| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
| |
11.07.2013, 00:29
| #1 |
| |  GVU Trojaner entfernen Mich hat nun auch der GVU Trojaner erwischt. Bisher habe ich eine Systemwiederherstellung durchgeführt. Nun habe ich auch schon FRST runtergeladen und den scan durchlaufen lassen. Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 03
Ran by Alex (administrator) on 11-07-2013 01:20:36
Running from C:\Users\Alex\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AkkuLine.de) C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Wistron) C:\Program Files (x86)\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WButton.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
() C:\Program Files (x86)\watchmi\TvdTray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\Windows-KB890830-x64-V4.22-delta.exe
(Microsoft Corporation) c:\6a7eb5229b1d107940c810\mrtstub.exe
(Microsoft Corporation) C:\Windows\system32\MRT.exe
() C:\Program Files (x86)\Google\Update\Install\{CBCDA0CF-F116-451A-84A0-B46056B6177E}\28.0.1500.71_27.0.1453.116_chrome_updater.exe
(Google Inc.) C:\Windows\TEMP\CR_A4F81.tmp\setup.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2012-01-23] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392984 2012-01-23] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [417560 2012-01-23] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [IntelPAN] - "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PAN Tray [1935120 2011-11-01] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [10358784 2011-11-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2294568 2010-09-03] (Synaptics Incorporated)
HKLM\...\Run: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe [443688 2011-05-26] (CyberLink)
HKLM\...\Run: [XboxStat] - "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [ALBATTTOOL] - C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe [408576 2010-10-05] (AkkuLine.de)
HKCU\...\Run: [GoogleDriveSync] - "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
HKCU\...\Run: [rfxsrvtray] - "C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe" [1838872 2013-02-07] (Tobit.Software)
MountPoints2: F - F:\AutoRun.exe
MountPoints2: {4130f1db-6799-11e2-9962-00262dc8ba66} - F:\AutoRun.exe
MountPoints2: {4130f1e0-6799-11e2-9962-00262dc8ba66} - F:\AutoRun.exe
MountPoints2: {574cedd7-9226-11e2-8a69-8fb0582a2b0a} - F:\AutoRun.exe
MountPoints2: {73baa2a3-95f7-11e2-be04-fd369ad93e31} - F:\AutoRun.exe
MountPoints2: {7cbfe660-c54e-11e2-8d67-b84a0dd0481d} - F:\AutoRun.exe
MountPoints2: {7cbfe662-c54e-11e2-8d67-b84a0dd0481d} - F:\AutoRun.exe
MountPoints2: {ff783e2b-6616-11e2-a0a3-00262dc8ba66} - F:\AutoRun.exe
MountPoints2: {ff783e2e-6616-11e2-a0a3-00262dc8ba66} - F:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-30] (Intel Corporation)
HKLM-x32\...\Run: [HotkeyApp] - "C:\Program Files (x86)\Launch Manager\HotkeyApp.exe" [207400 2011-08-06] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] - "C:\Program Files (x86)\Launch Manager\OSD.exe" [348960 2011-08-06] (Wistron Corp.)
HKLM-x32\...\Run: [LMgrOSD] - "C:\Program Files (x86)\Launch Manager\OSDCtrl.exe" [x]
HKLM-x32\...\Run: [Wbutton] - "C:\Program Files (x86)\Launch Manager\Wbutton.exe" [447016 2011-08-13] (Wistron Corp.)
HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [417792 2009-11-10] (Apple Inc.)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-10-17] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll [203072 2011-10-17] (NVIDIA Corporation)
Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\watchmi tray.lnk
ShortcutTarget: watchmi tray.lnk -> C:\Windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe (Acresso Software Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKLM-x32 SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKCU SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Chrome:
=======
CHR HomePage: https://www.facebook.com/
CHR Extension: (Google Docs) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$JTLWAWI; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-11-01] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2011-08-06] (Wistron Corp.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
S3 L1C; system32\DRIVERS\L1C62x64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 01:22 - 2013-07-11 01:22 - 00000000 ____D C:\601465059afd4d4526
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:25 - 2013-07-11 00:25 - 00393515 ____A C:\Users\Alex\AppData\Roaming\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393476 ____A C:\ProgramData\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-10 23:10 - 2013-07-10 23:10 - 00000000 ____D C:\Users\Alex\AppData\Local\{CDAED6EA-EF05-4273-92A8-B988E72A808E}
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 23:17 - 2012-08-07 18:01 - 03363840 ____A C:\Users\Alex\Downloads\EPortoInstaller2010_x64_v2.3.msi
2013-07-02 23:17 - 2012-08-07 18:01 - 00436736 ____A () C:\Users\Alex\Downloads\setup.exe
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-28 18:15 - 2013-04-29 20:00 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll
2013-06-28 18:15 - 2013-03-17 18:21 - 03649536 ____A (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2013-06-28 18:15 - 2012-06-09 19:21 - 00178688 ____A C:\Windows\SysWOW64\unrar.dll
2013-06-28 18:15 - 2011-12-21 19:14 - 00151552 ____A (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2013-06-28 18:15 - 2011-12-07 19:32 - 00216064 ____A ( ) C:\Windows\SysWOW64\lagarith.dll
2013-06-28 18:15 - 2011-06-24 16:44 - 00243200 ____A C:\Windows\SysWOW64\xvidvfw.dll
2013-06-28 18:15 - 2011-06-24 16:28 - 00650752 ____A C:\Windows\SysWOW64\xvidcore.dll
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:45 - 2013-06-28 14:56 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-28 14:33 - 2013-06-28 14:33 - 00000000 ____D C:\Users\Alex\AppData\Local\{D90D2822-2C49-4EDC-939A-E6A2FCE99A5B}
2013-06-26 21:48 - 2013-06-26 21:48 - 00000000 ____D C:\Users\Alex\AppData\Local\{A5F2B2AE-C423-4C9A-945C-03CF1F2B8211}
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-22 21:31 - 2013-06-22 21:31 - 00000000 ____D C:\Users\Alex\AppData\Local\{93976971-496C-4469-91E7-7D8208CBF866}
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXSUnins.exe
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXCUnins.exe
2013-06-19 21:01 - 2013-06-19 21:02 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-18 06:48 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-18 06:48 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-18 06:48 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-18 06:48 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-18 06:48 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-18 06:48 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-18 06:47 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-18 06:47 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-18 06:47 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-18 06:47 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-18 06:47 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-18 06:47 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-06-18 06:47 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-18 06:47 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{D147665A-6E74-4B2E-BE80-FA8F513EC956}
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{256DFA64-9487-4BDE-AD4D-F956536D26F9}
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:46 - 2010-02-10 14:26 - 00233472 ____A (FUJIFILM Corporation) C:\Windows\SysWOW64\RFCLauncher.exe
2013-06-14 20:46 - 2006-07-12 14:39 - 00208896 ____A (FUJI PHOTO FILM CO., LTD.) C:\Windows\SysWOW64\FFRafShellEx.dll
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-12 19:51 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 19:50 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 19:50 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 19:50 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 19:50 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 19:50 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 19:50 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 19:50 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-06-11 21:35 - 2013-06-11 21:36 - 26919963 ____A C:\Users\Alex\Downloads\Facebook Insights Data Export - VfL Sportfreunde Lotte - 2013-06-11.xls
==================== One Month Modified Files and Folders =======
2013-07-11 01:22 - 2013-07-11 01:22 - 00000000 ____D C:\601465059afd4d4526
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:19 - 2013-04-05 12:30 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:13 - 2011-07-18 22:31 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2012-12-22 19:59 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-11 01:05 - 2011-05-16 16:04 - 00755150 ____A C:\Windows\system32\perfh007.dat
2013-07-11 01:05 - 2011-05-16 16:04 - 00172652 ____A C:\Windows\system32\perfc007.dat
2013-07-11 01:05 - 2009-07-14 07:13 - 01786802 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:58 - 2012-12-24 00:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 00:57 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 00:57 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 00:54 - 2012-12-22 18:00 - 01919777 ____A C:\Windows\WindowsUpdate.log
2013-07-11 00:53 - 2012-12-22 18:12 - 00000000 ____D C:\Users\Alex\Documents\Youcam
2013-07-11 00:51 - 2013-04-20 22:19 - 00000000 ___SD C:\Users\Alex\Google Drive
2013-07-11 00:49 - 2013-04-05 12:30 - 00001102 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-11 00:49 - 2012-12-22 18:09 - 00000000 ____D C:\Users\Alex
2013-07-11 00:48 - 2013-04-06 19:21 - 00004743 ____A C:\Windows\setupact.log
2013-07-11 00:48 - 2012-03-20 00:34 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-11 00:48 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 00:48 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ____D C:\Windows\ShellNew
2013-07-11 00:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 00:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-07-11 00:46 - 2013-02-06 16:12 - 00000000 ____D C:\Users\Alex\Desktop\SF Lotte
2013-07-11 00:46 - 2013-01-03 21:58 - 00000000 ____D C:\Users\Alex\AppData\Roaming\SoftGrid Client
2013-07-11 00:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-11 00:45 - 2013-01-03 22:03 - 00000000 __RHD C:\MSOCache
2013-07-11 00:37 - 2013-01-14 15:40 - 00511488 __ASH C:\Users\Alex\Desktop\Thumbs.db
2013-07-11 00:25 - 2013-07-11 00:25 - 00393515 ____A C:\Users\Alex\AppData\Roaming\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393476 ____A C:\ProgramData\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-10 23:10 - 2013-07-10 23:10 - 00000000 ____D C:\Users\Alex\AppData\Local\{CDAED6EA-EF05-4273-92A8-B988E72A808E}
2013-07-10 00:13 - 2013-01-03 15:15 - 02310650 ____A C:\Users\Alex\Desktop\Gewerbe.mmb
2013-07-10 00:05 - 2013-01-15 16:21 - 00000000 ____D C:\Users\Alex\Desktop\backup_Gewerbe
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-03 07:47 - 2013-01-03 21:57 - 01742704 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-02 23:50 - 2013-01-03 11:22 - 01412608 ____A C:\Users\Alex\Documents\Meine Konten.stb
2013-07-02 23:48 - 2013-01-15 18:20 - 00001566 ____A C:\Users\Alex\AppData\Roaming\MyMicroBalanceConfig.ini
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 22:52 - 2013-05-14 09:04 - 00000432 ____A C:\Windows\BRWMARK.INI
2013-07-02 15:49 - 2013-01-30 17:59 - 00003922 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{E54F740F-F5C3-4B29-8CA5-7D6D529AF5AD}
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 22:55 - 2013-03-21 22:34 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Audacity
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-29 10:31 - 2013-04-07 13:43 - 00007748 ____A C:\Windows\PFRO.log
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 17:53 - 2013-03-24 18:19 - 00000000 ____D C:\Users\Alex\Documents\Any Video Converter
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:05 - 2013-04-06 22:19 - 00000000 ____D C:\Users\Alex\AppData\Roaming\OpenCandy
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:56 - 2013-06-28 14:45 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-28 14:33 - 2013-06-28 14:33 - 00000000 ____D C:\Users\Alex\AppData\Local\{D90D2822-2C49-4EDC-939A-E6A2FCE99A5B}
2013-06-26 21:48 - 2013-06-26 21:48 - 00000000 ____D C:\Users\Alex\AppData\Local\{A5F2B2AE-C423-4C9A-945C-03CF1F2B8211}
2013-06-26 17:05 - 2013-01-03 15:13 - 00000000 ____D C:\Users\Alex\Desktop\Ebay Bilder
2013-06-25 10:27 - 2013-05-07 20:27 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:33 - 2012-03-20 17:24 - 00000000 ____D C:\ProgramData\CyberLink
