

Wenn du jetzt in den Reparaturoptionen bist, wähle Eingabeaufforderung.
  • Gib nun bitte notepad ein und drücke Enter.
    • Es öffnet sich ein Textdokument. Klicke auf Datei -> Speichern unter und wähle Computer.
    • Lese nun hier den Laufwerksbuchstaben deines USB Sticks (z.B. e:\) ab.
    • Schliesse Notepad wieder.
  • Gib nun bitte folgenden Befehl ein und drücke Enter:
    e:\frst64.exe
    Hinweis: e steht für den Laufwerksbuchstaben deines USB Sticks. Wenn es bei dir ein anderer Buchstabe ist, dann passe den Befehl entsprechend an.
  • Akzeptiere den Disclaimer mit Yes und klicke Scan.
Das Tool erstellt eine Datei FRST.txt auf deinem USB Stick. Poste dessen Inhalt bitte hier.
__________________
--> GVU-Trojaner

Alt 22.06.2013, 02:15   #7
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Also doch 64-Bit, sorry ...
FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2013 02
Ran by SYSTEM on 22-06-2013 07:09:28
Running from H:\
WIN_7 Service Pack 1 (X64) OS Language: German Standard
Boot Mode: Recovery
Attention: Could not load system hive.
==================== Registry (Whitelisted) ==================

ATTENTION: Software hive is not loaded.

HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-12] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-12] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-12] ()
HKU\wir\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.exe [59904 2013-06-21] (Mozilla Foundation)
HKU\wir\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKU\wir\...\Command Processor: "C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.exe" <===== ATTENTION!
Startup: C:\ProgramData\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\wir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcbhn.lnk
ShortcutTarget: tcbhn.lnk ->  (No File)
BootExecute: 

==================== Services (Whitelisted) =================


==================== Drivers (Whitelisted) ====================


==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-22 07:09 - 2013-06-22 07:09 - 00000000 ____D C:\FRST
2013-06-21 14:44 - 2013-06-21 14:44 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-21 14:44 - 2013-06-21 14:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-21 14:44 - 2013-06-21 14:44 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-21 14:44 - 2013-06-21 14:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-21 14:44 - 2013-06-21 14:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-21 14:44 - 2013-06-21 14:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-21 14:44 - 2013-06-21 14:44 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-21 14:44 - 2013-06-21 14:44 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-21 14:44 - 2013-06-21 14:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-21 14:44 - 2013-06-21 14:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-21 14:44 - 2013-06-21 14:44 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-21 14:43 - 2013-06-21 14:48 - 00010370 ____A C:\Windows\IE10_main.log
2013-06-21 12:48 - 2013-06-21 12:48 - 01084717 ____A C:\ProgramData\2433f433
2013-06-21 12:48 - 2013-06-21 12:48 - 01084686 ____A C:\Users\wir\AppData\Local\2433f433
2013-06-21 12:48 - 2013-06-21 12:48 - 01084678 ____A C:\Users\wir\AppData\Roaming\2433f433
2013-06-21 12:47 - 2013-06-21 12:47 - 00000000 ____D C:\Windows\Sun
2013-06-15 03:45 - 2013-06-15 03:45 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-11 19:42 - 2013-05-12 21:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-11 19:42 - 2013-05-12 21:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-11 19:42 - 2013-05-12 21:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-11 19:42 - 2013-05-12 21:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-11 19:42 - 2013-05-12 20:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-11 19:42 - 2013-05-12 20:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-11 19:42 - 2013-05-12 20:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-11 19:42 - 2013-05-12 19:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-11 19:42 - 2013-05-12 19:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-11 19:42 - 2013-05-12 19:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-11 19:42 - 2013-05-09 21:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-11 19:42 - 2013-05-09 19:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-11 19:42 - 2013-05-07 22:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-11 19:42 - 2013-04-25 21:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-11 19:42 - 2013-04-25 20:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-11 19:42 - 2013-04-25 15:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-11 19:42 - 2013-04-16 23:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-11 19:42 - 2013-04-16 22:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-11 19:42 - 2013-03-31 14:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-09 03:49 - 2013-06-09 03:49 - 00000000 ____D C:\Users\wir\AppData\Local\{D44E6AC6-2F2C-437B-A768-A250149EACE6}
2013-06-04 09:28 - 2013-06-04 09:28 - 00000000 ____D C:\Users\wir\AppData\Local\{0E0B81E1-02BB-4D6D-AEA6-4E4492539E1C}
2013-05-23 03:49 - 2013-05-23 03:53 - 817828157 ____A C:\Users\wir\Downloads\Hoerspiel.zip
2013-05-23 03:44 - 2013-05-23 03:46 - 356529855 ____A C:\Users\wir\Downloads\Bilder.zip

