| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Trojanerbefall: Umleitung von LinksWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
11.07.2013, 08:27
| #1 |
 |  Trojanerbefall: Umleitung von Links Hallo, wie so viele andere hier im Forum, habe ich das Problem, dass einer unserer Laptops mit ihavenet und newsbusters verseucht ist. Diverse Virenscanner haben diverse Probleme erkannt, konnten das Thema aber nicht endgültig erledigen. Zusätzlich zur Umleitung von Links aus Google wurde das gesamte Startmenü durch unbrauchbare txt-Links ersetzt. OTL-Scan: Code:
ATTFilter t.OTL logfile created on: 11.07.2013 09:22:48 - Run 2 OTL by OldTimer - Version 3.2.69.0 Folder = C:\ 64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.10.9200.16635) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,89 Gb Total Physical Memory | 5,37 Gb Available Physical Memory | 68,09% Memory free 15,77 Gb Paging File | 13,21 Gb Available in Paging File | 83,79% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 238,37 Gb Total Space | 86,54 Gb Free Space | 36,31% Space Free | Partition Type: NTFS Drive P: | 1116,75 Gb Total Space | 770,38 Gb Free Space | 68,98% Space Free | Partition Type: NTFS Drive S: | 927,63 Gb Total Space | 622,82 Gb Free Space | 67,14% Space Free | Partition Type: NTFS Drive V: | 1116,75 Gb Total Space | 770,38 Gb Free Space | 68,98% Space Free | Partition Type: NTFS Drive W: | 1116,75 Gb Total Space | 770,38 Gb Free Space | 68,98% Space Free | Partition Type: NTFS Drive X: | 1116,75 Gb Total Space | 770,38 Gb Free Space | 68,98% Space Free | Partition Type: NTFS Drive Y: | 927,63 Gb Total Space | 622,82 Gb Free Space | 67,14% Space Free | Partition Type: NTFS Computer Name: HV-MW-001 | User Name: MWeber | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.07.10 15:54:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\OTL.exe PRC - [2013.07.03 10:29:11 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.04.05 09:32:16 | 011,479,896 | ---- | M] (NTeWORKS) -- C:\Program Files (x86)\PicPick\picpick.exe PRC - [2013.02.20 18:34:48 | 001,199,000 | ---- | M] (Spotify Ltd) -- C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe PRC - [2013.01.11 09:15:46 | 001,260,320 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2013.01.10 16:35:48 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe PRC - [2012.12.10 13:25:13 | 000,912,688 | ---- | M] () -- C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe PRC - [2012.07.18 19:08:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2012.07.18 19:08:03 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE PRC - [2012.07.18 19:08:01 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe PRC - [2012.07.18 19:08:01 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2012.07.18 19:08:01 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2012.04.17 12:06:42 | 002,594,584 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2012.04.17 12:06:40 | 000,326,424 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2012.03.23 16:09:38 | 014,749,544 | ---- | M] (GARMIN Corp.) -- C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe PRC - [2011.11.02 03:00:44 | 000,090,448 | ---- | M] (Research In Motion Limited) -- C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe PRC - [2011.04.13 06:58:14 | 000,084,088 | ---- | M] (Symantec Corporation) -- C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe PRC - [2011.02.24 01:10:24 | 000,212,944 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe PRC - [2010.11.18 14:47:52 | 000,446,592 | ---- | M] (Conexant Systems, Inc.) -- C:\Windows\SysWOW64\SAsrv.exe PRC - [2010.03.17 12:05:40 | 000,264,704 | ---- | M] () -- C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe PRC - [2010.03.11 15:06:06 | 000,193,824 | ---- | M] (Protexis Inc.) -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe PRC - [2009.11.20 20:17:54 | 000,106,496 | ---- | M] (NEC Electronics Corporation) -- C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe PRC - [2008.01.10 13:13:50 | 000,061,440 | ---- | M] (Ulead Systems, Inc.) -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe ========== Modules (No Company Name) ========== MOD - [2013.07.03 10:29:11 | 003,285,912 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2013.01.11 09:15:46 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll MOD - [2012.12.10 13:25:13 | 000,912,688 | ---- | M] () -- C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe MOD - [2012.11.28 15:13:52 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2012.11.28 15:13:30 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll MOD - [2010.03.17 12:05:40 | 000,264,704 | ---- | M] () -- C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe ========== Services (SafeList) ========== SRV:64bit: - [2013.04.28 06:52:04 | 000,061,224 | ---- | M] (Lenovo.) [Auto | Running] -- C:\Windows\SysNative\ibmpmsvc.exe -- (IBMPMSVC) SRV:64bit: - [2011.11.01 14:37:56 | 001,518,352 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:64bit: - [2011.11.01 14:22:28 | 000,844,560 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:64bit: - [2010.12.17 05:18:08 | 000,198,784 | ---- | M] (Conexant Systems Inc.) [Auto | Running] -- C:\Windows\SysNative\CxAudMsg64.exe -- (CxAudMsg) SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2013.07.03 10:29:11 | 000,117,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.02.07 14:10:08 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2013.01.11 09:15:46 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2013.01.10 16:35:48 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.07.18 19:08:11 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012.07.18 19:08:03 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2012.07.18 19:08:01 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2012.07.18 19:08:01 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012.04.17 12:06:42 | 002,594,584 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2012.04.17 12:06:40 | 000,326,424 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2011.04.13 06:58:14 | 000,084,088 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe -- (VIPAppService) SRV - [2011.02.24 01:10:24 | 000,212,944 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe -- (jhi_service) SRV - [2010.11.18 14:47:52 | 000,446,592 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\Windows\SysWow64\SAsrv.exe -- (SAService) SRV - [2010.03.17 12:05:42 | 000,039,936 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2010.03.11 15:06:06 | 000,193,824 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008.01.10 13:13:50 | 000,061,440 | ---- | M] (Ulead Systems, Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- (UleadBurningHelper) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013.04.28 06:52:04 | 000,044,800 | ---- | M] (Lenovo.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ibmpmdrv.sys -- (IBMPMDRV) DRV:64bit: - [2013.04.24 01:23:00 | 000,460,528 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:64bit: - [2013.01.11 09:15:46 | 000,284,448 | ---- | M] (NVIDIA Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\nvkflt.sys -- (nvkflt) DRV:64bit: - [2013.01.11 09:15:46 | 000,030,496 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:64bit: - [2012.10.18 00:19:22 | 000,044,344 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI) DRV:64bit: - [2012.09.28 11:32:56 | 000,053,760 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64) DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:64bit: - [2012.08.23 16:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2012.08.21 14:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM) DRV:64bit: - [2012.07.18 19:08:31 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2012.07.18 19:08:31 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2012.07.18 19:08:31 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.07.04 00:25:18 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA) DRV:64bit: - [2012.06.05 19:40:42 | 001,580,704 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService) DRV:64bit: - [2012.03.26 15:50:12 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netaapl64.sys -- (Netaapl) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2012.01.11 13:30:58 | 000,360,624 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress) DRV:64bit: - [2011.10.31 16:57:50 | 008,615,936 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:64bit: - [2011.09.26 03:40:28 | 012,309,440 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:64bit: - [2011.09.22 10:49:56 | 000,056,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:64bit: - [2011.07.25 18:44:46 | 000,074,752 | ---- | M] (Research In Motion Limited) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RimUsb_AMD64.sys -- (RimUsb) DRV:64bit: - [2011.07.20 14:58:22 | 000,044,032 | ---- | M] (Research in Motion Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RimSerial_AMD64.sys -- (RimVSerPort) DRV:64bit: - [2011.05.25 18:23:00 | 000,101,888 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\risdxc64.sys -- (risdxc) DRV:64bit: - [2011.04.08 16:09:38 | 000,042,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\WDKMD.sys -- (wdkmd) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2011.03.04 19:18:42 | 000,166,016 | ---- | M] (Ricoh co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\5U877.sys -- (5U877) DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc) DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.03.17 12:05:40 | 000,038,432 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.07.14 02:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\rootmdm.sys -- (ROOTMODEM) DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.29 04:07:38 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT) DRV:64bit: - [2007.04.17 12:51:50 | 000,014,112 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\regi.sys -- (regi) DRV - [2011.05.30 19:21:40 | 000,013,128 | ---- | M] (Authentec Inc.) [Kernel | Auto | Running] -- C:\Programme\ThinkVantage Fingerprint Software\smihlp.sys -- (smihlp) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) DRV - [2009.05.27 10:22:00 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysWOW64\drivers\SSPORT.SYS -- (SSPORT) ========== Standard Registry (All) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141 IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {674B1BE9-1E97-411C-8696-B67CBB0C8900} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE:64bit: - HKLM\..