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-22 21:31 - 2013-06-22 21:31 - 00000000 ____D C:\Users\Alex\AppData\Local\{93976971-496C-4469-91E7-7D8208CBF866}
2013-06-21 17:12 - 2013-04-05 12:30 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-19 23:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:03 - 2012-12-23 13:29 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Tobit
2013-06-19 21:02 - 2013-06-19 21:01 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{D147665A-6E74-4B2E-BE80-FA8F513EC956}
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{256DFA64-9487-4BDE-AD4D-F956536D26F9}
2013-06-14 20:53 - 2012-12-22 18:10 - 00096944 ____A C:\Users\Alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-11 22:09 - 2012-12-22 19:59 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:09 - 2012-12-22 19:59 - 00003822 ____A C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-06-11 22:09 - 2011-12-01 23:26 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 21:36 - 2013-06-11 21:35 - 26919963 ____A C:\Users\Alex\Downloads\Facebook Insights Data Export - VfL Sportfreunde Lotte - 2013-06-11.xls
2013-06-11 20:43 - 2013-01-23 23:04 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Origin
2013-06-11 20:43 - 2013-01-23 23:02 - 00000000 ____D C:\ProgramData\Origin
2013-06-11 20:40 - 2013-01-23 23:04 - 00000000 ____D C:\Users\Alex\AppData\Local\Origin
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-25 11:31
==================== End Of Log ============================
Addition: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 03
Ran by Alex (administrator) on 11-07-2013 01:20:36
Running from C:\Users\Alex\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AkkuLine.de) C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Wistron) C:\Program Files (x86)\Launch Manager\HotkeyApp.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WButton.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
() C:\Program Files (x86)\watchmi\TvdTray.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avcenter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avscan.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\Windows-KB890830-x64-V4.22-delta.exe
(Microsoft Corporation) c:\6a7eb5229b1d107940c810\mrtstub.exe
(Microsoft Corporation) C:\Windows\system32\MRT.exe
() C:\Program Files (x86)\Google\Update\Install\{CBCDA0CF-F116-451A-84A0-B46056B6177E}\28.0.1500.71_27.0.1453.116_chrome_updater.exe
(Google Inc.) C:\Windows\TEMP\CR_A4F81.tmp\setup.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2012-01-23] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392984 2012-01-23] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [417560 2012-01-23] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [IntelPAN] - "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PAN Tray [1935120 2011-11-01] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [10358784 2011-11-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2294568 2010-09-03] (Synaptics Incorporated)
HKLM\...\Run: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe [443688 2011-05-26] (CyberLink)
HKLM\...\Run: [XboxStat] - "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [ALBATTTOOL] - C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe [408576 2010-10-05] (AkkuLine.de)
HKCU\...\Run: [GoogleDriveSync] - "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
HKCU\...\Run: [rfxsrvtray] - "C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe" [1838872 2013-02-07] (Tobit.Software)
MountPoints2: F - F:\AutoRun.exe
MountPoints2: {4130f1db-6799-11e2-9962-00262dc8ba66} - F:\AutoRun.exe
MountPoints2: {4130f1e0-6799-11e2-9962-00262dc8ba66} - F:\AutoRun.exe
MountPoints2: {574cedd7-9226-11e2-8a69-8fb0582a2b0a} - F:\AutoRun.exe
MountPoints2: {73baa2a3-95f7-11e2-be04-fd369ad93e31} - F:\AutoRun.exe
MountPoints2: {7cbfe660-c54e-11e2-8d67-b84a0dd0481d} - F:\AutoRun.exe
MountPoints2: {7cbfe662-c54e-11e2-8d67-b84a0dd0481d} - F:\AutoRun.exe
MountPoints2: {ff783e2b-6616-11e2-a0a3-00262dc8ba66} - F:\AutoRun.exe
MountPoints2: {ff783e2e-6616-11e2-a0a3-00262dc8ba66} - F:\AutoRun.exe
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-30] (Intel Corporation)
HKLM-x32\...\Run: [HotkeyApp] - "C:\Program Files (x86)\Launch Manager\HotkeyApp.exe" [207400 2011-08-06] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] - "C:\Program Files (x86)\Launch Manager\OSD.exe" [348960 2011-08-06] (Wistron Corp.)
HKLM-x32\...\Run: [LMgrOSD] - "C:\Program Files (x86)\Launch Manager\OSDCtrl.exe" [x]
HKLM-x32\...\Run: [Wbutton] - "C:\Program Files (x86)\Launch Manager\Wbutton.exe" [447016 2011-08-13] (Wistron Corp.)
HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [417792 2009-11-10] (Apple Inc.)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-10-17] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll [203072 2011-10-17] (NVIDIA Corporation)
Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Start Menu\Programs\Startup\watchmi tray.lnk
ShortcutTarget: watchmi tray.lnk -> C:\Windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe (Acresso Software Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKLM-x32 SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKLM-x32 - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKCU SearchScopes: DefaultScope {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
SearchScopes: HKCU - {006ee092-9658-4fd6-bd8e-a21a348e59f5} URL = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GmbH)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Chrome:
=======
CHR HomePage: https://www.facebook.com/
CHR Extension: (Google Docs) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$JTLWAWI; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-11-01] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2011-08-06] (Wistron Corp.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
S3 L1C; system32\DRIVERS\L1C62x64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 01:22 - 2013-07-11 01:22 - 00000000 ____D C:\601465059afd4d4526
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:25 - 2013-07-11 00:25 - 00393515 ____A C:\Users\Alex\AppData\Roaming\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393476 ____A C:\ProgramData\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-10 23:10 - 2013-07-10 23:10 - 00000000 ____D C:\Users\Alex\AppData\Local\{CDAED6EA-EF05-4273-92A8-B988E72A808E}
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 23:17 - 2012-08-07 18:01 - 03363840 ____A C:\Users\Alex\Downloads\EPortoInstaller2010_x64_v2.3.msi
2013-07-02 23:17 - 2012-08-07 18:01 - 00436736 ____A () C:\Users\Alex\Downloads\setup.exe
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-28 18:15 - 2013-04-29 20:00 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll
2013-06-28 18:15 - 2013-03-17 18:21 - 03649536 ____A (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2013-06-28 18:15 - 2012-06-09 19:21 - 00178688 ____A C:\Windows\SysWOW64\unrar.dll
2013-06-28 18:15 - 2011-12-21 19:14 - 00151552 ____A (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2013-06-28 18:15 - 2011-12-07 19:32 - 00216064 ____A ( ) C:\Windows\SysWOW64\lagarith.dll
2013-06-28 18:15 - 2011-06-24 16:44 - 00243200 ____A C:\Windows\SysWOW64\xvidvfw.dll
2013-06-28 18:15 - 2011-06-24 16:28 - 00650752 ____A C:\Windows\SysWOW64\xvidcore.dll
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:45 - 2013-06-28 14:56 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-28 14:33 - 2013-06-28 14:33 - 00000000 ____D C:\Users\Alex\AppData\Local\{D90D2822-2C49-4EDC-939A-E6A2FCE99A5B}
2013-06-26 21:48 - 2013-06-26 21:48 - 00000000 ____D C:\Users\Alex\AppData\Local\{A5F2B2AE-C423-4C9A-945C-03CF1F2B8211}
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-22 21:31 - 2013-06-22 21:31 - 00000000 ____D C:\Users\Alex\AppData\Local\{93976971-496C-4469-91E7-7D8208CBF866}
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXSUnins.exe
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXCUnins.exe
2013-06-19 21:01 - 2013-06-19 21:02 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-18 06:48 - 2013-05-17 03:25 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-18 06:48 - 2013-05-17 03:25 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-18 06:48 - 2013-05-17 02:59 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-18 06:48 - 2013-05-17 02:59 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-18 06:48 - 2013-05-17 02:58 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-18 06:48 - 2013-05-17 02:58 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-18 06:48 - 2013-05-14 14:23 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-18 06:48 - 2013-05-14 10:40 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-18 06:47 - 2013-06-08 16:08 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-18 06:47 - 2013-06-08 16:07 - 19233792 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-18 06:47 - 2013-06-08 16:06 - 15404544 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-18 06:47 - 2013-06-08 16:06 - 02648064 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-18 06:47 - 2013-06-08 16:06 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-18 06:47 - 2013-06-08 14:28 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-06-18 06:47 - 2013-06-08 13:42 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 14327808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-18 06:47 - 2013-06-08 13:40 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-18 06:47 - 2013-06-08 13:13 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{D147665A-6E74-4B2E-BE80-FA8F513EC956}
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{256DFA64-9487-4BDE-AD4D-F956536D26F9}
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:46 - 2010-02-10 14:26 - 00233472 ____A (FUJIFILM Corporation) C:\Windows\SysWOW64\RFCLauncher.exe
2013-06-14 20:46 - 2006-07-12 14:39 - 00208896 ____A (FUJI PHOTO FILM CO., LTD.) C:\Windows\SysWOW64\FFRafShellEx.dll
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-12 19:51 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 19:50 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 19:50 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 19:50 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 19:50 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 19:50 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 19:50 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 19:50 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-06-11 21:35 - 2013-06-11 21:36 - 26919963 ____A C:\Users\Alex\Downloads\Facebook Insights Data Export - VfL Sportfreunde Lotte - 2013-06-11.xls
==================== One Month Modified Files and Folders =======
2013-07-11 01:22 - 2013-07-11 01:22 - 00000000 ____D C:\601465059afd4d4526
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:19 - 2013-04-05 12:30 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:13 - 2011-07-18 22:31 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2012-12-22 19:59 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-11 01:05 - 2011-05-16 16:04 - 00755150 ____A C:\Windows\system32\perfh007.dat
2013-07-11 01:05 - 2011-05-16 16:04 - 00172652 ____A C:\Windows\system32\perfc007.dat
2013-07-11 01:05 - 2009-07-14 07:13 - 01786802 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:58 - 2012-12-24 00:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 00:57 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 00:57 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 00:54 - 2012-12-22 18:00 - 01919777 ____A C:\Windows\WindowsUpdate.log
2013-07-11 00:53 - 2012-12-22 18:12 - 00000000 ____D C:\Users\Alex\Documents\Youcam
2013-07-11 00:51 - 2013-04-20 22:19 - 00000000 ___SD C:\Users\Alex\Google Drive
2013-07-11 00:49 - 2013-04-05 12:30 - 00001102 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-11 00:49 - 2012-12-22 18:09 - 00000000 ____D C:\Users\Alex
2013-07-11 00:48 - 2013-04-06 19:21 - 00004743 ____A C:\Windows\setupact.log
2013-07-11 00:48 - 2012-03-20 00:34 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-11 00:48 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 00:48 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ____D C:\Windows\ShellNew
2013-07-11 00:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 00:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-07-11 00:46 - 2013-02-06 16:12 - 00000000 ____D C:\Users\Alex\Desktop\SF Lotte
2013-07-11 00:46 - 2013-01-03 21:58 - 00000000 ____D C:\Users\Alex\AppData\Roaming\SoftGrid Client
2013-07-11 00:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-11 00:45 - 2013-01-03 22:03 - 00000000 __RHD C:\MSOCache