==================== One Month Modified Files and Folders =======

2013-06-22 07:09 - 2013-06-22 07:09 - 00000000 ____D C:\FRST
2013-06-21 17:11 - 2012-03-14 09:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-21 17:11 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-21 17:11 - 2009-07-13 20:51 - 00084861 ____A C:\Windows\setupact.log
2013-06-21 15:02 - 2009-07-13 20:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-21 15:02 - 2009-07-13 20:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-21 15:01 - 2012-10-27 11:16 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-06-21 15:00 - 2010-11-20 19:47 - 00023508 ____A C:\Windows\PFRO.log
2013-06-21 15:00 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-21 14:54 - 2012-03-14 09:14 - 02093230 ____A C:\Windows\WindowsUpdate.log
2013-06-21 14:48 - 2013-06-21 14:43 - 00010370 ____A C:\Windows\IE10_main.log
2013-06-21 14:44 - 2013-06-21 14:44 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-21 14:44 - 2013-06-21 14:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-21 14:44 - 2013-06-21 14:44 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-21 14:44 - 2013-06-21 14:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-21 14:44 - 2013-06-21 14:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-21 14:44 - 2013-06-21 14:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-21 14:44 - 2013-06-21 14:44 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-21 14:44 - 2013-06-21 14:44 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-21 14:44 - 2013-06-21 14:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-21 14:44 - 2013-06-21 14:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-21 14:44 - 2013-06-21 14:44 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-21 14:44 - 2013-06-21 14:44 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-21 14:44 - 2013-06-21 14:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-21 14:11 - 2012-10-07 00:06 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-21 12:48 - 2013-06-21 12:48 - 01084717 ____A C:\ProgramData\2433f433
2013-06-21 12:48 - 2013-06-21 12:48 - 01084686 ____A C:\Users\wir\AppData\Local\2433f433
2013-06-21 12:48 - 2013-06-21 12:48 - 01084678 ____A C:\Users\wir\AppData\Roaming\2433f433
2013-06-21 12:47 - 2013-06-21 12:47 - 00000000 ____D C:\Windows\Sun
2013-06-20 19:21 - 2012-05-10 23:14 - 00000000 ____D C:\Users\wir\AppData\Roaming\BrowserCompanion
2013-06-17 12:11 - 2012-09-29 22:45 - 00000000 ____D C:\Users\wir\AppData\Roaming\Skype
2013-06-15 03:45 - 2013-06-15 03:45 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-15 03:45 - 2011-11-08 04:01 - 00000000 ____D C:\ProgramData\Skype
2013-06-12 20:01 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache
2013-06-12 19:20 - 2009-07-13 18:34 - 00000531 ____A C:\Windows\win.ini
2013-06-12 12:12 - 2012-06-09 00:42 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-11 20:11 - 2012-10-07 00:06 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 20:11 - 2011-11-08 04:22 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 03:58 - 2012-11-01 01:56 - 00000000 ____D C:\Users\wir\Documents\Eigene PSP-Dateien
2013-06-09 10:17 - 2012-03-14 18:08 - 03318440 ____A C:\Windows\System32\perfh007.dat
2013-06-09 10:17 - 2012-03-14 18:08 - 00982922 ____A C:\Windows\System32\perfc007.dat
2013-06-09 10:17 - 2009-07-13 21:13 - 00005414 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-09 03:49 - 2013-06-09 03:49 - 00000000 ____D C:\Users\wir\AppData\Local\{D44E6AC6-2F2C-437B-A768-A250149EACE6}
2013-06-04 09:28 - 2013-06-04 09:28 - 00000000 ____D C:\Users\wir\AppData\Local\{0E0B81E1-02BB-4D6D-AEA6-4E4492539E1C}
2013-05-23 03:53 - 2013-05-23 03:49 - 817828157 ____A C:\Users\wir\Downloads\Hoerspiel.zip
2013-05-23 03:46 - 2013-05-23 03:44 - 356529855 ____A C:\Users\wir\Downloads\Bilder.zip

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe:  <===== ATTENTION!
HKLM\...\exefile\DefaultIcon:  <===== ATTENTION!
HKLM\...\exefile\open\command:  <===== ATTENTION!

==================== Restore Points  =========================

Restore point made on: 2013-05-15 19:47:23
Restore point made on: 2013-05-23 21:37:45
Restore point made on: 2013-06-02 04:57:38
Restore point made on: 2013-06-09 20:16:10
Restore point made on: 2013-06-12 12:12:19
Restore point made on: 2013-06-14 21:17:03
Restore point made on: 2013-06-21 14:42:42

==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 8043.86 MB
Available physical RAM: 6297.89 MB
Total Pagefile: 8042.06 MB
Available Pagefile: 6748.6 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:227.44 GB) (Free:111.58 GB) NTFS (Disk=0 Partition=3)
Drive d: (Volume) (Fixed) (Total:225.22 GB) (Free:209.27 GB) NTFS (Disk=0 Partition=4)
Drive f: (PQSERVICE) (Fixed) (Total:13 GB) (Free:2.09 GB) NTFS (Disk=0 Partition=1)
Drive h: () (Removable) (Total:1.88 GB) (Free:1.49 GB) FAT (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 717CFBDD)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=227 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=225 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 81CB2276)
Partition 1: (Not Active) - (Size=2 GB) - (Type=06)


LastRegBack: 2013-06-12 19:53

==================== End Of Log ============================
--- --- ---
Alt 22.06.2013, 02:34   #8
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Hi,

hmm, so ganz passt das Log aber auch nicht.
Versuchen wir dennoch den Fix. Kannst du den Rechner nach folgendem Schritt wieder normal starten?


Drücke auf einem Zweitrechner bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument:
Code:
ATTFilter
HKU\wir\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.exe [59904 2013-06-21] (Mozilla Foundation)
HKU\wir\...\Winlogon: [Shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTION 
HKU\wir\...\Command Processor: "C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.exe" <===== ATTENTION!
C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.exe
C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.dll
2013-06-21 12:48 - 2013-06-21 12:48 - 01084717 ____A C:\ProgramData\2433f433
2013-06-21 12:48 - 2013-06-21 12:48 - 01084686 ____A C:\Users\wir\AppData\Local\2433f433
2013-06-21 12:48 - 2013-06-21 12:48 - 01084678 ____A C:\Users\wir\AppData\Roaming\2433f433
Speichere dieses dann bitte unter dem Dateinamen Fixlist.txt auf deinen USB Stick neben FRST.
  • Schliesse den USB Stick wieder an den infizierten Rechner an.
  • Starte deinen Rechner erneut in die Reparaturoptionen.
  • Starte nun wiederum FRST, aber klicke dieses Mal auf den Fix Button.
Das Tool erstellt eine Datei Fixlog.txt auf deinem USB Stick. Poste deren Inhalt bitte hier.
__________________
cheers,
Leo

Alt 22.06.2013, 02:42   #9
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-06-2013 02
Ran by SYSTEM at 2013-06-22 07:41:15 Run:1
Running from H:\
Boot Mode: Recovery
==============================================

HKU\wir\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value deleted successfully.
HKU\wir\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.
HKU\wir\Software\Microsoft\Command Processor\\AutoRun => Value deleted successfully.
C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.exe => Moved successfully.
C:\Users\wir\AppData\Local\Temp\mwfidfkifvuaxytqo.dll => File/Directory not found.
C:\ProgramData\2433f433 => Moved successfully.
C:\Users\wir\AppData\Local\2433f433 => Moved successfully.
C:\Users\wir\AppData\Roaming\2433f433 => Moved successfully.

==== End of Fixlog ====

Alt 22.06.2013, 02:44   #10
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Und lässt sich der Rechner wieder starten?
__________________
cheers,
Leo

Alt 22.06.2013, 02:53   #11
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Hatte mich noch nicht getraut, ohne zu wissen, ob ich dadurch nicht wieder etwas aktiviere ...

Es läuft! Ich komme wieder auf den Desktop! Super! Danke!

Was muss ich jetzt noch beachten?

Alt 22.06.2013, 03:02   #12
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Wir sind noch nicht fertig!