\SearchScopes\{674B1BE9-1E97-411C-8696-B67CBB0C8900}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/p/?LinkId=255141 IE - HKLM\..\SearchScopes,DefaultScope = {674B1BE9-1E97-411C-8696-B67CBB0C8900} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{674B1BE9-1E97-411C-8696-B67CBB0C8900}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&form=LEMDF8&pc=MALC&src=IE-SearchBox IE - HKU\S-1-5-19\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation) IE - HKU\S-1-5-20\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation) IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157 IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 36 7E 40 5E 86 0F CE 01 [binary data] IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation) IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.msn.com IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad [binary data] IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 36 7E 40 5E 86 0F CE 01 [binary data] IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation) IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=111304&tt=3412_3&babsrc=SP_ss&mntrId=74431c2f0000000000000024d7e720d9 IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-606747145-1425521274-725345543-1124\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.startup.homepage: "hxxp://google.de" FF - prefs.js..extensions.enabledAddons: VIP%40verisign.com:2.0.1.0 FF - prefs.js..extensions.enabledAddons: undoclosedtabsbutton%40supernova00.biz:3.7.3 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.5: C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@RIM.com/WebSLLauncher,version=1.0: C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll () FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@fuzebox.com/Fuze Meeting NPAPI Plugin,version=1.0.0.1: C:\Users\mweber\AppData\Local\Fuze Box\Fuze Meeting\npfuzeshare.dll ( ) FF - HKCU\Software\MozillaPlugins\amazon.com/AmazonMP3DownloaderPlugin: C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\VIP@verisign.com: C:\Program Files (x86)\Symantec\VIP Access Client\ [2013.02.21 09:56:20 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.07.03 10:29:10 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.02.20 18:22:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mweber\AppData\Roaming\mozilla\Extensions [2013.07.10 14:51:26 | 000,000,000 | ---D | M] (No name found) -- C:\Users\mweber\AppData\Roaming\mozilla\Firefox\Profiles\scmdb34j.default\extensions [2013.02.21 10:24:25 | 000,033,396 | ---- | M] () (No name found) -- C:\Users\mweber\AppData\Roaming\mozilla\firefox\profiles\scmdb34j.default\extensions\undoclosedtabsbutton@supernova00.biz.xpi [2013.05.10 19:08:27 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\mweber\AppData\Roaming\mozilla\firefox\profiles\scmdb34j.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.07.03 10:29:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2013.07.03 10:29:11 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2013.02.21 09:56:20 | 000,000,000 | ---D | M] (Symantec VIP Access Add-On) -- C:\PROGRAM FILES (X86)\SYMANTEC\VIP ACCESS CLIENT O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Symantec VIP Access Add-On) - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation) O2 - BHO: (Symantec VIP Access Add-On) - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation) O4:64bit: - HKLM..\Run: [ForteConfig] C:\Program Files\Conexant\ForteConfig\fmapp.exe () O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [PSQLLauncher] C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe (Authentec Inc.) O4:64bit: - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe (Conexant systems, Inc.) O4:64bit: - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [IMSS] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation) O4 - HKLM..\Run: [iTunesHelper] C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (NEC Electronics Corporation) O4 - HKLM..\Run: [openvpn-gui] C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe () O4 - HKLM..\Run: [QuickTime Task] C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM..\Run: [RIMBBLaunchAgent.exe] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe (Research In Motion Limited) O4 - HKLM..\Run: [RotateImage] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe (Ricoh co.,Ltd.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [ANT Agent] C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (GARMIN Corp.) O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [BIBLauncher] C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe () O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [kxuizhes] C:\Users\mweber\AppData\Roaming\Ljoxpifu\nbtyrzhes.exe File not found O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [PicPick Start] C:\Program Files (x86)\PicPick\picpick.exe (NTeWORKS) O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [Speech Recognition] C:\Windows\Speech\Common\sapisvr.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [Spotify Web Helper] C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [vrxcejut] C:\Users\mweber\AppData\Roaming\Jcfob\ycfxejut.exe File not found O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [windq] "C:\Users\mweber\AppData\Roaming\windq.exe" -autorun File not found O4 - HKU\S-1-5-21-606747145-1425521274-725345543-1124..\Run: [wingx] "C:\Users\mweber\AppData\Roaming\wingx.exe" -autorun File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKU\S-1-5-21-2340238927-3428810843-3342884594-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-606747145-1425521274-725345543-1124\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000012 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000013 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000014 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000015 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000016 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000017 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000018 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:64bit: - Protocol_Catalog9\Catalog_Entries64\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll (Avira Operations GmbH & Co. KG) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\Program Files (x86)\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.100.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = networxs O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77C161C3-5D7D-4B30-ABFF-8D76B87CC48A}: DhcpNameServer = 192.168.100.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{ADD54867-87C3-45DD-857D-EF263625C186}: DhcpNameServer = 10.74.210.210 10.74.210.211 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E374E37D-8900-4015-B328-A00C33045970}: DhcpNameServer = 192.168.100.241 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EA3F4E81-3910-4943-B1BD-F4A8FDC3EADD}: DhcpNameServer = 10.74.210.210 10.74.210.211 O18:64bit: - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\ms-help - No CLSID value found O18:64bit: - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation) O18:64bit: - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files (x86)\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation) O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O20:64bit: - Winlogon\Notify\psfus: DllName - (C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll) - C:\Programme\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O29:64bit: - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation) O30:64bit: - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation) O30:64bit: - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation) O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - Unable to obtain root file information for disk C:\ O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2013.07.11 09:18:41 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\OTL.exe [2013.07.10 14:47:24 | 000,000,000 | ---D | C] -- C:\Users\mweber\AppData\Roaming\Malwarebytes [2013.07.10 14:47:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2013.07.10 14:47:02 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2013.07.10 14:47:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2013.07.10 14:47:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2013.07.10 13:57:36 | 000,526,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.07.10 13:57:36 | 000,391,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.07.10 13:57:35 | 000,136,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.07.10 13:57:35 | 000,109,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.07.10 13:57:35 | 000,089,600 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe [2013.07.10 13:57:35 | 000,071,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.07.10 13:57:35 | 000,067,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.07.10 13:57:35 | 000,061,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.07.10 13:57:35 | 000,051,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.07.10 13:57:35 | 000,039,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.07.10 13:57:35 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.07.10 13:57:34 | 003,958,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.07.10 13:57:34 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.07.10 