2013-07-11 00:37 - 2013-01-14 15:40 - 00511488 __ASH C:\Users\Alex\Desktop\Thumbs.db
2013-07-11 00:25 - 2013-07-11 00:25 - 00393515 ____A C:\Users\Alex\AppData\Roaming\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-11 00:25 - 2013-07-11 00:25 - 00393476 ____A C:\ProgramData\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-10 23:10 - 2013-07-10 23:10 - 00000000 ____D C:\Users\Alex\AppData\Local\{CDAED6EA-EF05-4273-92A8-B988E72A808E}
2013-07-10 00:13 - 2013-01-03 15:15 - 02310650 ____A C:\Users\Alex\Desktop\Gewerbe.mmb
2013-07-10 00:05 - 2013-01-15 16:21 - 00000000 ____D C:\Users\Alex\Desktop\backup_Gewerbe
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-03 07:47 - 2013-01-03 21:57 - 01742704 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-02 23:50 - 2013-01-03 11:22 - 01412608 ____A C:\Users\Alex\Documents\Meine Konten.stb
2013-07-02 23:48 - 2013-01-15 18:20 - 00001566 ____A C:\Users\Alex\AppData\Roaming\MyMicroBalanceConfig.ini
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 22:52 - 2013-05-14 09:04 - 00000432 ____A C:\Windows\BRWMARK.INI
2013-07-02 15:49 - 2013-01-30 17:59 - 00003922 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{E54F740F-F5C3-4B29-8CA5-7D6D529AF5AD}
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 22:55 - 2013-03-21 22:34 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Audacity
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-29 10:31 - 2013-04-07 13:43 - 00007748 ____A C:\Windows\PFRO.log
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 17:53 - 2013-03-24 18:19 - 00000000 ____D C:\Users\Alex\Documents\Any Video Converter
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:05 - 2013-04-06 22:19 - 00000000 ____D C:\Users\Alex\AppData\Roaming\OpenCandy
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:56 - 2013-06-28 14:45 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-28 14:33 - 2013-06-28 14:33 - 00000000 ____D C:\Users\Alex\AppData\Local\{D90D2822-2C49-4EDC-939A-E6A2FCE99A5B}
2013-06-26 21:48 - 2013-06-26 21:48 - 00000000 ____D C:\Users\Alex\AppData\Local\{A5F2B2AE-C423-4C9A-945C-03CF1F2B8211}
2013-06-26 17:05 - 2013-01-03 15:13 - 00000000 ____D C:\Users\Alex\Desktop\Ebay Bilder
2013-06-25 10:27 - 2013-05-07 20:27 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:33 - 2012-03-20 17:24 - 00000000 ____D C:\ProgramData\CyberLink
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-22 21:31 - 2013-06-22 21:31 - 00000000 ____D C:\Users\Alex\AppData\Local\{93976971-496C-4469-91E7-7D8208CBF866}
2013-06-21 17:12 - 2013-04-05 12:30 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-06-19 23:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:03 - 2012-12-23 13:29 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Tobit
2013-06-19 21:02 - 2013-06-19 21:01 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{D147665A-6E74-4B2E-BE80-FA8F513EC956}
2013-06-15 12:44 - 2013-06-15 12:44 - 00000000 ____D C:\Users\Alex\AppData\Local\{256DFA64-9487-4BDE-AD4D-F956536D26F9}
2013-06-14 20:53 - 2012-12-22 18:10 - 00096944 ____A C:\Users\Alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-11 22:09 - 2012-12-22 19:59 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:09 - 2012-12-22 19:59 - 00003822 ____A C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-06-11 22:09 - 2011-12-01 23:26 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 21:36 - 2013-06-11 21:35 - 26919963 ____A C:\Users\Alex\Downloads\Facebook Insights Data Export - VfL Sportfreunde Lotte - 2013-06-11.xls
2013-06-11 20:43 - 2013-01-23 23:04 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Origin
2013-06-11 20:43 - 2013-01-23 23:02 - 00000000 ____D C:\ProgramData\Origin
2013-06-11 20:40 - 2013-01-23 23:04 - 00000000 ____D C:\Users\Alex\AppData\Local\Origin
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-25 11:31
==================== End Of Log ============================
Danke schonmal im vorraus. |
|
11.07.2013, 03:37
| #2 | |
| /// the machine /// TB-Ausbilder    | GVU Trojaner entfernen hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
11.07.2013, 07:10
| #3 |
| | GVU Trojaner entfernenCode:
ATTFilter ComboFix 13-07-09.01 - Alex 11.07.2013 7:39.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4002.1853 [GMT 2:00]
ausgeführt von:: c:\users\Alex\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\2433f433
c:\programdata\Roaming
c:\users\Alex\4.0
c:\users\Alex\AppData\Local\Temp\_MEI50082\_ctypes.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\_elementtree.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\_hashlib.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\_multiprocessing.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\_socket.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\_ssl.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\pyexpat.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\pysqlite2._sqlite.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\python27.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\pythoncom27.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\PyWinTypes27.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\select.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\unicodedata.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32api.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32com.shell.shell.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32crypt.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32event.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32file.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32inet.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32pdh.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32process.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32profile.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32security.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\win32ts.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\windows._cacheinvalidation.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._controls_.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._core_.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._gdi_.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._html2.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._misc_.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._windows_.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wx._wizard.pyd
c:\users\Alex\AppData\Local\Temp\_MEI50082\wxbase294u_net_vc90.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\wxbase294u_vc90.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\wxmsw294u_adv_vc90.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\wxmsw294u_core_vc90.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\wxmsw294u_html_vc90.dll
c:\users\Alex\AppData\Local\Temp\_MEI50082\wxmsw294u_webview_vc90.dll
c:\users\Alex\AppData\Roaming\2433f433
c:\windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-11 bis 2013-07-11 ))))))))))))))))))))))))))))))
.
.
2013-07-10 23:19 . 2013-07-10 23:19 -------- d-----w- C:\FRST
2013-07-10 23:10 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-07-10 23:10 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-07-10 23:10 . 2013-07-10 23:10 -------- d-----w- c:\users\Alex\AppData\Roaming\Malwarebytes
2013-07-10 23:09 . 2013-07-10 23:09 -------- d-----w- c:\programdata\Malwarebytes
2013-07-10 23:09 . 2013-07-10 23:09 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-10 23:09 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-03 20:01 . 2013-07-03 20:01 -------- d-----w- c:\users\Alex\AppData\Roaming\Media Player Classic
2013-07-02 21:21 . 2013-07-02 21:21 -------- d-----w- c:\programdata\Deutsche Post AG
2013-07-02 21:21 . 2013-07-02 21:21 -------- d-----w- c:\program files\Deutsche Post AG
2013-07-01 07:34 . 2013-07-01 07:34 -------- d-----w- c:\programdata\Microsoft Help
2013-07-01 07:34 . 2013-07-01 07:34 -------- d-----w- c:\users\Alex\AppData\Local\Microsoft Help
2013-06-28 16:15 . 2013-03-17 16:21 3649536 ----a-w- c:\windows\SysWow64\x264vfw.dll
2013-06-28 16:15 . 2011-12-07 17:32 216064 ----a-w- c:\windows\SysWow64\lagarith.dll
2013-06-28 16:15 . 2012-06-09 17:21 178688 ----a-w- c:\windows\SysWow64\unrar.dll
2013-06-28 16:15 . 2011-12-21 17:14 151552 ----a-w- c:\windows\SysWow64\ac3acm.acm
2013-06-28 16:15 . 2011-06-24 14:44 243200 ----a-w- c:\windows\SysWow64\xvidvfw.dll
2013-06-28 16:15 . 2011-06-24 14:28 650752 ----a-w- c:\windows\SysWow64\xvidcore.dll
2013-06-28 16:15 . 2013-04-29 18:00 112640 ----a-w- c:\windows\SysWow64\ff_vfw.dll
2013-06-28 16:15 . 2013-06-28 16:15 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack
2013-06-28 13:05 . 2013-06-28 13:07 -------- d-----w- c:\programdata\Freemake
2013-06-28 13:05 . 2013-06-28 13:05 -------- d-----w- c:\program files (x86)\Freemake
2013-06-28 12:45 . 2013-06-28 12:56 -------- d-----w- c:\users\Alex\AppData\Roaming\avidemux
2013-06-22 19:32 . 2013-06-22 19:32 -------- d-----w- c:\users\Alex\AppData\Roaming\CyberLink
2013-06-19 19:02 . 2013-04-15 14:36 3326232 ----a-w- c:\windows\RXSUnins.exe
2013-06-19 19:02 . 2013-04-15 14:36 3326232 ----a-w- c:\windows\RXCUnins.exe
2013-06-14 18:46 . 2006-07-12 12:39 208896 ----a-w- c:\windows\SysWow64\FFRafShellEx.dll
2013-06-14 18:46 . 2013-06-14 18:46 -------- d-----w- c:\program files (x86)\RAF
2013-06-14 18:46 . 2010-02-10 12:26 233472 ----a-w- c:\windows\SysWow64\RFCLauncher.exe
2013-06-14 18:46 . 2013-06-14 18:46 -------- d-----w- c:\users\Alex\AppData\Local\FUJIFILM
2013-06-14 18:34 . 2013-06-14 18:34 -------- d-----w- c:\programdata\FUJIFILM
2013-06-14 18:34 . 2013-06-14 18:34 -------- d-----w- c:\program files (x86)\FUJIFILM
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin7.dll
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin6.dll
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-14 18:26 . 2013-06-14 18:26 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-14 18:25 . 2013-06-14 18:26 -------- d-----w- c:\program files (x86)\QuickTime
2013-06-14 18:25 . 2013-06-14 18:25 -------- d-----w- c:\programdata\Apple Computer
2013-06-14 18:24 . 2013-06-14 18:24 -------- d-----w- c:\program files (x86)\Common Files\Apple
2013-06-14 18:24 . 2013-06-14 18:24 -------- d-----w- c:\users\Alex\AppData\Local\Apple
2013-06-14 18:24 . 2013-06-14 18:24 -------- d-----w- c:\program files (x86)\Apple Software Update
2013-06-14 18:24 . 2013-06-14 18:24 -------- d-----w- c:\programdata\Apple
2013-06-12 17:51 . 2013-05-08 06:39 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-10 23:13 . 2011-07-18 20:31 78185248 ----a-w- c:\windows\system32\MRT.exe
2013-06-25 08:27 . 2013-05-07 18:27 83672 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-06-11 20:09 . 2012-12-22 17:59 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-11 20:09 . 2011-12-01 21:26 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-22 14:08 . 2012-12-23 11:29 2680832 ----a-w- c:\windows\SysWow64\dvmsg.dll
2013-05-17 10:16 . 2011-03-29 01:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-04-13 05:49 . 2013-05-16 07:43 135168 ----a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49 . 2013-05-16 07:43 350208 ----a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49 . 2013-05-16 07:43 308736 ----a-w- c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49 . 2013-05-16 07:43 111104 ----a-w- c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45 . 2013-05-16 07:43 474624 ----a-w- c:\windows\apppatch\AcSpecfc.dll
2013-04-13 04:45 . 2013-05-16 07:43 2176512 ----a-w- c:\windows\apppatch\AcGenral.dll
2013-04-12 14:45 . 2013-04-24 06:49 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584]
"ALBATTTOOL"="c:\program files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe" [2010-10-05 408576]
"GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2013-06-06 19676256]
"rfxsrvtray"="c:\program files (x86)\Tobit Radio.fx\Client\rfx-tray.exe" [2013-02-07 1838872]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"HotkeyApp"="c:\program files (x86)\Launch Manager\HotkeyApp.exe" [2011-08-06 207400]
"LMgrVolOSD"="c:\program files (x86)\Launch Manager\OSD.exe" [2011-08-06 348960]
"Wbutton"="c:\program files (x86)\Launch Manager\Wbutton.exe" [2011-08-13 447016]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2010-08-03 107816]
"Dolby Advanced Audio v2"="c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2011-12-21 507744]
"ControlCenter4"="c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2011-04-20 139264]
"BrStsMon00"="c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2010-06-10 2621440]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-25 345144]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-10 417792]
.