Schritt 1

Lade SystemLook (von jpshortstuff) herunter und speichere das Tool auf dem Desktop.
  • Doppelklicke auf die SystemLook_x64.exe, um das Tool zu starten.
    Vista und Win7 User: Rechtsklick und "als Administrator starten".
  • Kopiere den Inhalt der folgenden Codebox in das Textfeld des Tools:

    Code:
    ATTFilter
    :filefind
*mwfidfkifvuaxytqo*

:reg
HKEY_CLASSES_ROOT\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03} /sub
HKEY_CLASSES_ROOT\CLSID\{750fdf10-2a26-11d1-a3ea-080036587f03} /sub
HKEY_CLASSES_ROOT\CLSID\{28949824-6737-0594-0930-223283753445} /sub

:regfind
mwfidfkifvuaxytqo
  • Klicke nun auf den Button Look, um den Scan zu starten.
  • Wenn der Suchlauf beendet ist, wird sich dein Editor mit den Ergebnissen öffnen. Poste diese in deinen Thread.
  • Das Log-File wird auch auf dem Desktop als SystemLook.txt gespeichert.



Schritt 2

Verschiebe die frst64.exe vom USB-Stick auf deinen Desktop.
  • Starte dann FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden zwei Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.



Bitte poste in deiner nächsten Antwort:
  • Log von SystemLook
  • Logs von FRST
__________________
cheers,
Leo

Alt 22.06.2013, 03:25   #13
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


Die Programme sind noch am scannen ...

dauert anscheinend länger ...

der Systemlook scannt noch, obwohl eine Textdatei vorhanden.



FRST:
FRST Logfile:

FRST Logfile:

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2013 02
Ran by wir (administrator) on 22-06-2013 08:18:30
Running from C:\Users\wir\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Egis Technology Inc. ) C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
() C:\Users\wir\AppData\Roaming\BrowserCompanion\tcbhn.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Egis Technology Inc. ) C:\Program Files\Acer ProShield\EgisTSR.exe
(Garmin) C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
() C:\Users\wir\Desktop\SystemLook_x64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-10-08] ()
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2697512 2011-02-17] (Synaptics Incorporated)
HKLM\...\Run: [ProShieldTSR] "C:\Program Files\Acer ProShield\EgisTSR.exe" /run [165936 2011-06-04] (Egis Technology Inc. )
HKLM\...\Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k [297280 2011-04-24] (NTI Corporation)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1110096 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Garmin Lifetime Updater] C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized [1466760 2012-05-23] (Garmin)
HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1532992 2013-03-13] (McAfee, Inc.)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-13] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-13] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-09-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-09-08] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli EgisPwdFilter EgisDSPwdFilter
Startup: C:\ProgramData\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()
Startup: C:\Users\wir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcbhn.lnk
ShortcutTarget: tcbhn.lnk -> C:\Users\wir\AppData\Roaming\BrowserCompanion\tcbhn.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms}
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
HKLM-x32 SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms}
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms}
HKCU SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms}
SearchScopes: HKCU - {6430093D-4C69-4A4D-8D13-8B679258870F} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEAUTOBR
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
BHO-x32: Browser Companion Helper - {00cbb66b-1d3b-46d3-9577-323a336acb50} - C:\Program Files (x86)\BrowserCompanion\jsloader.dll ( )
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: EgisPBIE Sign-in Helper - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files\Acer ProShield\x86\EgisPBIE.dll (Egis Technology Inc.)
BHO-x32: DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Browser Companion Helper Verifier - {963B125B-8B21-49A2-A3A8-E37092276531} - C:\Program Files (x86)\BrowserCompanion\updatebhoWin32.dll ( )
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - DVDVideoSoftTB Toolbar - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Toolbar: HKCU - No Name - {872B5B88-9DB5-4310-BDD0-AC189557E5F5} -  No File
Handler: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: msdaipp - No CLSID Value - 
Handler: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} -  No File
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler-x32: base64 - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
Handler-x32: chrome - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: msdaipp - No CLSID Value - 
Handler-x32: prox - {5ACE96C0-C70A-4A4D-AF14-2E7B869345E1} - C:\Program Files (x86)\BrowserCompanion\tdataprotocol.dll (Blabbers Communications Ltd)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\PROGRA~1\mcafee\msc\MCSNIE~1.DLL (McAfee, Inc.)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} -  No File
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\PROGRA~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 83.169.184.161 83.169.184.225

==================== Services (Whitelisted) =================

R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
R2 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [212016 2011-06-04] (Egis Technology Inc. )
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)

==================== Drivers (Whitelisted) ====================

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [249152 2011-09-08] (NVIDIA Corporation)
U3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-22 17:09 - 2013-06-22 17:09 - 00000000 ____D C:\FRST
2013-06-22 08:18 - 2013-06-22 08:18 - 00000382 ____A C:\Users\wir\Desktop\SystemLook.txt
2013-06-22 08:17 - 2013-06-22 04:06 - 00165376 ____A C:\Users\wir\Desktop\SystemLook_x64.exe
2013-06-22 08:14 - 2013-06-22 03:05 - 01930924 ____A (Farbar) C:\Users\wir\Desktop\FRST64.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-22 00:43 - 2013-06-22 00:48 - 00010370 ____A C:\Windows\IE10_main.log
2013-06-21 22:47 - 2013-06-21 22:47 - 00000000 ____D C:\Windows\Sun
2013-06-15 13:45 - 2013-06-15 13:45 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-12 05:42 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 05:42 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 05:42 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 05:42 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 05:42 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 05:42 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 05:42 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 05:42 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 05:42 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 05:42 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 05:42 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 05:42 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 05:42 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 05:42 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 05:42 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 05:42 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 05:42 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 05:42 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 05:42 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-09 13:49 - 2013-06-09 13:49 - 00000000 ____D C:\Users\wir\AppData\Local\{D44E6AC6-2F2C-437B-A768-A250149EACE6}
2013-06-04 19:28 - 2013-06-04 19:28 - 00000000 ____D C:\Users\wir\AppData\Local\{0E0B81E1-02BB-4D6D-AEA6-4E4492539E1C}
2013-05-23 13:49 - 2013-05-23 13:53 - 817828157 ____A C:\Users\wir\Downloads\Hoerspiel.zip
2013-05-23 13:44 - 2013-05-23 13:46 - 356529855 ____A C:\Users\wir\Downloads\Bilder.zip