13:57:34 | 000,690,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.07.10 13:57:34 | 000,603,136 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.07.10 13:57:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2013.07.10 13:50:04 | 001,887,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WMVDECOD.DLL [2013.07.10 13:50:04 | 001,620,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\WMVDECOD.DLL [2013.07.10 13:49:50 | 001,643,520 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\DWrite.dll [2013.07.10 13:49:49 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll [2013.07.10 13:49:49 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll [2013.07.10 11:50:44 | 000,000,000 | ---D | C] -- C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client [2013.07.10 11:50:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Astaro [2013.07.09 16:42:18 | 000,177,680 | ---- | C] (McAfee, Inc.) -- C:\Windows\SysNative\mfevtps.exe.45d9.deleteme [2013.07.09 16:41:47 | 000,000,000 | ---D | C] -- C:\Program Files\stinger [2013.07.09 16:41:44 | 000,000,000 | ---D | C] -- C:\Users\mweber\Documents\stinger64-epo [2013.07.08 16:11:08 | 000,000,000 | ---D | C] -- C:\Stinger_Quarantine [2013.07.08 16:11:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\stinger [2013.07.08 15:33:18 | 001,192,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certutil.exe [2013.07.08 15:33:17 | 001,464,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2013.07.08 15:33:17 | 000,903,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certutil.exe [2013.07.08 15:33:17 | 000,139,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2013.07.08 15:33:17 | 000,052,224 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\certenc.dll [2013.07.08 15:33:17 | 000,043,008 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\certenc.dll [2013.07.08 15:33:16 | 000,751,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\win32spl.dll [2013.07.08 15:33:16 | 000,492,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\win32spl.dll [2013.07.08 15:32:25 | 000,000,000 | ---D | C] -- C:\Users\mweber\AppData\Roaming\Avira [2013.07.07 17:38:48 | 000,181,064 | ---- | C] (Sysinternals) -- C:\Windows\PSEXESVC.EXE [2013.07.07 17:38:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HMA! Pro VPN [2013.07.03 10:29:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox [2013.06.25 10:21:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime [2013.06.25 10:21:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime [2011.02.24 01:10:36 | 000,020,432 | ---- | C] (Intel Corporation) -- C:\Users\mweber\AppData\Roaming\JomCap.dll ========== Files - Modified Within 30 Days ========== [2013.07.11 09:14:31 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013.07.11 09:14:31 | 000,021,680 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013.07.11 08:50:42 | 001,480,602 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013.07.11 08:50:42 | 000,647,376 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2013.07.11 08:50:42 | 000,610,094 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013.07.11 08:50:42 | 000,127,404 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2013.07.11 08:50:42 | 000,104,412 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013.07.11 08:44:35 | 000,000,302 | ---- | M] () -- C:\Windows\tasks\BNIJ.job [2013.07.11 08:44:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013.07.11 08:44:27 | 2055,655,423 | -HS- | M] () -- C:\hiberfil.sys [2013.07.10 15:54:26 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\OTL.exe [2013.07.10 14:58:43 | 000,337,128 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013.07.10 14:52:45 | 000,046,501 | ---- | M] () -- C:\Users\mweber\Desktop\bookmarks-2013-07-10.json [2013.07.09 16:42:17 | 000,177,680 | ---- | M] (McAfee, Inc.) -- C:\Windows\SysNative\mfevtps.exe.45d9.deleteme [2013.07.08 10:43:17 | 000,471,040 | RHS- | M] () -- C:\Windows\SysWow64\C_1361D.dll [2013.07.07 17:38:48 | 000,181,064 | ---- | M] (Sysinternals) -- C:\Windows\PSEXESVC.EXE [2013.07.07 17:38:36 | 000,001,151 | ---- | M] () -- C:\Users\Public\Desktop\HMA! Pro VPN.lnk [2013.07.04 10:31:00 | 000,726,438 | ---- | M] () -- C:\Users\mweber\Desktop\DHH Teaser HLane.pdf [2013.06.25 10:21:58 | 000,001,845 | ---- | M] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2013.06.25 10:19:10 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013.06.25 10:19:10 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013.06.12 16:48:47 | 001,007,282 | ---- | M] () -- C:\Users\mweber\Desktop\Auda introduction.pdf [2013.06.12 11:07:31 | 008,819,799 | ---- | M] () -- C:\Users\mweber\Desktop\11-06-13_AGM Board Meeting 2013_Master.pdf [2013.06.12 01:43:00 | 000,690,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013.06.12 01:42:58 | 000,391,168 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013.06.12 01:42:58 | 000,109,056 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesysprep.dll [2013.06.12 01:42:58 | 000,061,440 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2013.06.12 01:42:58 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2013.06.12 01:26:36 | 000,051,712 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2013.06.12 01:25:29 | 000,603,136 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013.06.12 01:25:16 | 003,958,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013.06.12 01:25:16 | 000,855,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013.06.12 01:25:13 | 000,526,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013.06.12 01:25:13 | 000,136,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesysprep.dll [2013.06.12 01:25:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2013.06.12 01:25:13 | 000,039,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2013.06.12 00:51:45 | 000,071,680 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\RegisterIEPKEYs.exe [2013.06.12 00:50:58 | 000,089,600 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\RegisterIEPKEYs.exe ========== Files Created - No Company Name ========== [2013.07.10 14:52:45 | 000,046,501 | ---- | C] () -- C:\Users\mweber\Desktop\bookmarks-2013-07-10.json [2013.07.08 10:43:17 | 000,471,040 | RHS- | C] () -- C:\Windows\SysWow64\C_1361D.dll [2013.07.08 10:43:17 | 000,000,302 | ---- | C] () -- C:\Windows\tasks\BNIJ.job [2013.07.04 10:30:59 | 000,726,438 | ---- | C] () -- C:\Users\mweber\Desktop\DHH Teaser HLane.pdf [2013.06.25 10:21:58 | 000,001,845 | ---- | C] () -- C:\Users\Public\Desktop\QuickTime Player.lnk [2013.06.12 16:48:46 | 001,007,282 | ---- | C] () -- C:\Users\mweber\Desktop\Auda introduction.pdf [2013.06.12 11:09:29 | 008,819,799 | ---- | C] () -- C:\Users\mweber\Desktop\11-06-13_AGM Board Meeting 2013_Master.pdf [2013.02.21 10:16:06 | 000,000,774 | ---- | C] () -- C:\Windows\hpntwksetup.ini [2013.02.20 20:14:04 | 000,113,768 | ---- | C] () -- C:\Windows\Wiainst.exe [2013.02.20 19:37:37 | 001,500,444 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.02.20 18:39:49 | 000,000,000 | ---- | C] () -- C:\Users\mweber\AppData\Roaming\bibstats [2013.02.20 17:31:10 | 000,004,752 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2013.02.20 17:23:09 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2013.02.20 17:23:08 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2013.02.20 17:23:08 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2013.02.20 17:23:07 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2013.02.20 17:23:06 | 013,903,360 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] < End of report > VG Martina |
|
11.07.2013, 09:14
| #2 |
| /// the machine /// TB-Ausbilder    | Trojanerbefall: Umleitung von Links hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
11.07.2013, 10:05
| #3 |
| | Trojanerbefall: Umleitung von Links Hallo Schrauber, danke schonmal, dass Du Dich der Sache annimmst. Das Link-Problem habe ich inzwischen lösen können.
__________________Hier die FRST.txt FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by MWeber (administrator) on 11-07-2013 11:00:44
Running from C:\Users\mweber\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SAsrv.exe
(Skype Technologies) C:\Program Files (x86)\Skype\Updater\Updater.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\system32\PrintIsolationHost.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Spotify Ltd) C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(GARMIN Corp.) C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe
(NTeWORKS) C:\Program Files (x86)\PicPick\picpick.exe
(Microsoft Corporation) C:\Windows\Speech\Common\sapisvr.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ForteConfig] - C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2011-10-14] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392472 2011-10-14] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [416024 2011-10-14] (Intel Corporation)
HKLM\...\Run: [PSQLLauncher] - "C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe" /startup [85864 2012-09-21] (Authentec Inc.)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1199000 2013-02-20] (Spotify Ltd)
HKCU\...\Run: [BIBLauncher] - C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe [912688 2012-12-10] ()
HKCU\...\Run: [ANT Agent] - C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe [14749544 2012-03-23] (GARMIN Corp.)
HKCU\...\Run: [PicPick Start] - C:\Program Files (x86)\PicPick\picpick.exe /startup [11479896 2013-04-05] (NTeWORKS)
HKCU\...\Run: [Speech Recognition] - "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup [44544 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [vrxcejut] - C:\Users\mweber\AppData\Roaming\Jcfob\ycfxejut.exe [x]
HKCU\...\Run: [windq] - "C:\Users\mweber\AppData\Roaming\windq.exe" -autorun [x]
HKCU\...\Run: [kxuizhes] - C:\Users\mweber\AppData\Roaming\Ljoxpifu\nbtyrzhes.exe [x]
HKCU\...\Run: [wingx] - "C:\Users\mweber\AppData\Roaming\wingx.exe" -autorun [x]