c:\users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.4.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2012-8-13 1199104]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
R3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
R3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys;c:\windows\SYSNATIVE\DRIVERS\RTL8192su.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe;c:\program files (x86)\Launch Manager\WisLMSvc.exe [x]
R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 SLEE_18_DRIVER;Steganos Live Encryption Engine 18 [Driver];c:\windows\Sleen1864.sys;c:\windows\Sleen1864.sys [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [x]
S2 MSSQL$JTLWAWI;SQL Server (JTLWAWI);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x]
S2 PDF Architect Helper Service;PDF Architect Helper Service;c:\program files (x86)\PDF Architect\HelperService.exe;c:\program files (x86)\PDF Architect\HelperService.exe [x]
S2 PDF Architect Service;PDF Architect Service;c:\program files (x86)\PDF Architect\ConversionService.exe;c:\program files (x86)\PDF Architect\ConversionService.exe [x]
S2 Radio.fx;Radio.fx Server;c:\program files (x86)\Tobit Radio.fx\Server\rfx-server.exe;c:\program files (x86)\Tobit Radio.fx\Server\rfx-server.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe;c:\program files (x86)\watchmi\TvdService.exe [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
S3 tihub3;TI USB3 Hub Service;c:\windows\system32\drivers\tihub3.sys;c:\windows\SYSNATIVE\drivers\tihub3.sys [x]
S3 tixhci;TI XHCI Service;c:\windows\system32\drivers\tixhci.sys;c:\windows\SYSNATIVE\drivers\tixhci.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-10 23:20 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.71\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-10 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-12-22 20:09]
.
2013-07-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-05 10:30]
.
2013-07-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-04-05 10:30]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}]
2013-06-06 21:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-06 21:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}]
2013-06-06 21:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}]
2013-06-06 21:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}]
2013-06-06 21:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay]
@="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}"
[HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}]
2013-06-06 21:57 778192 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-23 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-23 392984]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-23 417560]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-08-26 12681320]
"RtHDVBg_Dolby"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-08-16 2277480]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-11-01 1935120]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-11-15 10358784]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]
"XboxStat"="c:\program files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2009-10-01 825184]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"MedionReminder"="c:\program files (x86)\CyberLink\PowerRecover\Reminder.exe" [2011-05-25 443688]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://google.de/
uDefault_Search_URL = hxxp://www.google.com/ie
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://feed.snapdo.com/?publisher=SnapdoOCYB&dpid=SnapdoOCYB&co=DE&userid=2bf0fd42-0dd0-4d91-9998-31c371e6294f&searchtype=ds&q={searchTerms}&installDate=28/06/2013
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-LMgrOSD - c:\program files (x86)\Launch Manager\OSDCtrl.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk - c:\windows\Installer\{F0559C5E-7912-4391-B1A0-6B975F0E5064}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-Inventoria - c:\program files (x86)\NCH Software\Inventoria\uninst.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files (x86)\CyberLink\YouCam\YouCamService.exe
c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-07-11 08:03:27 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-07-11 06:03
.
Vor Suchlauf: 11 Verzeichnis(se), 608.433.422.336 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 609.227.300.864 Bytes frei
.
- - End Of File - - 01032705EEE0A50AA55237CFCA7935F0
D41D8CD98F00B204E9800998ECF8427E
|
|
11.07.2013, 08:17
| #4 |
| /// the machine /// TB-Ausbilder | GVU Trojaner entfernen Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
und ein frisches FRST Log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 08:32
| #5 |
| | GVU Trojaner entfernen hier schonmal die neue log datei. der rest folgt Code:
ATTFilter # AdwCleaner v2.304 - Datei am 11/07/2013 um 09:22:50 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Alex - ALEX-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\Alex\Downloads\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Datei Gelöscht : C:\Program Files (x86)\Mozilla Firefox\searchplugins\babylon.xml
Ordner Gelöscht : C:\ProgramData\Babylon
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\Babylon
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Alex\AppData\Roaming\pdfforge
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\BabylonToolbar
Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar
Schlüssel Gelöscht : HKCU\Software\InstallCore
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKCU\Software\596da8ab76fbf41
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\Software\Babylon
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Prod.cap
Schlüssel Gelöscht : HKLM\Software\DataMngr
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SnapDo_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\596da8ab76fbf41
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}
Schlüssel Gelöscht : HKU\S-1-5-21-2198436372-3954641292-2980762466-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006EE092-9658-4FD6-BD8E-A21A348E59F5}
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Google Chrome v28.0.1500.71
Datei : C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Preferences
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [3254 octets] - [11/07/2013 09:22:50]
########## EOF - C:\AdwCleaner[S1].txt - [3314 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.0.7 (07.11.2013:1)
OS: Windows 7 Home Premium x64
Ran by Alex on 11.07.2013 at 9:33:17,73
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\tracing\apnstub_rasmancs
~~~ Files
Successfully deleted: [File] C:\Windows\syswow64\sho88E4.tmp
~~~ Folders
Successfully deleted: [Folder] "C:\ProgramData\simplitec"
Successfully deleted: [Folder] "C:\Users\Alex\AppData\Roaming\simplitec"
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{19176FBC-E929-4FE8-A994-835B068D7716}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{1A6BF14F-F7B5-484D-A5BF-05C26350BF66}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{21C37DB2-D57C-43CD-8F69-F0B16EED12A0}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{2443EE42-8191-48CE-8D37-0AA2DD34BA2A}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{256DFA64-9487-4BDE-AD4D-F956536D26F9}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{287536E4-59E6-4ADE-8BBF-3DBE32819434}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{2AC5EAEE-9AB8-4B73-93A1-C0272C3E6DDE}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{4C33BAB3-01AB-449D-9A53-5703A0DA6593}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{6FBD5905-2DDB-4955-853D-306FF7BC5582}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{93976971-496C-4469-91E7-7D8208CBF866}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{A5F2B2AE-C423-4C9A-945C-03CF1F2B8211}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{B73F3683-AD22-4DFA-970E-8207D0DC2067}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{CDAED6EA-EF05-4273-92A8-B988E72A808E}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{D147665A-6E74-4B2E-BE80-FA8F513EC956}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{D90D2822-2C49-4EDC-939A-E6A2FCE99A5B}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{EC2828F0-43FA-4D5A-9955-BE0A17370B5B}
Successfully deleted: [Empty Folder] C:\Users\Alex\appdata\local\{FE46C8A3-4D1E-480A-9807-C427AAD0AE8C}
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.07.2013 at 9:49:42,16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by Alex (administrator) on 11-07-2013 09:55:22
Running from C:\Users\Alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4T7E2XBF
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AkkuLine.de) C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Wistron) C:\Program Files (x86)\Launch Manager\HotkeyApp.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\OSD.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WButton.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2012-01-23] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392984 2012-01-23] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [417560 2012-01-23] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [IntelPAN] - "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PAN Tray [1935120 2011-11-01] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [10358784 2011-11-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2294568 2010-09-03] (Synaptics Incorporated)
HKLM\...\Run: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe [443688 2011-05-26] (CyberLink)
HKLM\...\Run: [XboxStat] - "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [ALBATTTOOL] - C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe [408576 2010-10-05] (AkkuLine.de)
HKCU\...\Run: [GoogleDriveSync] - "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
HKCU\...\Run: [rfxsrvtray] - "C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe" [1838872 2013-02-07] (Tobit.Software)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-30] (Intel Corporation)
HKLM-x32\...\Run: [HotkeyApp] - "C:\Program Files (x86)\Launch Manager\HotkeyApp.exe" [207400 2011-08-06] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] - "C:\Program Files (x86)\Launch Manager\OSD.exe" [348960 2011-08-06] (Wistron Corp.)
HKLM-x32\...\Run: [Wbutton] - "C:\Program Files (x86)\Launch Manager\Wbutton.exe" [447016 2011-08-13] (Wistron Corp.)
HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [417792 2009-11-10] (Apple Inc.)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [241984 2011-10-17] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\Windows\SysWOW64\nvinit.dll [203072 2011-10-17] (NVIDIA Corporation)
Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Chrome:
=======
CHR HomePage: https://www.facebook.com/
CHR RestoreOnStartup: "https://www.facebook.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U3) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$JTLWAWI; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-11-01] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2011-08-06] (Wistron Corp.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 L1C; system32\DRIVERS\L1C62x64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 09:49 - 2013-07-11 09:49 - 00002812 ____A C:\Users\Alex\Desktop\JRT.txt
2013-07-11 09:33 - 2013-07-11 09:33 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 09:32 - 2013-07-11 09:32 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\Alex\Downloads\JRT.exe
2013-07-11 09:22 - 2013-07-11 09:23 - 00003375 ____A C:\AdwCleaner[S1].txt
2013-07-11 09:21 - 2013-07-11 09:21 - 00650027 ____A C:\Users\Alex\Downloads\adwcleaner.exe
2013-07-11 08:03 - 2013-07-11 08:03 - 00032309 ____A C:\ComboFix.txt
2013-07-11 07:36 - 2013-07-11 08:03 - 00000000 ____D C:\Qoobox
2013-07-11 07:36 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-11 07:36 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-11 07:36 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-11 07:35 - 2013-07-11 07:59 - 00000000 ____D C:\Windows\erdnt
2013-07-11 07:34 - 2013-07-11 07:34 - 05087643 ____R (Swearware) C:\Users\Alex\Downloads\ComboFix.exe
2013-07-11 01:34 - 2013-07-11 01:34 - 00041714 ____A C:\Users\Alex\Downloads\Addition.txt
2013-07-11 01:29 - 2013-07-11 01:29 - 00043945 ____A C:\Users\Alex\Downloads\FRST.txt
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:11 - 2013-06-12 01:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 01:11 - 2013-06-12 01:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 01:11 - 2013-06-12 01:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 01:11 - 2013-06-12 01:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 01:11 - 2013-06-12 01:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 01:11 - 2013-06-12 00:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 01:11 - 2013-06-12 00:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 01:11 - 2013-06-07 05:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 01:11 - 2013-06-07 04:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:10 - 2013-06-12 01:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 01:10 - 2013-06-12 01:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 01:10 - 2013-06-12 01:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 01:10 - 2013-06-12 01:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-11 01:09 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 23:17 - 2012-08-07 18:01 - 03363840 ____A C:\Users\Alex\Downloads\EPortoInstaller2010_x64_v2.3.msi
2013-07-02 23:17 - 2012-08-07 18:01 - 00436736 ____A () C:\Users\Alex\Downloads\setup.exe
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-28 18:15 - 2013-06-28 18:15 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2013-06-28 18:15 - 2013-04-29 20:00 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll
2013-06-28 18:15 - 2013-03-17 18:21 - 03649536 ____A (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2013-06-28 18:15 - 2012-06-09 19:21 - 00178688 ____A C:\Windows\SysWOW64\unrar.dll
2013-06-28 18:15 - 2011-12-21 19:14 - 00151552 ____A (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2013-06-28 18:15 - 2011-12-07 19:32 - 00216064 ____A ( ) C:\Windows\SysWOW64\lagarith.dll
2013-06-28 18:15 - 2011-06-24 16:44 - 00243200 ____A C:\Windows\SysWOW64\xvidvfw.dll
2013-06-28 18:15 - 2011-06-24 16:28 - 00650752 ____A C:\Windows\SysWOW64\xvidcore.dll
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:45 - 2013-06-28 14:56 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXSUnins.exe
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXCUnins.exe
2013-06-19 21:01 - 2013-06-19 21:02 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Program Files (x86)\RAF
2013-06-14 20:46 - 2010-02-10 14:26 - 00233472 ____A (FUJIFILM Corporation) C:\Windows\SysWOW64\RFCLauncher.exe
2013-06-14 20:46 - 2006-07-12 14:39 - 00208896 ____A (FUJI PHOTO FILM CO., LTD.) C:\Windows\SysWOW64\FFRafShellEx.dll
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\Program Files (x86)\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:26 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-12 19:51 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 19:50 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 19:50 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 19:50 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 19:50 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 19:50 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 19:50 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 19:50 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
2013-06-11 21:35 - 2013-06-11 21:36 - 26919963 ____A C:\Users\Alex\Downloads\Facebook Insights Data Export - VfL Sportfreunde Lotte - 2013-06-11.xls
==================== One Month Modified Files and Folders =======
2013-07-11 09:49 - 2013-07-11 09:49 - 00002812 ____A C:\Users\Alex\Desktop\JRT.txt
2013-07-11 09:33 - 2013-07-11 09:33 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 09:32 - 2013-07-11 09:32 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\Alex\Downloads\JRT.exe
2013-07-11 09:32 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 09:32 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 09:27 - 2013-04-20 22:19 - 00000000 ___SD C:\Users\Alex\Google Drive
2013-07-11 09:27 - 2012-12-22 18:12 - 00000000 ____D C:\Users\Alex\Documents\Youcam
2013-07-11 09:24 - 2013-04-06 19:21 - 00004967 ____A C:\Windows\setupact.log
2013-07-11 09:24 - 2013-04-05 12:30 - 00001102 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-11 09:24 - 2012-03-20 00:34 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-11 09:24 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 09:23 - 2013-07-11 09:22 - 00003375 ____A C:\AdwCleaner[S1].txt
2013-07-11 09:23 - 2012-12-22 18:00 - 02077490 ____A C:\Windows\WindowsUpdate.log
2013-07-11 09:21 - 2013-07-11 09:21 - 00650027 ____A C:\Users\Alex\Downloads\adwcleaner.exe
2013-07-11 09:19 - 2013-04-05 12:30 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-11 09:09 - 2012-12-22 19:59 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-11 08:35 - 2013-05-14 09:04 - 00000432 ____A C:\Windows\BRWMARK.INI
2013-07-11 08:03 - 2013-07-11 08:03 - 00032309 ____A C:\ComboFix.txt
2013-07-11 08:03 - 2013-07-11 07:36 - 00000000 ____D C:\Qoobox
2013-07-11 07:59 - 2013-07-11 07:35 - 00000000 ____D C:\Windows\erdnt
2013-07-11 07:55 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-11 07:54 - 2013-04-07 13:43 - 00008654 ____A C:\Windows\PFRO.log
2013-07-11 07:52 - 2012-12-22 18:09 - 00000000 ____D C:\Users\Alex
2013-07-11 07:34 - 2013-07-11 07:34 - 05087643 ____R (Swearware) C:\Users\Alex\Downloads\ComboFix.exe
2013-07-11 07:23 - 2012-12-24 00:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 07:23 - 2012-12-24 00:45 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 01:34 - 2013-07-11 01:34 - 00041714 ____A C:\Users\Alex\Downloads\Addition.txt
2013-07-11 01:33 - 2013-04-05 12:30 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-11 01:29 - 2013-07-11 01:29 - 00043945 ____A C:\Users\Alex\Downloads\FRST.txt
2013-07-11 01:26 - 2011-05-16 16:04 - 00755150 ____A C:\Windows\system32\perfh007.dat
2013-07-11 01:26 - 2011-05-16 16:04 - 00172652 ____A C:\Windows\system32\perfc007.dat
2013-07-11 01:26 - 2009-07-14 07:13 - 01786802 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:13 - 2011-07-18 22:31 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:48 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ____D C:\Windows\ShellNew
2013-07-11 00:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 00:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-07-11 00:46 - 2013-02-06 16:12 - 00000000 ____D C:\Users\Alex\Desktop\SF Lotte
2013-07-11 00:46 - 2013-01-03 21:58 - 00000000 ____D C:\Users\Alex\AppData\Roaming\SoftGrid Client
2013-07-11 00:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-11 00:45 - 2013-01-03 22:03 - 00000000 ___RD C:\MSOCache
2013-07-11 00:37 - 2013-01-14 15:40 - 00511488 __ASH C:\Users\Alex\Desktop\Thumbs.db
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-10 00:13 - 2013-01-03 15:15 - 02310650 ____A C:\Users\Alex\Desktop\Gewerbe.mmb
2013-07-10 00:05 - 2013-01-15 16:21 - 00000000 ____D C:\Users\Alex\Desktop\backup_Gewerbe
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-03 07:47 - 2013-01-03 21:57 - 01742704 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-02 23:50 - 2013-01-03 11:22 - 01412608 ____A C:\Users\Alex\Documents\Meine Konten.stb
2013-07-02 23:48 - 2013-01-15 18:20 - 00001566 ____A C:\Users\Alex\AppData\Roaming\MyMicroBalanceConfig.ini
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 15:49 - 2013-01-30 17:59 - 00003922 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{E54F740F-F5C3-4B29-8CA5-7D6D529AF5AD}
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 22:55 - 2013-03-21 22:34 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Audacity
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-28 18:15 - 2013-06-28 18:15 - 00000000 ____D C:\Program Files (x86)\K-Lite Codec Pack
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 17:53 - 2013-03-24 18:19 - 00000000 ____D C:\Users\Alex\Documents\Any Video Converter
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Program Files (x86)\Freemake
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:56 - 2013-06-28 14:45 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-26 17:05 - 2013-01-03 15:13 - 00000000 ____D C:\Users\Alex\Desktop\Ebay Bilder
2013-06-25 10:27 - 2013-05-07 20:27 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:33 - 2012-03-20 17:24 - 00000000 ____D C:\ProgramData\CyberLink
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-19 23:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:03 - 2012-12-23 13:29 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Tobit
2013-06-19 21:02 - 2013-06-19 21:01 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-19 21:02 - 2012-12-23 13:29 - 00000000 ____D C:\Program Files (x86)\Tobit Radio.fx
2013-06-14 20:53 - 2012-12-22 18:10 - 00096944 ____A C:\Users\Alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Program Files (x86)\RAF
2013-06-14 20:46 - 2011-07-18 23:23 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\Program Files (x86)\FUJIFILM
2013-06-14 20:26 - 2013-06-14 20:25 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-12 01:43 - 2013-07-11 01:11 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 01:43 - 2013-07-11 01:10 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 01:42 - 2013-07-11 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 01:26 - 2013-07-11 01:11 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-12 01:26 - 2013-07-11 01:11 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-12 01:26 - 2013-07-11 01:11 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-12 01:25 - 2013-07-11 01:11 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-12 01:25 - 2013-07-11 01:10 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-12 01:25 - 2013-07-11 01:10 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-12 00:51 - 2013-07-11 01:11 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 00:50 - 2013-07-11 01:11 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-06-11 22:09 - 2012-12-22 19:59 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-11 22:09 - 2012-12-22 19:59 - 00003822 ____A C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-06-11 22:09 - 2011-12-01 23:26 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-11 21:36 - 2013-06-11 21:35 - 26919963 ____A C:\Users\Alex\Downloads\Facebook Insights Data Export - VfL Sportfreunde Lotte - 2013-06-11.xls
2013-06-11 20:43 - 2013-01-23 23:04 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Origin
2013-06-11 20:43 - 2013-01-23 23:02 - 00000000 ____D C:\ProgramData\Origin
2013-06-11 20:43 - 2013-01-23 23:02 - 00000000 ____D C:\Program Files (x86)\Origin
2013-06-11 20:40 - 2013-01-23 23:04 - 00000000 ____D C:\Users\Alex\AppData\Local\Origin
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-25 11:31
==================== End Of Log ============================