==================== One Month Modified Files and Folders =======

2013-06-22 17:09 - 2013-06-22 17:09 - 00000000 ____D C:\FRST
2013-06-22 08:18 - 2013-06-22 08:18 - 00000382 ____A C:\Users\wir\Desktop\SystemLook.txt
2013-06-22 08:12 - 2012-03-15 04:08 - 03333232 ____A C:\Windows\System32\perfh007.dat
2013-06-22 08:12 - 2012-03-15 04:08 - 00987658 ____A C:\Windows\System32\perfc007.dat
2013-06-22 08:12 - 2009-07-14 07:13 - 00005414 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-22 08:11 - 2012-10-07 10:06 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-22 08:03 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-22 08:03 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-22 08:00 - 2012-03-14 19:14 - 01058563 ____A C:\Windows\WindowsUpdate.log
2013-06-22 07:52 - 2012-05-11 09:14 - 00000000 ____D C:\Users\wir\AppData\Roaming\BrowserCompanion
2013-06-22 07:50 - 2012-03-14 19:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-22 07:50 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-22 07:50 - 2009-07-14 06:51 - 00084917 ____A C:\Windows\setupact.log
2013-06-22 04:06 - 2013-06-22 08:17 - 00165376 ____A C:\Users\wir\Desktop\SystemLook_x64.exe
2013-06-22 03:05 - 2013-06-22 08:14 - 01930924 ____A (Farbar) C:\Users\wir\Desktop\FRST64.exe
2013-06-22 01:01 - 2012-10-27 21:16 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-06-22 01:00 - 2010-11-21 05:47 - 00023508 ____A C:\Windows\PFRO.log
2013-06-22 01:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-22 00:48 - 2013-06-22 00:43 - 00010370 ____A C:\Windows\IE10_main.log
2013-06-22 00:44 - 2013-06-22 00:44 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-21 22:47 - 2013-06-21 22:47 - 00000000 ____D C:\Windows\Sun
2013-06-17 22:11 - 2012-09-30 08:45 - 00000000 ____D C:\Users\wir\AppData\Roaming\Skype
2013-06-15 13:45 - 2013-06-15 13:45 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-15 13:45 - 2011-11-08 14:01 - 00000000 ____D C:\ProgramData\Skype
2013-06-13 06:01 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-13 05:20 - 2009-07-14 04:34 - 00000531 ____A C:\Windows\win.ini
2013-06-12 22:12 - 2012-06-09 10:42 - 75825640 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-12 06:11 - 2012-10-07 10:06 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-12 06:11 - 2011-11-08 14:22 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 13:58 - 2012-11-01 11:56 - 00000000 ____D C:\Users\wir\Documents\Eigene PSP-Dateien
2013-06-09 13:49 - 2013-06-09 13:49 - 00000000 ____D C:\Users\wir\AppData\Local\{D44E6AC6-2F2C-437B-A768-A250149EACE6}
2013-06-04 19:28 - 2013-06-04 19:28 - 00000000 ____D C:\Users\wir\AppData\Local\{0E0B81E1-02BB-4D6D-AEA6-4E4492539E1C}
2013-05-23 13:53 - 2013-05-23 13:49 - 817828157 ____A C:\Users\wir\Downloads\Hoerspiel.zip
2013-05-23 13:46 - 2013-05-23 13:44 - 356529855 ____A C:\Users\wir\Downloads\Bilder.zip

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-06-13 05:53

==================== End Of Log ============================
--- --- ---

--- --- ---

--- --- ---




AdditionFRST Additions Logfile:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 22-06-2013 02
Ran by wir at 2013-06-22 08:31:30 Run:
Running from C:\Users\wir\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

???? ??? Windows Live (Version: 15.4.3502.0922)
???? Windows Live (Version: 15.4.3502.0922)
?????? ??????? ?? Windows Live (Version: 15.4.3502.0922)
???????? ?????????? Windows Live (Version: 15.4.3502.0922)
?????????? Windows Live (Version: 15.4.3502.0922)
??????????? ?? Windows Live (Version: 15.4.3502.0922)
Acer Backup Manager (Version: 3.0.0.99)
Acer Crystal Eye Webcam (Version: 1.0.1710)
Acer ePower Management (Version: 6.00.3007)
Acer eRecovery Management (Version: 5.00.3502)
Acer Registration (Version: 1.04.3502)
Acer ScreenSaver (Version: 1.1.0913.2011)
Acer Updater (Version: 1.02.3501)
Acer VCM (Version: 4.05.3501)
Adobe Flash Player 11 ActiveX (Version: 11.7.700.224)
Adobe Reader X (10.1.0) MUI (Version: 10.1.0)
Any Video Converter 3.5.6
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (Version: 1.0.0.36)
Backup Manager V3 (Version: 3.0.0.99)
BrowserCompanion
Compatibility Pack für 2007 Office System (Version: 12.0.6612.1000)
Conexant HD Audio (Version: 8.52.0.50)
Corel WinDVD (Version: 10.0.5.899)
D3DX10 (Version: 15.4.2368.0902)
DVDVideoSoftTB Toolbar (Version: 6.8.10.401)
Fotogalerija Windows Live (Version: 15.4.3502.0922)
Free YouTube Download version 3.1.38.1005 (Version: 3.1.38.1005)
Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922)
Galería fotográfica de Windows Live (Version: 15.4.3502.0922)
Galeria fotogràfica del Windows Live (Version: 15.4.3502.0922)
Galeria fotografii uslugi Windows Live (Version: 15.4.3502.0922)
Galerie de photos Windows Live (Version: 15.4.3502.0922)
Galerie foto Windows Live (Version: 15.4.3502.0922)
Garmin Lifetime Updater (Version: 2.1.10)
Identity Card (Version: 1.00.3501)
Install Absolute Data Protect (Version: 1.0.0.42)
Intel(R) Control Center (Version: 1.2.1.1007)
Intel(R) Management Engine Components (Version: 7.0.0.1144)
Intel(R) Processor Graphics (Version: 8.15.10.2345)
Intel(R) Rapid Storage Technology (Version: 10.6.0.1002)
Jasc Paint Shop Pro 9 (Version: 9.00.0000)
Java(TM) 6 Update 29 (Version: 6.0.290)
Junk Mail filter update (Version: 15.4.3502.0922)
Launch Manager (Version: 6.0.8s1)
McAfee Internet Security Suite (Version: 11.6.511)
Mesh Runtime (Version: 15.4.5722.2)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Professional Edition 2003 (Version: 11.0.8173.0)
Microsoft Office Starter 2010 - Deutsch (Version: 14.0.5128.5002)
Microsoft Silverlight (Version: 5.1.20125.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT_amd64 (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
newsXpresso (Version: 1.0.0.40)
Norton Online Backup (Version: 2.1.17869)
NTI Media Maker 9 (Version: 9.0.2.8942)
NVIDIA 3D Vision Treiber 285.25 (Version: 285.25)
NVIDIA Grafiktreiber 285.25 (Version: 285.25)
NVIDIA HD-Audiotreiber 1.2.24.0 (Version: 1.2.24.0)
NVIDIA Install Application (Version: 2.1002.42.219)
NVIDIA Optimus 1.5.20 (Version: 1.5.20)
NVIDIA PhysX (Version: 9.10.0514)
NVIDIA Stereoscopic 3D Driver (Version: 7.17.12.8525)
NVIDIA Systemsteuerung 285.25 (Version: 285.25)
NVIDIA Update Components (Version: 1.5.20)
PDFCreator (Version: 1.3.2)
Poczta uslugi Windows Live (Version: 15.4.3502.0922)
Podstawowe programy Windows Live (Version: 15.4.3502.0922)
Pošta Windows Live (Version: 15.4.3502.0922)
ProShield (Version: 1.0.48.3)
Raccolta foto di Windows Live (Version: 15.4.3502.0922)
Ravensburger tiptoi
Realtek PCIE Card Reader (Version: 6.1.7600.74)
S?????? f?t???af??? t?? Windows Live (Version: 15.4.3502.0922)
Shared C Run-time for x64 (Version: 10.0.0)
Skype™ 5.10 (Version: 5.10.116)
Synaptics Pointing Device Driver (Version: 15.2.14.0)
TuneUp Utilities Language Pack (de-DE) (Version: 13.0.2020.4)
Überwachungstool für die Intel® Turbo-Boost-Technik 2.0 (Version: 2.0.82.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Welcome Center (Version: 1.02.3504)
Windows Live ??? (Version: 15.4.3502.0922)
Windows Live ???? (Version: 15.4.3502.0922)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3538.0513)
Windows Live Fotogaléria (Version: 15.4.3502.0922)
Windows Live Fotogalerie (Version: 15.4.3502.0922)
Windows Live Fotogalleri (Version: 15.4.3502.0922)
Windows Live Fotograf Galerisi (Version: 15.4.3502.0922)
Windows Live Fotótár (Version: 15.4.3502.0922)
Windows Live Galeria de Fotos (Version: 15.4.3502.0922)
Windows Live Galerija fotografija (Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3538.0513)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Temel Parçalar (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Liven asennustyökalu (Version: 15.4.3502.0922)
Windows Liven sähköposti (Version: 15.4.3502.0922)
Windows Liven valokuvavalikoima (Version: 15.4.3502.0922)
WISO Steuer-Sparbuch 2012 (Version: 19.05.7368)
WISO Steuer-Sparbuch 2013 (Version: 20.00.8137)