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [IMSS] - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [112408 2012-04-17] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-02] (Research In Motion Limited)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] - C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe [264704 2010-03-17] ()
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [DPAPIKeyMig] - %SystemRoot%\system32\dpapimig.exe -quiet [74752 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [WAB Migrate] - %ProgramFiles%\Windows Mail\wab.exe /Upgrade [516096 2010-11-21] (Microsoft Corporation)
HKU\UpdatusUser\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\system32\nvinitx.dll [245872 2013-01-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-01-11] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.msn.com
HKCU SearchScopes: DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=111304&tt=3412_3&babsrc=SP_ss&mntrId=74431c2f0000000000000024d7e720d9
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://search.babylon.com/?q={searchTerms}&affID=111304&tt=3412_3&babsrc=SP_ss&mntrId=74431c2f0000000000000024d7e720d9
BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.100.241
FireFox:
========
FF ProfilePath: C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default
FF Homepage: hxxp://google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @fuzebox.com/Fuze Meeting NPAPI Plugin,version=1.0.0.1 - C:\Users\mweber\AppData\Local\Fuze Box\Fuze Meeting\npfuzeshare.dll ( )
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Extension: undoclosedtabsbutton - C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\Extensions\undoclosedtabsbutton@supernova00.biz.xpi
FF Extension: No Name - C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [VIP@verisign.com] C:\Program Files (x86)\Symantec\VIP Access Client\
FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\
==================== Services (Whitelisted) =================
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
S3 OpenVPNService; C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpnserv.exe [39936 2010-03-17] ()
S2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84088 2011-04-13] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-01-11] (NVIDIA Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [44344 2012-10-18] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 11:00 - 2013-07-11 11:00 - 00000000 ____D C:\FRST
2013-07-11 11:00 - 2013-07-11 10:55 - 01777775 ____A (Farbar) C:\Users\mweber\Desktop\FRST64.exe
2013-07-11 09:21 - 2013-07-11 09:25 - 00134370 ____A C:\OTL.Txt
2013-07-11 09:18 - 2013-07-10 15:54 - 00602112 ____A (OldTimer Tools) C:\OTL.exe
2013-07-10 14:52 - 2013-07-10 14:52 - 00046501 ____A C:\Users\mweber\Desktop\bookmarks-2013-07-10.json
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 14:47 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-10 13:57 - 2013-06-12 01:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 13:57 - 2013-06-12 01:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 13:57 - 2013-06-12 00:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 13:57 - 2013-06-12 00:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 13:57 - 2013-06-07 05:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 13:57 - 2013-06-07 04:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 13:54 - 2013-07-10 13:54 - 00019534 ____A C:\Users\mweber\Desktop\AVSCAN-20130708-153233-ED44747B.LOG
2013-07-10 13:52 - 2013-07-10 13:58 - 88691984 ____A (Microsoft Corporation) C:\Users\mweber\Downloads\msert(1).exe
2013-07-10 13:51 - 2013-07-10 13:52 - 01048576 ____A C:\Users\mweber\Downloads\msert.exe
2013-07-10 13:50 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 13:50 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 13:49 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 13:49 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 13:49 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 13:49 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 13:49 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 11:50 - 2013-07-11 10:39 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client
2013-07-10 11:50 - 2013-07-10 11:50 - 00000000 ____D C:\Program Files (x86)\Astaro
2013-07-10 10:24 - 2013-07-10 17:22 - 00013524 ____A ****
2013-07-08 15:33 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-08 15:33 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-08 15:33 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-08 15:33 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-08 15:33 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-08 15:33 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-08 15:33 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-08 15:33 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-08 15:33 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-07-08 15:33 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-07-08 15:32 - 2013-07-08 15:32 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Avira
2013-07-08 12:48 - 2013-07-08 12:49 - 01688642 ____A C:\Users\mweber\Downloads\history(4).hst
2013-07-08 12:42 - 2013-07-08 12:43 - 00353899 ____A C:\Users\mweber\Downloads\HPInst(3).IMG
2013-07-08 12:42 - 2013-07-08 12:42 - 00353899 ____A C:\Users\mweber\Downloads\HPInst(2).IMG
2013-07-08 10:43 - 2013-07-11 10:59 - 00000302 ____A C:\Windows\Tasks\BNIJ.job
2013-07-08 10:43 - 2013-07-08 10:43 - 00471040 _RASH C:\Windows\SysWOW64\C_1361D.dll
2013-07-08 10:43 - 2013-07-08 10:43 - 00002582 ____A C:\Windows\System32\Tasks\BNIJ
2013-07-07 17:38 - 2013-07-07 17:38 - 05280184 ____A (Privax Ltd) C:\Users\mweber\Downloads\HMA-Pro-VPN-2.8.0.7-install.exe
2013-07-07 17:38 - 2013-07-07 17:38 - 00181064 ____A (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-07-07 08:59 - 2013-07-09 16:46 - 00012585 ____A C:\Users\mweber\Desktop\***.xlsx
2013-07-06 22:50 - 2013-07-08 10:30 - 00022330 ____A C:\Users\mweber\Desktop\Commitment calculation 130705 (rm)-we.xlsx
2013-07-05 17:31 - 2013-07-05 17:38 - 00383914 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v1.pptx
2013-07-04 17:55 - 2013-07-04 17:55 - 01862079 ____A C:\Users\mweber\Desktop\20130704 HV Intro.pptx
2013-07-04 17:47 - 2013-07-04 17:47 - 00012992 ____A C:\Users\mweber\Desktop\GvH Kapitalbindung Aufstellung Fund 4 5.xlsx
2013-07-04 15:03 - 2013-07-04 15:03 - 00230519 ____A C:\Users\mweber\Desktop\2013-05-31 Lecturio Reporting.xlsx
2013-07-04 15:00 - 2013-07-04 15:00 - 00046548 ____A C:\Users\mweber\Desktop\2013-02-26 Lecturio captable current.xlsx
2013-07-03 17:03 - 2013-07-04 14:53 - 00365296 ____A C:\Users\mweber\Desktop\2013-07-22 250togo.pptx
2013-07-03 10:29 - 2013-07-03 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 19:36 - 2013-07-02 19:36 - 02975466 ____A C:\Users\mweber\Desktop\Kopie von Delivery Hero Consolidated Budget v26 (Output Sheets Only).xlsx
2013-06-28 10:28 - 2013-06-28 10:28 - 10985355 ____A C:\Users\mweber\Downloads\May 13.zip
2013-06-27 17:05 - 2013-06-27 17:05 - 04780759 ____A C:\Users\mweber\Desktop\20130627 Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 13:41 - 2013-06-27 13:41 - 04782146 ____A C:\Users\mweber\Desktop\Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-26 18:13 - 2013-06-26 18:13 - 02022001 ____A C:\Users\mweber\Documents\Track record Q4_2011 versus Q1_2013.xlsx
2013-06-26 16:08 - 2013-06-26 16:08 - 00003086 ____A C:\Windows\System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8}
2013-06-25 19:54 - 2013-06-28 10:41 - 00747171 ____A C:\Users\mweber\Desktop\Jabong India May-13.xlsx
2013-06-25 19:54 - 2013-06-28 10:41 - 00496909 ____A C:\Users\mweber\Desktop\Lamoda Kazakhstan May-13.xlsx
2013-06-25 19:54 - 2013-06-28 10:41 - 00492047 ____A C:\Users\mweber\Desktop\Lamoda Russia May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00535177 ____A C:\Users\mweber\Desktop\Dafiti Group May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00489732 ____A C:\Users\mweber\Desktop\Dafiti Brazil May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00479399 ____A C:\Users\mweber\Desktop\Lamoda Group May-13.xlsx
2013-06-25 19:07 - 2013-06-28 10:42 - 00739591 ____A C:\Users\mweber\Desktop\Linio Venezuela May-13.xlsx
2013-06-25 19:06 - 2013-06-28 10:42 - 00759246 ____A C:\Users\mweber\Desktop\Linio Peru May-13.xlsx
2013-06-25 19:05 - 2013-06-28 10:42 - 00683642 ____A C:\Users\mweber\Desktop\Linio Mexico May-13.xlsx
2013-06-25 19:03 - 2013-06-28 10:42 - 00844432 ____A C:\Users\mweber\Desktop\Linio Group May-13.xlsx
2013-06-25 19:02 - 2013-06-28 10:42 - 00794280 ____A C:\Users\mweber\Desktop\Linio Colombia May-13.xlsx
2013-06-25 19:01 - 2013-06-28 10:41 - 00577941 ____A C:\Users\mweber\Desktop\Lazada Vietnam May-13.xlsx
2013-06-25 19:00 - 2013-06-28 10:41 - 00699036 ____A C:\Users\mweber\Desktop\Lazada Thailand May-13.xlsx
2013-06-25 18:59 - 2013-06-28 10:41 - 01232783 ____A C:\Users\mweber\Desktop\Lazada Group May-13.xlsx
2013-06-25 18:57 - 2013-06-28 10:41 - 00777564 ____A C:\Users\mweber\Desktop\Lazada Philippines May-13.xlsx
2013-06-25 18:56 - 2013-06-28 10:41 - 00672022 ____A C:\Users\mweber\Desktop\Lazada Malaysia May-13.xlsx
2013-06-25 18:55 - 2013-06-28 10:41 - 00484396 ____A C:\Users\mweber\Desktop\Lazada Indonesia May-13.xlsx
2013-06-25 14:02 - 2013-06-26 09:00 - 00014417 ____A C:\Users\mweber\Desktop\Interne Erlösverteilung HV4.xlsx
2013-06-25 13:56 - 2013-06-25 13:56 - 00010707 ____A C:\Users\mweber\Desktop\Mappe1.xlsx
2013-06-25 10:21 - 2013-06-25 10:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-25 10:20 - 2013-06-25 10:21 - 41404760 ____A (Apple Inc.) C:\Users\mweber\Downloads\QuickTimeInstaller.exe
2013-06-25 10:20 - 2013-06-25 10:20 - 07872648 ____A (Adobe Systems Inc.) C:\Users\mweber\Downloads\Shockwave_Installer_Slim.exe
2013-06-19 09:55 - 2013-06-19 09:57 - 00086355 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19-after KV step put.xlsx