--- --- --- Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-07-2013 04 Ran by Alex at 2013-07-11 09:57:04 Running from C:\Users\Alex\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4T7E2XBF Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe AIR (x32 Version: 3.1.0.4880) Adobe Bridge 1.0 (x32 Version: 001.000.001) Adobe Common File Installer (x32 Version: 1.00.001) Adobe Creative Suite 2 (x32) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Help Center 1.0 (x32 Version: 1.0.1) Adobe Photoshop CS2 (x32 Version: 9.0) Adobe Reader X (10.1.4) MUI (x32 Version: 10.1.4) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Adobe Stock Photos 1.0 (x32 Version: 1.0.1) AkkuLine Batterie-Tool (x32 Version: 1.0.0) Amazon Kindle (HKCU) Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17) Any Video Converter 5 5.0.4 (x32) Apple Application Support (x32 Version: 1.1.0) Apple Software Update (x32 Version: 2.1.1.116) Audacity 2.0.3 (x32 Version: 2.0.3) Avira Free Antivirus (x32 Version: 13.0.0.3737) Brother MFL-Pro Suite DCP-7055 (x32 Version: 1.0.7.0) calibre (x32 Version: 0.9.21) Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2) Corel Graphics - Windows Shell Extension (x32 Version: 15.2.0.686) Corel Graphics - Windows Shell Extension (x32 Version: 15.2.686) Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686) CorelDRAW Essentials X5 - Common (x32 Version: 15.3) CorelDRAW Essentials X5 - Connect (x32 Version: 15.3) CorelDRAW Essentials X5 - Custom Data (x32 Version: 15.3) CorelDRAW Essentials X5 - DE (x32 Version: 15.3) CorelDRAW Essentials X5 - Draw (x32 Version: 15.3) CorelDRAW Essentials X5 - EN (x32 Version: 15.3) CorelDRAW Essentials X5 - ES (x32 Version: 15.3) CorelDRAW Essentials X5 - Extra Content (x32 Version: 15.0) CorelDRAW Essentials X5 - Extra Content (x32) CorelDRAW Essentials X5 - Filters (x32 Version: 15.3) CorelDRAW Essentials X5 - FR (x32 Version: 15.3) CorelDRAW Essentials X5 - IPM (x32 Version: 15.3) CorelDRAW Essentials X5 - IT (x32 Version: 15.3) CorelDRAW Essentials X5 - PHOTO-PAINT (x32 Version: 15.3) CorelDRAW Essentials X5 - Redist (x32 Version: 15.0) CorelDRAW Essentials X5 - Setup Files (x32 Version: 15.3) CorelDRAW Essentials X5 - WT (x32 Version: 15.3) CorelDRAW Essentials X5 (x32 Version: 15.2.0.686) CorelDRAW Essentials X5 (x32 Version: 15.3) CyberLink LabelPrint (x32 Version: 2.5.3624) CyberLink Power2Go (x32 Version: 7.0.0.1327) CyberLink PowerDVD Copy (x32 Version: 1.5.1306) CyberLink PowerRecover (x32 Version: 5.5.4125) CyberLink WaveEditor (x32 Version: 1.0.1.3320) CyberLink YouCam 5 (x32 Version: 5.0.1223) D3DX10 (x32 Version: 15.4.2368.0902) Deutsche Post E-Porto (Version: 2.3.0) Dolby Advanced Audio v2 (x32 Version: 7.2.7000.11) eaner (Version: 4.00) Emergency 2012 Deluxe (x32) EtikettenAssistent 4.2 (x32 Version: 4.2.1) FIFA 13 (x32 Version: 1.6.0.0) FIFA 13 Demo (x32 Version: 1.0.0.0) Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (x32 Version: 15.4.5722.2) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Freemake Audio Converter Version 1.1.0 (x32 Version: 1.1.0) FUJIFILM MyFinePix Studio 2.0 (x32) Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) Google Chrome (x32 Version: 28.0.1500.71) Google Drive (x32 Version: 1.10.4769.632) Google Update Helper (x32 Version: 1.3.21.145) Intel PROSet Wireless Intel PROSet Wireless (x32) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Processor Graphics (x32 Version: 8.15.10.2622) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 1.3.0.0621) Intel(R) PROSet/Wireless WiFi Software (Version: 14.03.0000) Intel(R) Rapid Storage Technology (x32 Version: 11.0.0.1032) Inventoria Bestandsverwaltung (x32) Java Auto Updater (x32 Version: 2.1.6.0) Java(TM) 7 Update 3 (64-bit) (Version: 7.0.30) Java(TM) 7 Update 3 (x32 Version: 7.0.30) Junk Mail filter update (x32 Version: 15.4.3502.0922) K-Lite Mega Codec Pack 9.9.0 (x32 Version: 9.9.0) Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2) LAME v3.99.3 (for Windows) (x32) Launch Manager (x32 Version: 1.5.1.4) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Medion Home Cinema (x32 Version: 8.0.3216) Memeo Instant Backup (x32 Version: 4.60.0.7943) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000) Microsoft PowerPoint Viewer (x32 Version: 14.0.6029.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 (x32) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft SQL Server 2005 Express Edition (JTLWAWI) (x32 Version: 9.4.5000.00) Microsoft SQL Server Native Client (Version: 9.00.5000.00) Microsoft SQL Server VSS Writer (Version: 9.00.5000.00) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft Xbox 360 Accessories 1.2 (Version: 1.20.146.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MyMicroBalance (x32 Version: 2.5.5) NVIDIA 3D Vision Driver 285.64 (Version: 285.64) NVIDIA Control Panel 285.64 (Version: 285.64) NVIDIA Graphics Driver 285.64 (Version: 285.64) NVIDIA Install Application (Version: 2.1002.46.235) NVIDIA Optimus 1.5.20 (Version: 1.5.20) NVIDIA PhysX (x32 Version: 9.10.0513) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.8564) NVIDIA Update Components (Version: 1.5.20) o.tel.o (x32 Version: 16.001.06.07.35) OpenOffice.org 3.4.1 (x32 Version: 3.41.9593) Origin (x32 Version: 9.1.10.2728) PDF Architect (x32 Version: 1.1.83.9982) PDFCreator (x32 Version: 1.7.0) Picasa 3 (x32 Version: 3.9) PlayReady PC Runtime amd64 (Version: 1.3.0) Poczta usługi Windows Live (x32 Version: 15.4.3502.0922) Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922) PokerStars.eu (x32) Pošta Windows Live (x32 Version: 15.4.3502.0922) QuickTime (x32 Version: 7.65.17.80) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Radio.fx (x32) RAF (x32 Version: 1.00.0001) Realtek High Definition Audio Driver (x32 Version: 6.0.1.6449) Realtek USB 2.0 Reader Driver (x32 Version: 6.1.7600.10010) RollerCoaster Tycoon 3 (x32) Shared Add-in Extensibility Update for Microsoft .NET Framework 2.0 (KB908002) (x32 Version: 1.0.0) Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002) (x32 Version: 1.0.0) Spelling Dictionaries Support For Adobe Reader X (x32 Version: 10.0.0) Steganos Online-Banking 2012 (x32 Version: 2.0.4) Suite Specific (x32 Version: 2.0.0) Synaptics Pointing Device Driver (Version: 15.1.12.0) TI USB 3.0 Host Controller Driver (x32 Version: 1.12.16) TI USB3 Host Driver (x32 Version: 1.12.16) Tools für Microsoft SQL Server 2005 Express Edition (x32 Version: 9.4.5000.00) Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (x32 Version: 9.00.5000.00) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1) watchmi (x32 Version: 3.0.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3538.0513) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3538.0513) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 02-07-2013 21:19:40 Deutsche Post E-Porto wird installiert 03-07-2013 05:47:49 Windows Modules Installer 03-07-2013 05:48:50 Windows Modules Installer 10-07-2013 22:53:48 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-07-11 07:55 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {3F9C8207-D271-4241-8333-1EC42088EFDE} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-11] (Adobe Systems Incorporated) Task: {54F64904-44B9-45CC-B052-51FE59734756} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation) Task: {5BE6CE6C-E17E-47B5-B79A-461CB5F734BF} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2011-12-23] (CyberLink Corp.) Task: {66700F3D-2ABE-4082-87B8-8D546CAE53C0} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {7D5CB3F2-433A-4CA8-8E85-7158ED2AAC2C} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-21] (Microsoft Corporation) Task: {AD5F38A2-8948-4582-8DDE-6EDA45E28FF0} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd) Task: {B28C167B-ED76-46D1-B4A3-4BA8FE86D780} - System32\Tasks\User_Feed_Synchronization-{E54F740F-F5C3-4B29-8CA5-7D6D529AF5AD} => C:\Windows\system32\msfeedssync.exe [2013-04-02] (Microsoft Corporation) Task: {CC1BAF32-4C55-47C7-BCDE-7F9C2252F0ED} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-05] (Google Inc.) Task: {E43AA00B-9F2F-4613-A3E8-353796E48EFB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-05] (Google Inc.) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= Name: Ethernet-Controller Description: Ethernet-Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= CodeIntegrity Errors: =================================== Date: 2013-07-11 07:51:48.329 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-11 07:51:48.191 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 52% Total physical RAM: 4001.87 MB Available physical RAM: 1906.46 MB Total Pagefile: 8001.93 MB Available Pagefile: 5471.3 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:647.54 GB) (Free:566.98 GB) NTFS (Disk=0 Partition=2) Drive d: (Recover) (Fixed) (Total:50 GB) (Free:26.07 GB) NTFS (Disk=0 Partition=3) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 699 GB) (Disk ID: 2BD2C32A) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=648 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=50 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ |
|
11.07.2013, 09:24
| #6 |
| /// the machine /// TB-Ausbilder | GVU Trojaner entfernen Onlinescan und wir sind durch  ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST Log bitte. Noch Probleme?
__________________ --> GVU Trojaner entfernen |
|
11.07.2013, 21:52
| #7 |
| | GVU Trojaner entfernenCode:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=502c8653cc6e7645a7d41457eae410d0
# engine=14349
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-11 08:45:43
# local_time=2013-07-11 10:45:43 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 11779 238955633 4506 0
# compatibility_mode=5893 16776574 100 94 35872 125162193 0 0
# scanned=2478
# found=0
# cleaned=0
# scan_time=834
ESETSmartInstaller@High as downloader log:
Can not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
Can not open internetCan not open internetESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=502c8653cc6e7645a7d41457eae410d0
# engine=14352
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-11 04:46:04
# local_time=2013-07-11 06:46:04 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 40600 238984454 33327 0
# compatibility_mode=5893 16776574 100 94 64693 125191014 0 0
# scanned=117040
# found=1
# cleaned=0
# scan_time=13849
sh=1C9BD651288D9CE6AB7F2091EB55B7A552F3AFB6 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\a331351-4ca8983a"
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=12
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=502c8653cc6e7645a7d41457eae410d0
# engine=14355
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-11 08:48:20
# local_time=2013-07-11 10:48:20 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1799 16775165 100 96 55136 238998990 47863 0
# compatibility_mode=5893 16776574 100 94 79229 125205550 0 0
# scanned=229805
# found=2
# cleaned=0
# scan_time=12926
sh=1C9BD651288D9CE6AB7F2091EB55B7A552F3AFB6 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\17\a331351-4ca8983a"
sh=83A6C8CC692C623754B40ABC016E539C5303C971 ft=1 fh=c991d7d32341d99e vn="Win32/Moure.A trojan" ac=I fn="C:\Users\Alex\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\40\2fb186e8-517e7e48"
Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 7 Update 3 Java version out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader XI Google Chrome 27.0.1453.116 Google Chrome 28.0.1500.71 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` Code:
ATTFilter Results of screen317's Security Check version 0.99.68 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 7 Update 3 Java version out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader XI Google Chrome 27.0.1453.116 Google Chrome 28.0.1500.71 ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 03
Ran by Alex (administrator) on 12-07-2013 08:28:44
Running from C:\Users\Alex\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GmbH) C:\Program Files (x86)\PDF Architect\ConversionService.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Xbox 360 Accessories\XBoxStat.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(AkkuLine.de) C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Tobit.Software) C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Wistron) C:\Program Files (x86)\Launch Manager\HotkeyApp.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\OSD.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WButton.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Wistron Corp.) C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2012-01-23] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392984 2012-01-23] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [417560 2012-01-23] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12681320 2011-08-26] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE4 [2277480 2011-08-16] (Realtek Semiconductor)
HKLM\...\Run: [IntelPAN] - "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PAN Tray [1935120 2011-11-01] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [10358784 2011-11-15] (Intel Corporation)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2294568 2010-09-03] (Synaptics Incorporated)
HKLM\...\Run: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe [443688 2011-05-26] (CyberLink)
HKLM\...\Run: [XboxStat] - "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun [825184 2009-10-01] (Microsoft Corporation)
HKLM\...\RunOnce: [MedionReminder] - C:\Program Files (x86)\CyberLink\PowerRecover\Reminder.exe /DeleteRunKey [443688 2011-05-26] (CyberLink)
HKCU\...\Run: [Sidebar] - C:\Program Files\Windows Sidebar\sidebar.exe /autoRun [1475584 2010-11-21] (Microsoft Corporation)
HKCU\...\Run: [ALBATTTOOL] - C:\Program Files (x86)\AkkuLine.de\AkkuLine Batterie-Tool\AL-Batterie-Tool.exe [408576 2010-10-05] (AkkuLine.de)
HKCU\...\Run: [GoogleDriveSync] - "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart [19676256 2013-06-06] (Google)
HKCU\...\Run: [rfxsrvtray] - "C:\Program Files (x86)\Tobit Radio.fx\Client\rfx-tray.exe" [1838872 2013-02-07] (Tobit.Software)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-30] (Intel Corporation)
HKLM-x32\...\Run: [HotkeyApp] - "C:\Program Files (x86)\Launch Manager\HotkeyApp.exe" [207400 2011-08-06] (Wistron)
HKLM-x32\...\Run: [LMgrVolOSD] - "C:\Program Files (x86)\Launch Manager\OSD.exe" [348960 2011-08-06] (Wistron Corp.)