==================== Restore Points  =========================

16-05-2013 03:46:35 Windows Update
24-05-2013 05:37:25 Geplanter Prüfpunkt
02-06-2013 12:57:06 Geplanter Prüfpunkt
10-06-2013 04:15:45 Geplanter Prüfpunkt
12-06-2013 20:12:04 Windows Update
15-06-2013 05:16:09 Windows Update
21-06-2013 22:41:50 Windows Update

==================== Scheduled Tasks (whitelisted) =============

Task: {4686E940-F180-4457-9B3D-E36C0E827C43} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {4ADF09FF-BC48-4C2D-8C56-991833956FBE} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {6D1A49A0-53E9-4CD4-98B6-5FD4A58FB610} - System32\Tasks\UALU notificatin => C:\Program Files\Acer\Acer Updater\UALU.exe [2012-02-06] (Acer Incorporated)
Task: {D5CDD0A6-3186-4B90-AFE6-E249D4DE4C85} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (06/22/2013 08:13:03 AM) (Source: McLogEvent) (User: NT-AUTORITÄT)
Description: A thread in process C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe took longer than 90000 ms to complete a request.

The process will be terminated.
Thread id : 2832 (0xb10)

Thread address : 0x0000000076EC16EA

Thread message : 

 Build VSCORE.15.1.0.520 / 5500.1093
 Object being scanned = \Device\HarddiskVolume4\2012\sommerurlaub 2012\urlaub sommer 2012\1.7.-13.7.NB\CIMG0110.JPG
 by C:\Windows\Explorer.EXE
 7005(0)(0)
 7004(0)(0)
 5006(0)(0)
 5004(0)(0)
 5003(0)(0)
 5002(0)(1)
 15002(0)(0)
 5000(0)(0)

Error: (06/22/2013 08:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (06/22/2013 08:11:59 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/22/2013 08:11:57 AM) (Source: Microsoft-Windows-LoadPerf) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (06/22/2013 07:51:16 AM) (Source: System Restore) (User: )
Description: Die Systemwiederherstellung wurde wegen eines Stromausfalls oder eines Programmfehlers unerwartet beendet. Zusätzliche Informationen: (Geplanter Prüfpunkt).

Error: (06/22/2013 00:40:23 AM) (Source: McLogEvent) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 3

Error: (06/22/2013 00:38:06 AM) (Source: McLogEvent) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 3

Error: (06/22/2013 00:33:55 AM) (Source: McLogEvent) (User: NT-AUTORITÄT)
Description: MCSCAN32 Engine Initialisation failed.
Engine returned error : 3

Error: (06/22/2013 00:24:27 AM) (Source: WinMgmt) (User: )
Description: 0x80041002C:\WINDOWS\SYSTEM32\WBEM\VDS.MOF

Error: (06/22/2013 00:24:27 AM) (Source: WinMgmt) (User: )
Description: 0x80041002C:\WINDOWS\SYSTEM32\WBEM\VSS.MOF


System errors:
=============
Error: (06/22/2013 08:13:06 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee McShield" wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 5000 Millisekunden durchgeführt: Neustart des Diensts.

Error: (06/22/2013 08:12:50 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows-Fehlerberichterstattungsdienst erreicht.

Error: (06/22/2013 08:03:23 AM) (Source: DCOM) (User: )
Description: {752073A1-23F2-4396-85F0-8FDB879ED0ED}

Error: (06/22/2013 07:57:51 AM) (Source: DCOM) (User: )
Description: {209500FC-6B45-4693-8871-6296C4843751}

Error: (06/22/2013 07:57:19 AM) (Source: DCOM) (User: )
Description: {211EBA3A-EA5A-496B-A021-5C6BEB365E4C}

Error: (06/22/2013 07:56:22 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde nicht richtig gestartet.