2013-06-17 18:56 - 2013-06-17 18:56 - 00040665 ____A C:\Users\mweber\Desktop\Cap Table Secondary KV_v5 (rm) we.xlsx
2013-06-17 15:28 - 2013-06-17 15:28 - 05575116 ____A C:\Users\mweber\Desktop\2013-06-14 Westwing Group Financial Reporting May 2013-we.xlsm
2013-06-17 08:57 - 2013-06-17 08:57 - 00064201 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19.xlsx
==================== One Month Modified Files and Folders =======
2013-07-11 11:00 - 2013-07-11 11:00 - 00000000 ____D C:\FRST
2013-07-11 10:59 - 2013-07-08 10:43 - 00000302 ____A C:\Windows\Tasks\BNIJ.job
2013-07-11 10:59 - 2013-02-20 17:27 - 00000120 ____A C:\Windows\system32\config\netlogon.ftl
2013-07-11 10:59 - 2013-02-20 17:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-11 10:59 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 10:59 - 2009-07-14 06:51 - 00067883 ____A C:\Windows\setupact.log
2013-07-11 10:58 - 2013-02-20 17:17 - 01876609 ____A C:\Windows\WindowsUpdate.log
2013-07-11 10:58 - 2009-07-14 06:45 - 00021680 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 10:58 - 2009-07-14 06:45 - 00021680 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 10:55 - 2013-07-11 11:00 - 01777775 ____A (Farbar) C:\Users\mweber\Desktop\FRST64.exe
2013-07-11 10:39 - 2013-07-10 11:50 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client
2013-07-11 09:25 - 2013-07-11 09:21 - 00134370 ____A C:\OTL.Txt
2013-07-11 08:50 - 2011-04-12 09:43 - 00647376 ____A C:\Windows\system32\perfh007.dat
2013-07-11 08:50 - 2011-04-12 09:43 - 00127404 ____A C:\Windows\system32\perfc007.dat
2013-07-11 08:50 - 2009-07-14 07:13 - 01480602 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 08:18 - 2013-02-20 19:19 - 00000000 ____D C:\Persönliche Ordner Outlook
2013-07-11 08:18 - 2013-02-20 19:14 - 00000000 ____D C:\Users\mweber\Persönliche Ordner Outlook
2013-07-10 16:03 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-10 15:54 - 2013-07-11 09:18 - 00602112 ____A (OldTimer Tools) C:\OTL.exe
2013-07-10 14:58 - 2013-02-20 19:50 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-10 14:58 - 2013-02-20 19:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-10 14:58 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 14:58 - 2010-11-21 05:47 - 00150288 ____A C:\Windows\PFRO.log
2013-07-10 14:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 14:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 14:58 - 2009-07-14 06:45 - 00337128 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-10 14:52 - 2013-07-10 14:52 - 00046501 ____A C:\Users\mweber\Desktop\bookmarks-2013-07-10.json
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 13:58 - 2013-07-10 13:52 - 88691984 ____A (Microsoft Corporation) C:\Users\mweber\Downloads\msert(1).exe
2013-07-10 13:58 - 2013-02-20 17:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-10 13:56 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2013-07-10 13:54 - 2013-07-10 13:54 - 00019534 ____A C:\Users\mweber\Desktop\AVSCAN-20130708-153233-ED44747B.LOG
2013-07-10 13:52 - 2013-07-10 13:51 - 01048576 ____A C:\Users\mweber\Downloads\msert.exe
2013-07-10 11:50 - 2013-07-10 11:50 - 00000000 ____D C:\Program Files (x86)\Astaro
2013-07-10 09:59 - 2013-07-09 16:41 - 00000000 ____D C:\Users\mweber\Documents\stinger64-epo
2013-07-10 09:59 - 2013-07-09 16:41 - 00000000 ____D C:\Program Files\stinger
2013-07-09 22:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-09 21:30 - 2013-05-13 17:37 - 00000000 ____D C:\ProgramData\boost_interprocess
2013-07-09 17:12 - 2013-07-09 17:12 - 00047514 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6 v2.xlsx
2013-07-09 16:46 - 2013-07-07 08:59 - 00012585 ____A C:\Users\mweber\Desktop\***.xlsx
2013-07-09 16:42 - 2013-07-09 16:42 - 00177680 ____A (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.45d9.deleteme
2013-07-09 16:40 - 2013-07-09 16:40 - 00000116 ___RH C:\Users\mweber\Downloads\Stinger.opt
2013-07-09 16:40 - 2013-07-08 16:11 - 00000000 ____D C:\Program Files (x86)\stinger
2013-07-09 13:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-09 10:06 - 2013-07-09 10:06 - 01864358 ____A C:\Users\mweber\Desktop\LP introduction master_Juli-we.pptx
2013-07-09 09:49 - 2013-04-10 17:58 - 00000000 ____A C:\ctapi_out_gr.txt
2013-07-08 22:16 - 2013-07-08 22:16 - 00047935 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6 v1.xlsx
2013-07-08 22:12 - 2013-07-08 22:08 - 00389807 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v2.pptx
2013-07-08 21:18 - 2013-07-08 21:18 - 00047506 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6.xlsx
2013-07-08 16:11 - 2013-07-08 16:11 - 00490268 ____A C:\Users\mweber\Downloads\runtime.dat
2013-07-08 16:11 - 2013-07-08 16:11 - 00000000 ____D C:\Stinger_Quarantine
2013-07-08 16:11 - 2013-07-08 16:11 - 00000000 ____A C:\Users\mweber\Downloads\Stinger_08072013_161108.html
2013-07-08 16:07 - 2013-07-08 16:07 - 01808985 ____A C:\Users\mweber\Desktop\2013-06-26 Drawdowns distributions overview Fund IV LP.xlsx
2013-07-08 16:07 - 2013-07-08 16:07 - 00046545 ____A C:\Users\mweber\Desktop\Commitment calculation 130708 (rm).xlsx
2013-07-08 15:46 - 2013-07-08 15:46 - 00036704 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Cange of Reinvest pool.xlsx
2013-07-08 15:43 - 2013-07-08 15:43 - 00046832 ____A C:\Users\mweber\Documents\20130708 Commitment calculation Cange of Reinvest pool.xlsx
2013-07-08 15:32 - 2013-07-08 15:32 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Avira
2013-07-08 12:49 - 2013-07-08 12:48 - 01688642 ____A C:\Users\mweber\Downloads\history(4).hst
2013-07-08 12:43 - 2013-07-08 12:42 - 00353899 ____A C:\Users\mweber\Downloads\HPInst(3).IMG
2013-07-08 12:42 - 2013-07-08 12:42 - 00353899 ____A C:\Users\mweber\Downloads\HPInst(2).IMG
2013-07-08 10:43 - 2013-07-08 10:43 - 00471040 _RASH C:\Windows\SysWOW64\C_1361D.dll
2013-07-08 10:43 - 2013-07-08 10:43 - 00002582 ____A C:\Windows\System32\Tasks\BNIJ
2013-07-08 10:30 - 2013-07-06 22:50 - 00022330 ____A C:\Users\mweber\Desktop\Commitment calculation 130705 (rm)-we.xlsx
2013-07-07 17:38 - 2013-07-07 17:38 - 05280184 ____A (Privax Ltd) C:\Users\mweber\Downloads\HMA-Pro-VPN-2.8.0.7-install.exe
2013-07-07 17:38 - 2013-07-07 17:38 - 00181064 ____A (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-07-07 17:38 - 2013-04-09 16:38 - 00001151 ____A C:\Users\Public\Desktop\HMA! Pro VPN.lnk
2013-07-07 17:38 - 2013-04-09 16:38 - 00000000 ____D C:\Program Files (x86)\HMA! Pro VPN
2013-07-05 17:38 - 2013-07-05 17:31 - 00383914 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v1.pptx
2013-07-04 17:55 - 2013-07-04 17:55 - 01862079 ____A C:\Users\mweber\Desktop\20130704 HV Intro.pptx
2013-07-04 17:47 - 2013-07-04 17:47 - 00012992 ____A C:\Users\mweber\Desktop\GvH Kapitalbindung Aufstellung Fund 4 5.xlsx
2013-07-04 15:03 - 2013-07-04 15:03 - 00230519 ____A C:\Users\mweber\Desktop\2013-05-31 Lecturio Reporting.xlsx
2013-07-04 15:00 - 2013-07-04 15:00 - 00046548 ____A C:\Users\mweber\Desktop\2013-02-26 Lecturio captable current.xlsx
2013-07-04 14:53 - 2013-07-03 17:03 - 00365296 ____A C:\Users\mweber\Desktop\2013-07-22 250togo.pptx
2013-07-03 22:13 - 2013-02-20 18:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 12:42 - 2013-07-03 10:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 19:36 - 2013-07-02 19:36 - 02975466 ____A C:\Users\mweber\Desktop\Kopie von Delivery Hero Consolidated Budget v26 (Output Sheets Only).xlsx
2013-06-30 19:59 - 2013-02-20 19:38 - 00000000 ____D C:\Users\mweber\AppData\Local\Lookeen
2013-06-28 10:42 - 2013-06-25 19:07 - 00739591 ____A C:\Users\mweber\Desktop\Linio Venezuela May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:06 - 00759246 ____A C:\Users\mweber\Desktop\Linio Peru May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:05 - 00683642 ____A C:\Users\mweber\Desktop\Linio Mexico May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:03 - 00844432 ____A C:\Users\mweber\Desktop\Linio Group May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:02 - 00794280 ____A C:\Users\mweber\Desktop\Linio Colombia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00747171 ____A C:\Users\mweber\Desktop\Jabong India May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00496909 ____A C:\Users\mweber\Desktop\Lamoda Kazakhstan May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00492047 ____A C:\Users\mweber\Desktop\Lamoda Russia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00535177 ____A C:\Users\mweber\Desktop\Dafiti Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00489732 ____A C:\Users\mweber\Desktop\Dafiti Brazil May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00479399 ____A C:\Users\mweber\Desktop\Lamoda Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:01 - 00577941 ____A C:\Users\mweber\Desktop\Lazada Vietnam May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:00 - 00699036 ____A C:\Users\mweber\Desktop\Lazada Thailand May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:59 - 01232783 ____A C:\Users\mweber\Desktop\Lazada Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:57 - 00777564 ____A C:\Users\mweber\Desktop\Lazada Philippines May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:56 - 00672022 ____A C:\Users\mweber\Desktop\Lazada Malaysia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:55 - 00484396 ____A C:\Users\mweber\Desktop\Lazada Indonesia May-13.xlsx
2013-06-28 10:28 - 2013-06-28 10:28 - 10985355 ____A C:\Users\mweber\Downloads\May 13.zip
2013-06-28 10:23 - 2013-04-09 22:24 - 00011121 ____A C:\Users\mweber\Desktop\Stromkosten.xlsx
2013-06-27 17:05 - 2013-06-27 17:05 - 04780759 ____A C:\Users\mweber\Desktop\20130627 Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 13:41 - 2013-06-27 13:41 - 04782146 ____A C:\Users\mweber\Desktop\Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 10:58 - 2011-09-16 17:54 - 00000072 ____A C:\Users\Public\LMDebug.log