HKLM-x32\...\Run: [Wbutton] - "C:\Program Files (x86)\Launch Manager\Wbutton.exe" [447016 2011-08-13] (Wistron Corp.)
HKLM-x32\...\Run: [CLMLServer] - "C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [107816 2010-08-04] (CyberLink)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart [507744 2011-12-21] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe /autorun [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe /AUTORUN [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-06-25] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [417792 2009-11-10] (Apple Inc.)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [241984 2011-10-17] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\Windows\SysWOW64\nvinit.dll [203072 2011-10-17] (NVIDIA Corporation)
Startup: C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk
ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
Startup: C:\ProgramData\Start Menu\Programs\Startup\Adobe Gamma.lnk
ShortcutTarget: Adobe Gamma.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Chrome:
=======
CHR HomePage: https://www.facebook.com/
CHR RestoreOnStartup: "https://www.facebook.com/"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.71\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (AmazonMP3DownloaderPlugin) - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll (Amazon.com, Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 7 U3) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Gmail) - C:\Users\Alex\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [72704 2013-01-08] (Adobe Systems)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-25] (Avira Operations GmbH & Co. KG)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MSSQL$JTLWAWI; C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-11-01] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1320496 2013-04-08] (pdfforge GmbH)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [799280 2013-04-08] (pdfforge GmbH)
R2 Radio.fx; C:\Program Files (x86)\Tobit Radio.fx\Server\rfx-server.exe [3999512 2013-06-03] ()
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2012-01-31] ()
R3 WisLMSvc; C:\Program Files (x86)\Launch Manager\WisLMSvc.exe [118560 2011-08-06] (Wistron Corp.)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-03-30] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-03-30] (Avira Operations GmbH & Co. KG)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
R1 SLEE_18_DRIVER; C:\Windows\Sleen1864.sys [108648 2013-01-08] (Softwareentwicklung Remus - ArchiCrypt - )
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 L1C; system32\DRIVERS\L1C62x64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 22:56 - 2013-07-11 22:56 - 00890988 ____A C:\Users\Alex\Downloads\SecurityCheck.exe
2013-07-11 19:11 - 2013-07-11 19:11 - 02347384 ____A (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_enu (2).exe
2013-07-11 14:54 - 2013-07-11 14:54 - 02347384 ____A (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_enu (1).exe
2013-07-11 10:28 - 2013-07-11 10:28 - 02347384 ____A (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_enu.exe
2013-07-11 09:49 - 2013-07-11 09:49 - 00002812 ____A C:\Users\Alex\Desktop\JRT.txt
2013-07-11 09:33 - 2013-07-11 09:33 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 09:32 - 2013-07-11 09:32 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\Alex\Downloads\JRT.exe
2013-07-11 09:22 - 2013-07-11 09:23 - 00003375 ____A C:\AdwCleaner[S1].txt
2013-07-11 09:21 - 2013-07-11 09:21 - 00650027 ____A C:\Users\Alex\Downloads\adwcleaner.exe
2013-07-11 08:03 - 2013-07-11 08:03 - 00032309 ____A C:\ComboFix.txt
2013-07-11 07:36 - 2013-07-11 08:03 - 00000000 ____D C:\Qoobox
2013-07-11 07:36 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-11 07:36 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-11 07:36 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-11 07:36 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-11 07:35 - 2013-07-11 07:59 - 00000000 ____D C:\Windows\erdnt
2013-07-11 07:34 - 2013-07-11 07:34 - 05087643 ____R (Swearware) C:\Users\Alex\Downloads\ComboFix.exe
2013-07-11 01:34 - 2013-07-11 01:34 - 00041714 ____A C:\Users\Alex\Downloads\Addition.txt
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:11 - 2013-06-12 01:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 01:11 - 2013-06-12 01:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 01:11 - 2013-06-12 01:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 01:11 - 2013-06-12 01:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 01:11 - 2013-06-12 01:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 01:11 - 2013-06-12 01:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 01:11 - 2013-06-12 01:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 01:11 - 2013-06-12 01:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 01:11 - 2013-06-12 00:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 01:11 - 2013-06-12 00:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 01:11 - 2013-06-07 05:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 01:11 - 2013-06-07 04:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:10 - 2013-06-12 01:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 01:10 - 2013-06-12 01:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 01:10 - 2013-06-12 01:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 01:10 - 2013-06-12 01:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:09 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:03 - 2013-07-11 01:04 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-02 23:17 - 2012-08-07 18:01 - 03363840 ____A C:\Users\Alex\Downloads\EPortoInstaller2010_x64_v2.3.msi
2013-07-02 23:17 - 2012-08-07 18:01 - 00436736 ____A () C:\Users\Alex\Downloads\setup.exe
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-28 18:15 - 2013-04-29 20:00 - 00112640 ____A C:\Windows\SysWOW64\ff_vfw.dll
2013-06-28 18:15 - 2013-03-17 18:21 - 03649536 ____A (x264vfw project) C:\Windows\SysWOW64\x264vfw.dll
2013-06-28 18:15 - 2012-06-09 19:21 - 00178688 ____A C:\Windows\SysWOW64\unrar.dll
2013-06-28 18:15 - 2011-12-21 19:14 - 00151552 ____A (fccHandler) C:\Windows\SysWOW64\ac3acm.acm
2013-06-28 18:15 - 2011-12-07 19:32 - 00216064 ____A ( ) C:\Windows\SysWOW64\lagarith.dll
2013-06-28 18:15 - 2011-06-24 16:44 - 00243200 ____A C:\Windows\SysWOW64\xvidvfw.dll
2013-06-28 18:15 - 2011-06-24 16:28 - 00650752 ____A C:\Windows\SysWOW64\xvidcore.dll
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:05 - 2013-06-28 15:07 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:45 - 2013-06-28 14:56 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXSUnins.exe
2013-06-19 21:02 - 2013-04-15 16:36 - 03326232 ____A (Tobit.Software) C:\Windows\RXCUnins.exe
2013-06-19 21:01 - 2013-06-19 21:02 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:46 - 2010-02-10 14:26 - 00233472 ____A (FUJIFILM Corporation) C:\Windows\SysWOW64\RFCLauncher.exe
2013-06-14 20:46 - 2006-07-12 14:39 - 00208896 ____A (FUJI PHOTO FILM CO., LTD.) C:\Windows\SysWOW64\FFRafShellEx.dll
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-12 19:51 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-06-12 19:50 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-06-12 19:50 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-06-12 19:50 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-06-12 19:50 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-06-12 19:50 - 2013-05-10 07:49 - 00030720 ____A (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2013-06-12 19:50 - 2013-05-10 05:20 - 00024576 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll
2013-06-12 19:50 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-06-12 19:50 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-06-12 19:50 - 2013-04-26 01:30 - 01505280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-06-12 19:50 - 2013-04-17 09:02 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-17 08:24 - 01424384 ____A (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2013-06-12 19:50 - 2013-04-01 00:52 - 01887232 ____A (Microsoft Corporation) C:\Windows\system32\d3d11.dll
==================== One Month Modified Files and Folders =======
2013-07-12 08:29 - 2012-12-22 18:00 - 01377262 ____A C:\Windows\WindowsUpdate.log
2013-07-12 08:27 - 2013-01-30 17:59 - 00003922 ____A C:\Windows\System32\Tasks\User_Feed_Synchronization-{E54F740F-F5C3-4B29-8CA5-7D6D529AF5AD}
2013-07-12 08:26 - 2013-04-20 22:19 - 00000000 ___SD C:\Users\Alex\Google Drive
2013-07-12 08:26 - 2012-12-22 18:12 - 00000000 ____D C:\Users\Alex\Documents\Youcam
2013-07-12 08:25 - 2013-01-14 15:40 - 00511488 __ASH C:\Users\Alex\Desktop\Thumbs.db
2013-07-12 08:23 - 2013-04-07 13:43 - 00010026 ____A C:\Windows\PFRO.log
2013-07-12 08:23 - 2013-04-06 19:21 - 00005079 ____A C:\Windows\setupact.log
2013-07-12 08:23 - 2013-04-05 12:30 - 00001102 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-12 08:23 - 2012-03-20 00:34 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-12 08:23 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 23:19 - 2013-04-05 12:30 - 00001106 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-11 23:09 - 2012-12-22 19:59 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-11 22:56 - 2013-07-11 22:56 - 00890988 ____A C:\Users\Alex\Downloads\SecurityCheck.exe
2013-07-11 19:11 - 2013-07-11 19:11 - 02347384 ____A (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_enu (2).exe
2013-07-11 18:55 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 18:55 - 2009-07-14 06:45 - 00016944 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:54 - 2013-07-11 14:54 - 02347384 ____A (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_enu (1).exe
2013-07-11 10:31 - 2011-05-16 16:04 - 00755150 ____A C:\Windows\system32\perfh007.dat
2013-07-11 10:31 - 2011-05-16 16:04 - 00172652 ____A C:\Windows\system32\perfc007.dat
2013-07-11 10:31 - 2009-07-14 07:13 - 01764810 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 10:28 - 2013-07-11 10:28 - 02347384 ____A (ESET) C:\Users\Alex\Downloads\esetsmartinstaller_enu.exe
2013-07-11 09:49 - 2013-07-11 09:49 - 00002812 ____A C:\Users\Alex\Desktop\JRT.txt