Error: (06/22/2013 03:11:26 AM) (Source: Microsoft-Windows-Directory-Services-SAM) (User: NT-AUTORITÄT)
Description: Das SAM-Modul konnte den TCP/IP- bzw. SPX/IPX-Listening-Thread nicht starten.

Error: (06/22/2013 03:11:16 AM) (Source: Service Control Manager) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
AFD
DfsC
discache
mfehidk
mwlPSDFilter
mwlPSDNServ
mwlPSDVDisk
NetBIOS
NetBT
nsiproxy
Psched
rdbss
spldr
tdx
vwififlt
Wanarpv6
WfpLwf

Error: (06/22/2013 03:11:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Proxy Service" ist vom Dienst "McAfee Firewall Core Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (06/22/2013 03:11:16 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "McAfee Anti-Spam Service" ist vom Dienst "McAfee Firewall Core Service" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================
Error: (06/22/2013 08:13:03 AM) (Source: McLogEvent)(User: NT-AUTORITÄT)
Description: C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe900002832 (0xb10)0x0000000076EC16EA
 Build VSCORE.15.1.0.520 / 5500.1093
 Object being scanned = \Device\HarddiskVolume4\2012\sommerurlaub 2012\urlaub sommer 2012\1.7.-13.7.NB\CIMG0110.JPG
 by C:\Windows\Explorer.EXE
 7005(0)(0)
 7004(0)(0)
 5006(0)(0)
 5004(0)(0)
 5003(0)(0)
 5002(0)(1)
 15002(0)(0)
 5000(0)(0)

Error: (06/22/2013 08:11:59 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (06/22/2013 08:11:59 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/22/2013 08:11:57 AM) (Source: Microsoft-Windows-LoadPerf)(User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (06/22/2013 07:51:16 AM) (Source: System Restore)(User: )
Description: Geplanter Prüfpunkt

Error: (06/22/2013 00:40:23 AM) (Source: McLogEvent)(User: NT-AUTORITÄT)
Description: 3

Error: (06/22/2013 00:38:06 AM) (Source: McLogEvent)(User: NT-AUTORITÄT)
Description: 3

Error: (06/22/2013 00:33:55 AM) (Source: McLogEvent)(User: NT-AUTORITÄT)
Description: 3

Error: (06/22/2013 00:24:27 AM) (Source: WinMgmt)(User: )
Description: 0x80041002C:\WINDOWS\SYSTEM32\WBEM\VDS.MOF

Error: (06/22/2013 00:24:27 AM) (Source: WinMgmt)(User: )
Description: 0x80041002C:\WINDOWS\SYSTEM32\WBEM\VSS.MOF


==================== Memory info =========================== 

Percentage of memory in use: 20%
Total physical RAM: 8043.86 MB
Available physical RAM: 6375.81 MB
Total Pagefile: 16085.9 MB
Available Pagefile: 13882.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:227.44 GB) (Free:111.69 GB) NTFS (Disk=0 Partition=3)
Drive e: (Volume) (Fixed) (Total:225.22 GB) (Free:186.82 GB) NTFS (Disk=0 Partition=4)
Drive f: () (Removable) (Total:1.88 GB) (Free:1.49 GB) FAT (Disk=1 Partition=1)

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 717CFBDD)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=227 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=225 GB) - (Type=OF Extended)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: 81CB2276)
Partition 1: (Not Active) - (Size=2 GB) - (Type=06)

==================== End Of Log ============================
--- --- ---

SystemLook

SystemLook 30.07.11 by jpshortstuff
Log created at 08:18 on 22/06/2013 by wir
Administrator - Elevation successful

========== filefind ==========

Searching for "*mwfidfkifvuaxytqo*"
C:\FRST\Quarantine\mwfidfkifvuaxytqo.exe --a---- 59904 bytes [20:47 21/06/2013] [20:47 21/06/2013] (Unable to calculate MD5)
C:\Windows\Prefetch\MWFIDFKIFVUAXYTQO.EXE-08947728.pf --a---- 23064 bytes [20:47 21/06/2013] [20:47 21/06/2013] 02C62CE4920DE9073DD327091F5EAD2A

========== reg ==========

[HKEY_CLASSES_ROOT\CLSID\{750fdf0e-2a26-11d1-a3ea-080036587f03}]
(Unable to open key - key not found)

[HKEY_CLASSES_ROOT\CLSID\{750fdf10-2a26-11d1-a3ea-080036587f03}]
(Unable to open key - key not found)

[HKEY_CLASSES_ROOT\CLSID\{28949824-6737-0594-0930-223283753445}]
(Unable to open key - key not found)

========== regfind ==========

Searching for "mwfidfkifvuaxytqo"
No data found.

-= EOF =-

Alt 22.06.2013, 10:43   #14
aharonov
/// TB-Ausbilder
 
GVU-Trojaner - Standard

GVU-Trojaner


Ok, dann weiter:


Schritt 1

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).



Schritt 2

Starte noch einmal FRST.
  • Ändere keine der Voreinstellungen und drücke auf Scan.
  • Wenn der Scan abgeschlossen ist, werden ein neues Logfile FRST.txt erstellt und auf dem Desktop gespeichert.
  • Poste den Inhalt dieses Logfiles bitte hier in deinen Thread.



Bitte poste in deiner nächsten Antwort:
  • Log von AdwCleaner
  • Log von FRST
__________________
cheers,
Leo

Alt 22.06.2013, 12:01   #15
neubrandenbg
 
GVU-Trojaner - Standard

GVU-Trojaner


AdwCleaner Logfile:
Code:
ATTFilter
# AdwCleaner v2.303 - Datei am 22/06/2013 um 16:52:38 erstellt
# Aktualisiert am 08/06/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : wir - WIR-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\wir\Downloads\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****

Datei Gelöscht : C:\Users\wir\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcbhn.lnk
Ordner Gelöscht : C:\Program Files (x86)\BrowserCompanion
Ordner Gelöscht : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB
Ordner Gelöscht : C:\Program Files (x86)\Conduit
Ordner Gelöscht : C:\Program Files (x86)\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\wir\AppData\Local\Conduit
Ordner Gelöscht : C:\Users\wir\AppData\Local\Temp\Smartbar
Ordner Gelöscht : C:\Users\wir\AppData\LocalLow\bbrs_002.tb
Ordner Gelöscht : C:\Users\wir\AppData\LocalLow\Conduit
Ordner Gelöscht : C:\Users\wir\AppData\LocalLow\DVDVideoSoftTB
Ordner Gelöscht : C:\Users\wir\AppData\LocalLow\PriceGong
Ordner Gelöscht : C:\Users\wir\AppData\Roaming\BrowserCompanion
Ordner Gelöscht : C:\Users\wir\AppData\Roaming\dvdvideosoftiehelpers
Ordner Gelöscht : C:\Users\wir\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\wir\AppData\Roaming\pdfforge