2013-06-27 09:37 - 2013-02-20 19:56 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Skype
2013-06-26 18:13 - 2013-06-26 18:13 - 02022001 ____A C:\Users\mweber\Documents\Track record Q4_2011 versus Q1_2013.xlsx
2013-06-26 16:08 - 2013-06-26 16:08 - 00003086 ____A C:\Windows\System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8}
2013-06-26 09:00 - 2013-06-25 14:02 - 00014417 ____A C:\Users\mweber\Desktop\Interne Erlösverteilung HV4.xlsx
2013-06-25 13:56 - 2013-06-25 13:56 - 00010707 ____A C:\Users\mweber\Desktop\Mappe1.xlsx
2013-06-25 10:22 - 2013-06-25 10:21 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-25 10:21 - 2013-06-25 10:20 - 41404760 ____A (Apple Inc.) C:\Users\mweber\Downloads\QuickTimeInstaller.exe
2013-06-25 10:20 - 2013-06-25 10:20 - 07872648 ____A (Adobe Systems Inc.) C:\Users\mweber\Downloads\Shockwave_Installer_Slim.exe
2013-06-25 10:19 - 2013-02-20 19:37 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-25 10:19 - 2013-02-20 19:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-25 10:19 - 2013-02-20 19:36 - 00000000 ____D C:\Users\mweber\AppData\Local\Adobe
2013-06-24 10:07 - 2013-06-05 09:56 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Jcfob
2013-06-24 00:57 - 2013-02-20 18:40 - 78277128 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-19 09:57 - 2013-06-19 09:55 - 00086355 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19-after KV step put.xlsx
2013-06-17 18:56 - 2013-06-17 18:56 - 00040665 ____A C:\Users\mweber\Desktop\Cap Table Secondary KV_v5 (rm) we.xlsx
2013-06-17 15:28 - 2013-06-17 15:28 - 05575116 ____A C:\Users\mweber\Desktop\2013-06-14 Westwing Group Financial Reporting May 2013-we.xlsm
2013-06-17 08:57 - 2013-06-17 08:57 - 00064201 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19.xlsx
2013-06-12 14:59 - 2013-06-10 10:55 - 00021389 ____A C:\Users\mweber\Desktop\fundkpichj11062013 (3).xlsx
2013-06-12 01:43 - 2013-07-10 13:57 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-12 01:25 - 2013-07-10 13:57 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-12 00:51 - 2013-07-10 13:57 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 00:50 - 2013-07-10 13:57 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 09:21
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- Und hier die Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-07-2013 04 Ran by MWeber at 2013-07-11 11:01:02 Running from C:\Users\mweber\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe AIR (x32 Version: 3.6.0.5970) Adobe Flash Player 10 ActiveX (x32 Version: 10.0.12.36) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122) Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) Astaro SSL VPN Client 1.7 (x32 Version: 1.7) Attachments Processor for Outlook (x32 Version: 4.4.2) Avira Professional Security (x32 Version: 12.1.9.1580) BlackBerry Desktop Software 7.1 (x32 Version: 7.1.0.37) Bonjour (Version: 3.0.0.10) Burn.Now 4.5 (x32 Version: 4.5.0) Business-in-a-Box (x32 Version: 5.0.4) Canon MX870 series MP Drivers Canon My Printer (x32 Version: 3.0.0) Conexant 20672 SmartAudio HD (Version: 8.32.23.5) Corel Burn.Now Lenovo Edition (x32 Version: 4.5.0) Corel DVD MovieFactory 7 (x32 Version: 7.0.0) Corel DVD MovieFactory Lenovo Edition (x32 Version: 7.0.0) Corel WinDVD (x32 Version: 10.0.5.828) CutePDF Writer 3.0 (Version: 3.0) Direct DiscRecorder (x32 Version: 1.00.0000) dows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (Version: 07/07/2009 1.12.2) Fuze Meeting (x32 Version: 1.10.44835) Garmin ANT Agent (x32 Version: 2.3.3) Garmin Training Center (x32 Version: 3.6.5) Garmin USB Drivers (x32 Version: 2.3.1.0) History CL 1.0 (x32) HMA! Pro VPN 2.8.0.7 (x32 Version: 2.8.0.7) homeputer CL Studio Version 4.0 (x32) Integrated Camera Driver Installer Package Ver.1.1.0.1147 (x32 Version: 1.1.0.1147) Integrated Camera TWAIN (x32 Version: 1.0.11.1223) Intel PROSet Wireless Intel PROSet Wireless (x32) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0) Intel(R) Management Engine Components (x32 Version: 7.1.50.1172) Intel(R) Network Connections Drivers (Version: 16.8) Intel(R) Processor Graphics (x32 Version: 8.15.10.2538) Intel(R) PROSet/Wireless WiFi-Software (Version: 14.03.0000) Intel(R) Wireless Display Intel(R) Wireless Display (x32 Version: 2.0.31.0) iTunes (Version: 11.0.1.12) Lenovo Power Management Driver (Version: 1.67.00.02) Lookeen Version 8.3.1.5156 (x32 Version: 8.3.1.5156) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Outlook-Sicherung für Persönliche Ordner (x32 Version: 1.10.0.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0) NVIDIA 3D Vision Treiber 311.00 (Version: 311.00) NVIDIA Grafiktreiber 311.00 (Version: 311.00) NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA Optimus 1.11.3 (Version: 1.11.3) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1100) NVIDIA Systemsteuerung 311.00 (Version: 311.00) NVIDIA Update Components (Version: 1.11.3) PicPick (x32 Version: 3.2.4) PSPad editor (x32 Version: 4.5.7.2450) QuickTime (x32 Version: 7.74.80.86) RICOH_Media_Driver_v2.14.18.01 (x32 Version: 2.14.18.01) Skype™ 6.2 (x32 Version: 6.2.106) Spotify (HKCU Version: 0.8.5.1356.gd1d40f3a) swMSM (x32 Version: 12.0.0.1) ThinkPad UltraNav Driver (Version: 16.2.19.7) ThinkVantage Fingerprint Software (Version: 5.9.8.7264) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32) VIPAccess (x32 Version: 2.0.1.91) Wartung Samsung CLX-6220 Series (x32) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0) ==================== Restore Points ========================= ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {165113B5-9B7B-4F21-A583-24010DA54A0C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {28166543-1E87-4130-9536-0420D1A40FE0} - System32\Tasks\Microsoft\Windows\SyncCenter\S-1-5-21-606747145-1425521274-725345543-1124\{750FDF10-2A26-11D1-A3EA-080036587F03}\Synchronisierung beim Start => C:\Windows\system32\mobsync.exe [2010-11-21] (Microsoft Corporation) Task: {548E9983-355E-4153-A1FA-C7008673E590} - System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8} => C:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03] (Mozilla Corporation) Task: {AD46FD5E-E79C-4CD3-9F98-E88A08ACAAEB} - System32\Tasks\BNIJ => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {EDF7A6FD-7C64-4294-9D1C-F577DCC6E119} - System32\Tasks\WPD\SqmUpload_S-1-5-21-606747145-1425521274-725345543-1124 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: C:\Windows\Tasks\BNIJ.job => C:\Windows\system32\rundll32.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/11/2013 10:59:03 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/11/2013 10:55:21 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/11/2013 08:44:38 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/11/2013 08:18:21 AM) (Source: Avira Antivirus) (User: NT-AUTORITÄT) Description: Das Update von HV-MW-001 (127.0.0.1) ist fehlgeschlagen. Das Engine/VDF Set konnte nicht validiert werden. . Es wurden keine neuen Dateien geladen. Error: (07/10/2013 05:29:12 PM) (Source: Application Hang) (User: ) Description: Programm OUTLOOK.EXE, Version 12.0.6668.5000 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 16e0 Startzeit: 01ce7d820bf00ef4 Endzeit: 0 Anwendungspfad: C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE Berichts-ID: 6ee84c35-e975-11e2-8ee0-f0def181052d Error: (07/10/2013 05:14:59 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT) Description: Das Update von HV-MW-001 (169.254.163.44) ist fehlgeschlagen. Während des Herunterladens ist ein Fehler aufgetreten. . Es wurden keine neuen Dateien geladen. Error: (07/10/2013 04:09:00 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT) Description: Das Update von HV-MW-001 (127.0.0.1) ist fehlgeschlagen. Während des Herunterladens ist ein Fehler aufgetreten. . Es wurden keine neuen Dateien geladen. Error: (07/10/2013 04:04:00 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/10/2013 02:58:46 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/10/2013 09:07:03 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (07/11/2013 10:59:31 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NETWORXS) Description: Fehler bei der Verarbeitung der Gruppenrichtlinie. Der Versuch, die Datei "\\networxs\sysvol\networxs\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini" von einem Domänencontroller zu lesen, war nicht erfolgreich. Die Gruppenrichtlinieneinstellungen dürfen nicht angewendet werden, bis dieses Ereignis behoben ist. Dies ist möglicherweise ein vorübergehendes Problem, das mindestens eine der folgenden Ursachen haben kann: a) Namensauflösung/Netzwerkverbindung mit dem aktuellen Domänencontroller. b) Wartezeit des Dateireplikationsdienstes (eine auf einem anderen Domänencontroller erstellte Datei hat nicht auf dem aktuellen Domänencontroller repliziert). c) Der DFS-Client (Distributed File System) wurde deaktiviert. Error: (07/11/2013 10:59:08 AM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom Error: (07/11/2013 10:59:03 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT) Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator. Error: (07/11/2013 10:59:02 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/11/2013 10:59:02 AM) (Source: NETLOGON) (User: ) Description: Der Computer konnte eine sichere Sitzung mit einem Domänencontroller in der Domäne NETWORXS aufgrund der folgenden Ursache nicht einrichten: %%1311 Dies kann zu Authentifizierungsproblemen führen. Stellen Sie sicher, dass der Computer mit dem Netzwerk verbunden ist. Wenden Sie sich an den Domänenadministrator, wenn das Problem weiterhin besteht. ZUSÄTZLICHE INFORMATIONEN Wenn dieser Computer ein Domänencontroller der bestimmten Domäne ist, wird eine sichere Sitzung zum primären Domänencontrolleremulator in der bestimmten Domäne eingerichtet. Andernfalls richtet dieser Computer eine sichere Sitzung zu einem beliebigen Domänencontroller in der bestimmten Domäne ein. Error: (07/11/2013 10:56:28 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NETWORXS) Description: Fehler bei der Verarbeitung der Gruppenrichtlinie. Der Versuch, die Datei "\\networxs\sysvol\networxs\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini" von einem Domänencontroller zu lesen, war nicht erfolgreich. Die Gruppenrichtlinieneinstellungen dürfen nicht angewendet werden, bis dieses Ereignis behoben ist. Dies ist möglicherweise ein vorübergehendes Problem, das mindestens eine der folgenden Ursachen haben kann: a) Namensauflösung/Netzwerkverbindung mit dem aktuellen Domänencontroller. b) Wartezeit des Dateireplikationsdienstes (eine auf einem anderen Domänencontroller erstellte Datei hat nicht auf dem aktuellen Domänencontroller repliziert). c) Der DFS-Client (Distributed File System) wurde deaktiviert. Error: (07/11/2013 10:55:27 AM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom Error: (07/11/2013 10:55:22 AM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT) Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator. Error: (07/11/2013 10:55:21 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/11/2013 10:55:21 AM) (Source: NETLOGON) (User: ) Description: Der Computer konnte eine sichere Sitzung mit einem Domänencontroller in der Domäne NETWORXS aufgrund der folgenden Ursache nicht einrichten: %%1311 Dies kann zu Authentifizierungsproblemen führen. Stellen Sie sicher, dass der Computer mit dem Netzwerk verbunden ist. Wenden Sie sich an den Domänenadministrator, wenn das Problem weiterhin besteht. ZUSÄTZLICHE INFORMATIONEN Wenn dieser Computer ein Domänencontroller der bestimmten Domäne ist, wird eine sichere Sitzung zum primären Domänencontrolleremulator in der bestimmten Domäne eingerichtet. Andernfalls richtet dieser Computer eine sichere Sitzung zu einem beliebigen Domänencontroller in der bestimmten Domäne ein. Microsoft Office Sessions: ========================= Error: (06/30/2013 00:53:12 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3558 seconds with 60 seconds of active time. This session ended with a crash. Error: (06/24/2013 03:58:33 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 21046 seconds with 6960 seconds of active time. This session ended with a crash. Error: (04/10/2013 04:54:51 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 27862 seconds with 7680 seconds of active time. This session ended with a crash. Error: (04/09/2013 04:36:15 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 25785 seconds with 4680 seconds of active time. This session ended with a crash. Error: (04/09/2013 09:26:18 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1977 seconds with 960 seconds of active time. This session ended with a crash. Error: (04/08/2013 04:45:27 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 26621 seconds with 9720 seconds of active time. This session ended with a crash. Error: (04/05/2013 08:26:04 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 262 seconds with 180 seconds of active time. This session ended with a crash. Error: (03/29/2013 11:53:28 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2314 seconds with 1080 seconds of active time. This session ended with a crash. Error: (03/21/2013 02:10:45 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3049 seconds with 1620 seconds of active time. This session ended with a crash. Error: (03/12/2013 06:19:01 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 31 seconds with 0 seconds of active time. This session ended with a crash. ==================== Memory info =========================== Percentage of memory in use: 26% Total physical RAM: 8075.23 MB Available physical RAM: 5912.11 MB Total Pagefile: 16148.65 MB Available Pagefile: 13940.86 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:238.37 GB) (Free:86.42 GB) NTFS (Disk=0 Partition=2) Drive p: (Volume) (Network) (Total:1116.75 GB) (Free:770.37 GB) NTFS Drive s: () (Network) (Total:927.63 GB) (Free:622.82 GB) NTFS Drive w: (Volume) (Network) (Total:1116.75 GB) (Free:770.37 GB) NTFS Drive x: (Volume) (Network) (Total:1116.75 GB) (Free:770.37 GB) NTFS Drive y: () (Network) (Total:927.63 GB) (Free:622.82 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238 GB) (Disk ID: 011564D3) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=238 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
|
11.07.2013, 11:05
| #4 | |
| /// the machine /// TB-Ausbilder | Trojanerbefall: Umleitung von LinksCombofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 12:27
| #5 |
| | Trojanerbefall: Umleitung von Links Hi, es war ziemlich mühsam, alle Avira-Dienste und Tools zu beenden und trotzdem sie alle beendet waren, hat combofix gemotzt. Hoffe, das Ergebnis sagt trotzdem etwas aus: Code:
ATTFilter ComboFix 13-07-09.01 - MWeber 11.07.2013 13:17:29.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8075.5677 [GMT 2:00]
ausgeführt von:: c:\users\mweber\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\Autorun.inf
C:\Install.exe
c:\programdata\AMMYY
c:\programdata\AMMYY\hr
c:\programdata\AMMYY\hr3
c:\programdata\AMMYY\settings3.bin
c:\programdata\boost_interprocess\20130709205344.579598
c:\programdata\boost_interprocess\20130709205344.579598\windows_plug_in-start_up_queue
c:\programdata\Roaming
C:\root
c:\root\wpfdot.exe
c:\users\mweber\AppData\Local\assembly\tmp
c:\users\mweber\AppData\Roaming\JomCap.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-06-11 bis 2013-07-11 ))))))))))))))))))))))))))))))
.
.
2013-07-11 11:20 . 2013-07-11 11:20 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-07-11 09:00 . 2013-07-11 09:00 -------- d-----w- C:\FRST
2013-07-11 07:18 . 2013-07-10 13:54 602112 ----a-w- C:\OTL.exe
2013-07-10 12:47 . 2013-07-10 12:47 -------- d-----w- c:\users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 12:47 . 2013-07-10 12:47 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-10 12:47 . 2013-07-10 12:47 -------- d-----w- c:\programdata\Malwarebytes
2013-07-10 12:47 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-07-10 11:50 . 2013-05-06 06:03 1887744 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-10 11:50 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-10 09:50 . 2013-07-10 09:50 -------- d-----w- c:\program files (x86)\Astaro
2013-07-09 14:42 . 2013-07-09 14:42 177680 ----a-w- c:\windows\system32\mfevtps.exe.45d9.deleteme
2013-07-09 14:41 . 2013-07-10 07:59 -------- d-----w- c:\program files\stinger
2013-07-08 14:11 . 2013-07-08 14:11 -------- d-----w- C:\Stinger_Quarantine
2013-07-08 14:11 . 2013-07-09 14:40 -------- d-----w- c:\program files (x86)\stinger
2013-07-08 13:32 . 2013-07-08 13:32 -------- d-----w- c:\users\mweber\AppData\Roaming\Avira
2013-07-08 08:43 . 2013-07-08 08:43 471040 --sha-r- c:\windows\SysWow64\C_1361D.dll
2013-07-07 15:38 . 2013-07-07 15:38 181064 ----a-w- c:\windows\PSEXESVC.EXE
2013-06-25 08:22 . 2013-06-25 08:22 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2013-06-25 08:22 . 2013-06-25 08:22 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2013-06-25 08:22 . 2013-06-25 08:22 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2013-06-25 08:22 . 2013-06-25 08:22 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2013-06-25 08:22 . 2013-06-25 08:22 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2013-06-25 08:21 . 2013-06-25 08:22 -------- d-----w- c:\program files (x86)\QuickTime
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-25 08:19 . 2013-02-20 17:37 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-25 08:19 . 2013-02-20 17:37 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-23 22:57 . 2013-02-20 16:40 78277128 ----a-w- c:\windows\system32\MRT.exe
2013-05-01 01:59 . 2013-05-01 01:59 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2013-05-01 01:59 . 2013-05-01 01:59 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
2013-04-28 04:52 . 2013-04-28 04:52 61224 ----a-w- c:\windows\system32\ibmpmsvc.exe
2013-04-28 04:52 . 2013-04-28 04:52 60712 ----a-w- c:\windows\system32\ibmpmctl.exe
2013-04-28 04:52 . 2013-04-28 04:52 44800 ----a-w- c:\windows\system32\drivers\ibmpmdrv.sys
2013-04-28 04:52 . 2013-04-28 04:52 40232 ----a-w- c:\windows\system32\tpinspm.dll
2013-04-23 23:23 . 2013-04-23 23:23 178416 ----a-w- c:\windows\system32\SynTPCo14.dll
2013-04-23 23:23 . 2013-04-23 23:23 460528 ----a-w- c:\windows\system32\drivers\SynTP.sys
2013-04-23 23:23 . 2013-04-23 23:23 114416 ----a-w- c:\windows\SysWow64\SynTPCOM.dll
2013-04-23 23:23 . 2013-02-20 15:29 1048816 ----a-w- c:\windows\system32\SynCOM.dll
2013-04-23 23:22 . 2013-04-23 23:22 229616 ----a-w- c:\windows\system32\SynTPAPI.dll
2013-04-23 23:22 . 2013-04-23 23:22 540400 ----a-w- c:\windows\SysWow64\SynCOM.dll
2013-04-12 14:45 . 2013-06-03 12:51 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="c:\users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2013-02-20 1199000]
"BIBLauncher"="c:\program files (x86)\Business-in-a-Box\BIBLauncher.exe" [2012-12-10 912688]
"ANT Agent"="c:\program files (x86)\Garmin\ANT Agent\ANT Agent.exe" [2012-03-23 14749544]
"PicPick Start"="c:\program files (x86)\PicPick\picpick.exe" [2013-04-05 11479896]
"Speech Recognition"="c:\windows\Speech\Common\sapisvr.exe" [2009-07-14 44544]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2012-04-17 112408]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
"RIMBBLaunchAgent.exe"="c:\program files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe" [2011-11-02 90448]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-05-11 958576]
"NUSB3MON"="c:\program files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2009-11-20 106496]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"openvpn-gui"="c:\program files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe" [2010-03-17 264704]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-18 348664]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
.