2013-07-11 09:33 - 2013-07-11 09:33 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 09:32 - 2013-07-11 09:32 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\Alex\Downloads\JRT.exe
2013-07-11 09:23 - 2013-07-11 09:22 - 00003375 ____A C:\AdwCleaner[S1].txt
2013-07-11 09:21 - 2013-07-11 09:21 - 00650027 ____A C:\Users\Alex\Downloads\adwcleaner.exe
2013-07-11 08:35 - 2013-05-14 09:04 - 00000432 ____A C:\Windows\BRWMARK.INI
2013-07-11 08:03 - 2013-07-11 08:03 - 00032309 ____A C:\ComboFix.txt
2013-07-11 08:03 - 2013-07-11 07:36 - 00000000 ____D C:\Qoobox
2013-07-11 07:59 - 2013-07-11 07:35 - 00000000 ____D C:\Windows\erdnt
2013-07-11 07:55 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-11 07:52 - 2012-12-22 18:09 - 00000000 ____D C:\Users\Alex
2013-07-11 07:34 - 2013-07-11 07:34 - 05087643 ____R (Swearware) C:\Users\Alex\Downloads\ComboFix.exe
2013-07-11 07:23 - 2012-12-24 00:45 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 01:34 - 2013-07-11 01:34 - 00041714 ____A C:\Users\Alex\Downloads\Addition.txt
2013-07-11 01:33 - 2013-04-05 12:30 - 00002187 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-11 01:19 - 2013-07-11 01:19 - 01776951 ____A (Farbar) C:\Users\Alex\Downloads\FRST64.exe
2013-07-11 01:19 - 2013-07-11 01:19 - 00000000 ____D C:\FRST
2013-07-11 01:18 - 2013-07-11 01:18 - 00793536 ____A C:\Users\Alex\Downloads\ZipOpenerSetup.exe
2013-07-11 01:13 - 2011-07-18 22:31 - 78185248 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-07-11 01:10 - 2013-07-11 01:10 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Malwarebytes
2013-07-11 01:09 - 2013-07-11 01:09 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-11 01:04 - 2013-07-11 01:03 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\Alex\Downloads\mbam-setup-1.75.0.1300 (1).exe
2013-07-11 00:48 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-07-11 00:47 - 2011-04-12 10:28 - 00000000 ____D C:\Windows\ShellNew
2013-07-11 00:47 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 00:47 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\AppCompat
2013-07-11 00:46 - 2013-02-06 16:12 - 00000000 ____D C:\Users\Alex\Desktop\SF Lotte
2013-07-11 00:46 - 2013-01-03 21:58 - 00000000 ____D C:\Users\Alex\AppData\Roaming\SoftGrid Client
2013-07-11 00:46 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-11 00:45 - 2013-01-03 22:03 - 00000000 ___RD C:\MSOCache
2013-07-11 00:25 - 2013-07-11 00:25 - 00393480 ____A C:\Users\Alex\AppData\Local\2433f433
2013-07-10 23:43 - 2013-07-10 23:43 - 03425262 ____A C:\Users\Alex\Downloads\monti.wmv
2013-07-10 00:13 - 2013-01-03 15:15 - 02310650 ____A C:\Users\Alex\Desktop\Gewerbe.mmb
2013-07-10 00:05 - 2013-01-15 16:21 - 00000000 ____D C:\Users\Alex\Desktop\backup_Gewerbe
2013-07-09 21:58 - 2013-07-09 21:58 - 00046080 ____A C:\Users\Alex\Downloads\zeitstrahl_mc.xls
2013-07-05 15:34 - 2013-07-05 15:34 - 00274373 ____A C:\Users\Alex\Documents\Unbenannt.wma
2013-07-03 22:01 - 2013-07-03 22:01 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Media Player Classic
2013-07-03 07:47 - 2013-01-03 21:57 - 01742704 ____A C:\Windows\SysWOW64\PerfStringBackup.INI
2013-07-02 23:50 - 2013-01-03 11:22 - 01412608 ____A C:\Users\Alex\Documents\Meine Konten.stb
2013-07-02 23:48 - 2013-01-15 18:20 - 00001566 ____A C:\Users\Alex\AppData\Roaming\MyMicroBalanceConfig.ini
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Users\Alex\Documents\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\ProgramData\Deutsche Post AG
2013-07-02 23:21 - 2013-07-02 23:21 - 00000000 ____D C:\Program Files\Deutsche Post AG
2013-07-02 23:17 - 2013-07-02 23:17 - 03245409 ____A C:\Users\Alex\Downloads\ep_ms_word_2010_addin_v2_3_64bit.exe
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\Users\Alex\AppData\Local\Microsoft Help
2013-07-01 09:34 - 2013-07-01 09:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-30 22:55 - 2013-03-21 22:34 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Audacity
2013-06-30 21:20 - 2013-06-30 21:20 - 00000423 ____A C:\Users\Alex\Documents\SteganosBanking2012Error.txt
2013-06-28 18:12 - 2013-06-28 18:12 - 23768255 ____A ( ) C:\Users\Alex\Downloads\K-Lite_Codec_Pack_990_Mega.exe
2013-06-28 17:53 - 2013-03-24 18:19 - 00000000 ____D C:\Users\Alex\Documents\Any Video Converter
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\Documents\Freemake
2013-06-28 15:07 - 2013-06-28 15:05 - 00000000 ____D C:\ProgramData\Freemake
2013-06-28 15:05 - 2013-06-28 15:05 - 00001328 ____A C:\Users\Public\Desktop\Freemake Audio Converter.lnk
2013-06-28 15:05 - 2013-06-28 15:05 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
2013-06-28 15:03 - 2013-06-28 15:03 - 01264824 ____A (Ellora Assets Corporation ) C:\Users\Alex\Downloads\FreemakeAudioConverterSetup.exe
2013-06-28 14:56 - 2013-06-28 14:45 - 00000000 ____D C:\Users\Alex\AppData\Roaming\avidemux
2013-06-28 14:42 - 2013-06-28 14:42 - 12977165 ____A C:\Users\Alex\Downloads\avidemux_2.6.3_32bits.exe
2013-06-26 17:05 - 2013-01-03 15:13 - 00000000 ____D C:\Users\Alex\Desktop\Ebay Bilder
2013-06-25 10:27 - 2013-05-07 20:27 - 00083672 ____A (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-06-22 21:38 - 2013-06-22 21:38 - 00000000 ____D C:\Users\Alex\Documents\Avatar
2013-06-22 21:33 - 2012-03-20 17:24 - 00000000 ____D C:\ProgramData\CyberLink
2013-06-22 21:32 - 2013-06-22 21:32 - 00000000 ____D C:\Users\Alex\AppData\Roaming\CyberLink
2013-06-19 23:32 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-06-19 21:03 - 2013-06-19 21:03 - 00002091 ____A C:\Users\Public\Desktop\Radio.fx.LNK
2013-06-19 21:03 - 2013-06-19 21:03 - 00002077 ____A C:\Users\Public\Desktop\djukebox.LNK
2013-06-19 21:03 - 2012-12-23 13:29 - 00000000 ____D C:\Users\Alex\AppData\Roaming\Tobit
2013-06-19 21:02 - 2013-06-19 21:01 - 17615456 ____A (Tobit.Software) C:\Users\Alex\Downloads\radio-fx (1).exe
2013-06-14 20:53 - 2012-12-22 18:10 - 00096944 ____A C:\Users\Alex\AppData\Local\GDIPFONTCACHEV1.DAT
2013-06-14 20:46 - 2013-06-14 20:46 - 00000000 ____D C:\Users\Alex\AppData\Local\FUJIFILM
2013-06-14 20:34 - 2013-06-14 20:34 - 00037836 ____A C:\Windows\DirectX.log
2013-06-14 20:34 - 2013-06-14 20:34 - 00001190 ____A C:\Users\Public\Desktop\MyFinePix Studio.lnk
2013-06-14 20:34 - 2013-06-14 20:34 - 00000000 ____D C:\ProgramData\FUJIFILM
2013-06-14 20:25 - 2013-06-14 20:25 - 00000000 ____D C:\ProgramData\Apple Computer
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\Users\Alex\AppData\Local\Apple
2013-06-14 20:24 - 2013-06-14 20:24 - 00000000 ____D C:\ProgramData\Apple
2013-06-13 09:21 - 2013-06-13 09:21 - 01690803 ____A C:\Users\Alex\Downloads\gbb_presse_2.zip
2013-06-13 09:20 - 2013-06-13 09:20 - 01153053 ____A C:\Users\Alex\Downloads\gbb_presse_5.zip
2013-06-12 01:43 - 2013-07-11 01:11 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 01:43 - 2013-07-11 01:11 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 01:43 - 2013-07-11 01:10 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 01:42 - 2013-07-11 01:11 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 01:42 - 2013-07-11 01:10 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 01:26 - 2013-07-11 01:11 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-12 01:26 - 2013-07-11 01:11 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-12 01:26 - 2013-07-11 01:11 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-12 01:25 - 2013-07-11 01:11 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-12 01:25 - 2013-07-11 01:11 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-12 01:25 - 2013-07-11 01:10 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-12 01:25 - 2013-07-11 01:10 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-12 00:51 - 2013-07-11 01:11 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 00:50 - 2013-07-11 01:11 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-06-25 11:31
==================== End Of Log ============================
--- --- --- |
|
12.07.2013, 09:59
| #8 |
| /// the machine /// TB-Ausbilder | GVU Trojaner entfernen Java updaten. Downloade Dir bitte TFC ( von Oldtimer ) und speichere die Datei auf dem Desktop. Schließe nun alle offenen Programme und trenne Dich von dem Internet. Doppelklick auf die TFC.exe und drücke auf Start. Sollte TFC nicht alle Dateien löschen können wird es einen Neustart verlangen. Dies bitte zulassen. Noch probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.07.2013, 14:17
| #9 |
| | GVU Trojaner entfernen So habe jetzt alles erledigt, gab auch keine Probleme. Gibt es sonst noch was zu tun, bzw. kann ich sicher sein das der Schädling erstmal entfernt ist? Vielen Dank für die Hilfe! |
|
12.07.2013, 16:43
| #10 |
| /// the machine /// TB-Ausbilder | GVU Trojaner entfernen Fertig und aufräumen Die Reihenfolge ist hier entscheidend.
Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so das ich diesen Thread aus meinen Abos löschen kann.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.07.2013, 20:16
| #11 |
| | GVU Trojaner entfernen Hi, jetzt ist mir aufgefallen das ich bei Musik etc. ein knacken/ rauschen drin habe. Kann das evtl. was mit gelöschten Treibern etc. zu tun haben? Problem hatte ich vorher noch nie. |
|
12.07.2013, 20:59
| #12 |
| /// the machine /// TB-Ausbilder | GVU Trojaner entfernen Wurden keine Treiber gelöscht. Boxen vielleicht hinüber? Klemm andere an, bei nem Notebook Externe boxen oder mal die Kopfhörer. Treiber ersetzen.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.07.2013, 21:57
| #13 |
| | GVU Trojaner entfernen Hab einen Laptop, liegt aber wohl nicht daran. Nachdem ich Malwarebytes deaktiviert habe läufts wieder normal. Kann dann aber zu hier. Danke. |
|
13.07.2013, 10:09
| #14 |
| /// the machine /// TB-Ausbilder | GVU Trojaner entfernen Alles klar
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu GVU Trojaner entfernen |
| administrator, adobe, antivir, avg, avira, desktop, ebay, entfernen, explorer, farbar, farbar recovery scan tool, flash player, frst.txt, google, home, homepage, launch, nvidia, opera, plug-in, realtek, registry, rundll, server, services.exe, svchost.exe, trojaner, win32/moure.a, winlogon.exe |
Hybrid-Darstellung