***** [Registrierungsdatenbank] *****

Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\SmartBar
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Toolbar
Schlüssel Gelöscht : HKCU\Software\Blabbers
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{00CBB66B-1D3B-46D3-9577-323A336ACB50}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{963B125B-8B21-49A2-A3A8-E37092276531}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00CBB66B-1D3B-46D3-9577-323A336ACB50}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{963B125B-8B21-49A2-A3A8-E37092276531}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\Software\BrowserCompanion
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{20EDC024-43C5-423E-B7F5-FD93523E0D9F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{373ED12D-B306-43AC-9485-A7C5133DC34C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{ED6535E7-F778-48A5-A060-549D30024511}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\tdataprotocol.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\updatebho.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\wit4ie.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\base64
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\chrome
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\prox
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\tdataprotocol.CTData
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\tdataprotocol.CTData.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Toolbar.CT2269050
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{830B56CB-FD22-44AA-9887-7898F4F4158D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{8830DDF0-3042-404D-A62C-384A85E34833}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{955B782E-CDC8-4CEE-B6F6-AD7D541A8D8A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\updatebho.TimerBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\updatebho.TimerBHO.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wit4ie.WitBHO
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\wit4ie.WitBHO.2
Schlüssel Gelöscht : HKLM\Software\Conduit
Schlüssel Gelöscht : HKLM\Software\DVDVideoSoftTB
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00CBB66B-1D3B-46D3-9577-323A336ACB50}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{5ACE96C0-C70A-4A4D-AF14-2E7B869345E1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{963B125B-8B21-49A2-A3A8-E37092276531}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D3F69D07-0AEE-47AF-87D0-1A67D4F70C68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9F0C17EB-EF2C-4278-9136-2D547656BC03}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\bodddioamolcibagionmmobehnbhiakf
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C1EA53FD-8884-4706-B111-D336C1B625A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DED57064-2B4D-4058-8168-59CB5B2C783D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00CBB66B-1D3B-46D3-9577-323A336ACB50}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{872B5B88-9DB5-4310-BDD0-AC189557E5F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{963B125B-8B21-49A2-A3A8-E37092276531}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BrowserCompanion
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DVDVideoSoftTB Toolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{817923CB-4744-4216-B250-CF7EDA8F1767}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9F0C17EB-EF2C-4278-9136-2D547656BC03}
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{872B5B88-9DB5-4310-BDD0-AC189557E5F5}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16618

Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Page] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Main - Search Bar] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - Default_Search_URL] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\Search - SearchAssistant] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKCU\Software\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms} --> hxxp://www.google.com
Ersetzt : [HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchUrl - Default] = hxxp://feed.snap.do/?publisher=SnapdoOpenCandy&dpid=SnapdoOpenCandy&co=DE&userid=a14a8376-825f-42e0-bfad-de7db5dbfebf&searchtype=ds&q={searchTerms} --> hxxp://www.google.com

*************************

AdwCleaner[S1].txt - [9346 octets] - [22/06/2013 16:52:38]

########## EOF - C:\AdwCleaner[S1].txt - [9406 octets] ##########
--- --- ---







Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-06-2013 02
Ran by wir (administrator) on 22-06-2013 16:56:36
Running from C:\Users\wir\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Egis Technology Inc. ) C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\dsiwmis.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMworker.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps32.exe
(Acer Incorporated) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
(McAfee, Inc.) C:\Windows\system32\mfevtps.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe
(Acer Incorporated) C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(NTI Corporation) C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc. ) C:\Program Files\Acer ProShield\EgisTSR.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LManager.exe
(Garmin) C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe
(McAfee, Inc.) C:\Program Files\McAfee.com\Agent\mcagent.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\MMDx64Fx.exe
(Dritek System Inc.) C:\Program Files (x86)\Launch Manager\LMutilps.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer ePower Management\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil64_11_7_700_224_ActiveX.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IntelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-10-08] ()
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2697512 2011-02-17] (Synaptics Incorporated)
HKLM\...\Run: [ProShieldTSR] "C:\Program Files\Acer ProShield\EgisTSR.exe" /run [165936 2011-06-04] (Egis Technology Inc. )
HKLM\...\Run: [Power Management] C:\Program Files\Acer\Acer ePower Management\ePowerTray.exe [1831528 2011-05-10] (Acer Incorporated)
HKLM-x32\...\Run: [Norton Online Backup] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BackupManagerTray] "C:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe" -h -k [297280 2011-04-24] (NTI Corporation)
HKLM-x32\...\Run: [LManager] C:\Program Files (x86)\Launch Manager\LManager.exe [1110096 2011-07-01] (Dritek System Inc.)
HKLM-x32\...\Run: [Garmin Lifetime Updater] C:\Program Files (x86)\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized [1466760 2012-05-23] (Garmin)
HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1532992 2013-03-13] (McAfee, Inc.)
HKU\Default\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-13] ()
HKU\Default User\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-13] ()
HKU\UpdatusUser\...\RunOnce: [ScrSav] C:\Program Files (x86)\Acer\Screensaver\run_Acer.exe /default [162408 2011-09-13] ()
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-09-08] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-09-08] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli EgisPwdFilter EgisDSPwdFilter
Startup: C:\ProgramData\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files (x86)\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
Startup: C:\ProgramData\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.web.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
SearchScopes: HKCU - {6430093D-4C69-4A4D-8D13-8B679258870F} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050&SSPV=IEAUTOBR
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: EgisPBIE Sign-in Helper - {7B51CCBE-4AF9-44A6-BDAB-D7F7E4C4E6F9} - C:\Program Files\Acer ProShield\x86\EgisPBIE.dll (Egis Technology Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: msdaipp - No CLSID Value -
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: msdaipp - No CLSID Value -
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - C:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\PROGRA~1\mcafee\msc\MCSNIE~1.DLL (McAfee, Inc.)
Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - C:\PROGRA~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 83.169.184.161 83.169.184.225

==================== Services (Whitelisted) =================

R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
R2 EgisTec Ticket Service; C:\Program Files\Common Files\EgisTec\Services\EgisTicketService.exe [212016 2011-06-04] (Egis Technology Inc. )
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241456 2013-02-19] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-02-19] (McAfee, Inc.)
R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-02-19] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 NTI IScheduleSvc; C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe [256832 2011-04-24] (NTI Corporation)
R2 RS_Service; C:\Program Files (x86)\Acer\Acer VCM\RS_Service.exe [260640 2010-01-30] (Acer Incorporated)

==================== Drivers (Whitelisted) ====================

R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [249152 2011-09-08] (NVIDIA Corporation)
U3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-06-22 17:09 - 2013-06-22 17:09 - 00000000 ____D C:\FRST
2013-06-22 16:55 - 2013-06-22 16:55 - 00009465 ____A C:\Users\wir\Desktop\AdwCleaner[S1].txt
2013-06-22 16:52 - 2013-06-22 16:53 - 00009465 ____A C:\AdwCleaner[S1].txt
2013-06-22 16:51 - 2013-06-22 16:52 - 00648201 ____A C:\Users\wir\Downloads\adwcleaner.exe
2013-06-22 08:28 - 2013-06-22 08:32 - 00016356 ____A C:\Users\wir\Desktop\Addition.txt
2013-06-22 08:18 - 2013-06-22 08:35 - 00001814 ____A C:\Users\wir\Desktop\SystemLook.txt
2013-06-22 08:17 - 2013-06-22 04:06 - 00165376 ____A C:\Users\wir\Desktop\SystemLook_x64.exe
2013-06-22 08:14 - 2013-06-22 03:05 - 01930924 ____A (Farbar) C:\Users\wir\Desktop\FRST64.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-22 00:43 - 2013-06-22 00:48 - 00010370 ____A C:\Windows\IE10_main.log
2013-06-21 22:47 - 2013-06-21 22:47 - 00000000 ____D C:\Windows\Sun
2013-06-15 13:45 - 2013-06-15 13:45 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-06-12 05:42 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-12 05:42 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-12 05:42 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-12 05:42 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-12 05:42 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 05:42 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 05:42 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 05:42 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-12 05:42 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 05:42 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 05:42 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-12 05:42 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 05:42 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-12 05:42 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll
2013-06-12 05:42 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 05:42 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 05:42 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 05:42 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-06-12 05:42 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-06-09 13:49 - 2013-06-09 13:49 - 00000000 ____D C:\Users\wir\AppData\Local\{D44E6AC6-2F2C-437B-A768-A250149EACE6}
2013-06-04 19:28 - 2013-06-04 19:28 - 00000000 ____D C:\Users\wir\AppData\Local\{0E0B81E1-02BB-4D6D-AEA6-4E4492539E1C}
2013-05-23 13:49 - 2013-05-23 13:53 - 817828157 ____A C:\Users\wir\Downloads\Hoerspiel.zip
2013-05-23 13:44 - 2013-05-23 13:46 - 356529855 ____A C:\Users\wir\Downloads\Bilder.zip

==================== One Month Modified Files and Folders =======

2013-06-22 17:09 - 2013-06-22 17:09 - 00000000 ____D C:\FRST
2013-06-22 16:55 - 2013-06-22 16:55 - 00009465 ____A C:\Users\wir\Desktop\AdwCleaner[S1].txt
2013-06-22 16:54 - 2012-03-14 19:21 - 00000000 ____D C:\ProgramData\NVIDIA
2013-06-22 16:54 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-06-22 16:54 - 2009-07-14 06:51 - 00085029 ____A C:\Windows\setupact.log
2013-06-22 16:53 - 2013-06-22 16:52 - 00009465 ____A C:\AdwCleaner[S1].txt
2013-06-22 16:53 - 2012-03-14 19:14 - 01096362 ____A C:\Windows\WindowsUpdate.log
2013-06-22 16:52 - 2013-06-22 16:51 - 00648201 ____A C:\Users\wir\Downloads\adwcleaner.exe
2013-06-22 16:47 - 2012-10-07 10:06 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-06-22 12:50 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-06-22 12:50 - 2009-07-14 06:45 - 00016752 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-06-22 12:47 - 2012-03-15 04:08 - 03348024 ____A C:\Windows\System32\perfh007.dat
2013-06-22 12:47 - 2012-03-15 04:08 - 00992394 ____A C:\Windows\System32\perfc007.dat
2013-06-22 12:47 - 2009-07-14 07:13 - 00005414 ____A C:\Windows\System32\PerfStringBackup.INI
2013-06-22 08:35 - 2013-06-22 08:18 - 00001814 ____A C:\Users\wir\Desktop\SystemLook.txt
2013-06-22 08:32 - 2013-06-22 08:28 - 00016356 ____A C:\Users\wir\Desktop\Addition.txt
2013-06-22 04:06 - 2013-06-22 08:17 - 00165376 ____A C:\Users\wir\Desktop\SystemLook_x64.exe
2013-06-22 03:05 - 2013-06-22 08:14 - 01930924 ____A (Farbar) C:\Users\wir\Desktop\FRST64.exe
2013-06-22 01:01 - 2012-10-27 21:16 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-06-22 01:00 - 2010-11-21 05:47 - 00023508 ____A C:\Windows\PFRO.log
2013-06-22 01:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-06-22 00:48 - 2013-06-22 00:43 - 00010370 ____A C:\Windows\IE10_main.log
2013-06-22 00:44 - 2013-06-22 00:44 - 19233792 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-22 00:44 - 2013-06-22 00:44 - 02648064 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-06-22 00:44 - 2013-06-22 00:44 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-06-22 00:44 - 2013-06-22 00:44 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-06-22 00:44 - 2013-06-22 00:44 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-06-22 00:44 - 2013-06-22 00:44 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-06-22 00:44 - 2013-06-22 00:44 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-06-21 22:47 - 2013-06-21 22:47 - 00000000 ____D C:\Windows\Sun

Guten Morgen ... :-)

Antwort
Seite 1 von 2 1 2

Themen zu GVU-Trojaner
abgesicherte, abgesicherten, abgesicherten modus funktioniert, arten, daten, funktionier, funktioniert, interne, internet, kaspersky, modus, network, neu, prüfen, rechner, scan, scanne, scannen, sichern, sicherung, starte, starten, system, system neu, verbindung, würde, überhaupt


« 2 Trojaner mit Kaspersky gefunden | Frage zu "unbekanntes Element gefunden" »


Zum Thema GVU-Trojaner - Hallo, ich habe mir den GVU-Trojaner eingefangen. Das Starten aus dem abgesicherten Modus funktioniert überhaupt nicht und die Kaspersky Rettungs-CD (WindowsUnlocker) nimmt er nicht an. Das Scannen des nicht bootbares - GVU-Trojaner...
Archiv
Du betrachtest: GVU-Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131