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R4 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [x]
R4 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
R4 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 regi;regi;c:\windows\system32\drivers\regi.sys;c:\windows\SYSNATIVE\drivers\regi.sys [x]
S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdxc64.sys [x]
S2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe;c:\windows\SYSNATIVE\SAsrv.exe [x]
S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VIPAppService;VIPAppService;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe [x]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys;c:\windows\SYSNATIVE\DRIVERS\5U877.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-11 c:\windows\Tasks\BNIJ.job
- c:\windows\system32\rundll32.exe [2009-07-13 01:14]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-14 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-14 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-14 416024]
"PSQLLauncher"="c:\program files\ThinkVantage Fingerprint Software\launcher.exe" [2012-09-21 85864]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.100.241
FF - ProfilePath - c:\users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.de
.
.
------- Dateityp-Verknüpfung -------
.
txtfile="c:\program files (x86)\PSPad editor\PSPad.exe" "%1"
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-vrxcejut - c:\users\mweber\AppData\Roaming\Jcfob\ycfxejut.exe
Wow6432Node-HKCU-Run-windq - c:\users\mweber\AppData\Roaming\windq.exe
Wow6432Node-HKCU-Run-kxuizhes - c:\users\mweber\AppData\Roaming\Ljoxpifu\nbtyrzhes.exe
Wow6432Node-HKCU-Run-wingx - c:\users\mweber\AppData\Roaming\wingx.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10a.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10a.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10a.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-07-11 13:21:17
ComboFix-quarantined-files.txt 2013-07-11 11:21
.
Vor Suchlauf: 21 Verzeichnis(se), 92.286.791.680 Bytes frei
Nach Suchlauf: 25 Verzeichnis(se), 92.210.135.040 Bytes frei
.
- - End Of File - - 922C4868AB4D0329526575A501741638
A36C5E4F47E84449FF07ED3517B43A31
Martina |
|
11.07.2013, 12:57
| #6 |
| /// the machine /// TB-Ausbilder | Trojanerbefall: Umleitung von Links Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
FRST öffnen, Haken bei Additional setzen, scannen lassen, bitte beide Logfiles posten 
__________________ --> Trojanerbefall: Umleitung von Links |
|
11.07.2013, 13:24
| #7 |
| | Trojanerbefall: Umleitung von Links OK, hier erstmal die adwcleaner.txt: Code:
ATTFilter # AdwCleaner v2.304 - Datei am 11/07/2013 um 14:05:00 erstellt
# Aktualisiert am 03/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : MWeber - HV-MW-001
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\mweber\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\ProgramData\boost_interprocess
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\APN PIP
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Schlüssel Gelöscht : HKLM\Software\PIP
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v22.0 (de)
Datei : C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\prefs.js
[OK] Die Datei ist sauber.
*************************
AdwCleaner[S1].txt - [1385 octets] - [11/07/2013 14:05:00]
########## EOF - C:\AdwCleaner[S1].txt - [1445 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.0.7 (07.11.2013:1)
OS: Windows 7 Professional x64
Ran by MWeber on 11.07.2013 at 14:07:27,06
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\secman.dll
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\appid\{4d076ab4-7562-427a-b5d2-bd96e19dee56}
~~~ Files
Successfully deleted: [File] C:\eula.1028.txt
Successfully deleted: [File] C:\eula.1031.txt
Successfully deleted: [File] C:\eula.1033.txt
Successfully deleted: [File] C:\eula.1036.txt
Successfully deleted: [File] C:\eula.1040.txt
Successfully deleted: [File] C:\eula.1041.txt
Successfully deleted: [File] C:\eula.1042.txt
Successfully deleted: [File] C:\eula.2052.txt
Successfully deleted: [File] C:\install.res.1028.dll
Successfully deleted: [File] C:\install.res.1031.dll
Successfully deleted: [File] C:\install.res.1033.dll
Successfully deleted: [File] C:\install.res.1036.dll
Successfully deleted: [File] C:\install.res.1040.dll
Successfully deleted: [File] C:\install.res.1041.dll
Successfully deleted: [File] C:\install.res.1042.dll
Successfully deleted: [File] C:\install.res.2052.dll
Successfully deleted: [File] C:\install.res.3082.dll
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\mweber\AppData\Roaming\mozilla\firefox\profiles\scmdb34j.default\minidumps [10 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 11.07.2013 at 14:11:06,01
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by MWeber (administrator) on 11-07-2013 14:16:53
Running from C:\Users\mweber\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SAsrv.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Spotify Ltd) C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(NTeWORKS) C:\Program Files (x86)\PicPick\picpick.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ForteConfig] - C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2011-10-14] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392472 2011-10-14] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [416024 2011-10-14] (Intel Corporation)
HKLM\...\Run: [PSQLLauncher] - "C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe" /startup [85864 2012-09-21] (Authentec Inc.)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1199000 2013-02-20] (Spotify Ltd)
HKCU\...\Run: [BIBLauncher] - C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe [912688 2012-12-10] ()
HKCU\...\Run: [PicPick Start] - C:\Program Files (x86)\PicPick\picpick.exe /startup [11479896 2013-04-05] (NTeWORKS)
HKCU\...\Run: [Speech Recognition] - "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup [44544 2009-07-14] (Microsoft Corporation)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [IMSS] - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [112408 2012-04-17] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-02] (Research In Motion Limited)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] - C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe [264704 2010-03-17] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [DPAPIKeyMig] - %SystemRoot%\system32\dpapimig.exe -quiet [74752 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [WAB Migrate] - %ProgramFiles%\Windows Mail\wab.exe /Upgrade [516096 2010-11-21] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [245872 2013-01-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-01-11] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.100.241
FireFox:
========
FF ProfilePath: C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default
FF Homepage: hxxp://google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @fuzebox.com/Fuze Meeting NPAPI Plugin,version=1.0.0.1 - C:\Users\mweber\AppData\Local\Fuze Box\Fuze Meeting\npfuzeshare.dll ( )
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Extension: undoclosedtabsbutton - C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\Extensions\undoclosedtabsbutton@supernova00.biz.xpi
FF Extension: No Name - C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [VIP@verisign.com] C:\Program Files (x86)\Symantec\VIP Access Client\
FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\
==================== Services (Whitelisted) =================
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
S3 OpenVPNService; C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpnserv.exe [39936 2010-03-17] ()
R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84088 2011-04-13] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-01-11] (NVIDIA Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [44344 2012-10-18] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 14:16 - 2013-07-11 14:16 - 01777775 ____A (Farbar) C:\Users\mweber\Desktop\FRST64.exe
2013-07-11 14:11 - 2013-07-11 14:11 - 00001799 ____A C:\Users\mweber\Desktop\JRT.txt
2013-07-11 14:07 - 2013-07-11 14:07 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 14:05 - 2013-07-11 14:05 - 00001510 ____A C:\AdwCleaner[S1].txt
2013-07-11 14:04 - 2013-07-11 14:04 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\mweber\Desktop\JRT.exe
2013-07-11 14:01 - 2013-07-11 14:01 - 00650027 ____A C:\Users\mweber\Desktop\adwcleaner.exe
2013-07-11 13:21 - 2013-07-11 13:21 - 00016991 ____A C:\ComboFix.txt
2013-07-11 13:16 - 2013-07-11 13:21 - 00000000 ____D C:\ComboFix
2013-07-11 13:16 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-11 13:16 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-11 13:16 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-11 12:13 - 2013-07-11 13:21 - 00000000 ____D C:\Qoobox
2013-07-11 12:13 - 2013-07-11 13:20 - 00000000 ____D C:\Windows\erdnt
2013-07-11 12:12 - 2013-07-11 12:13 - 05087643 ____R (Swearware) C:\Users\mweber\Desktop\ComboFix.exe
2013-07-11 11:01 - 2013-07-11 11:01 - 00020351 ____A C:\Users\mweber\Desktop\Addition.txt
2013-07-11 11:00 - 2013-07-11 11:00 - 00000000 ____D C:\FRST
2013-07-11 09:21 - 2013-07-11 09:25 - 00134370 ____A C:\OTL.Txt
2013-07-11 09:18 - 2013-07-10 15:54 - 00602112 ____A (OldTimer Tools) C:\OTL.exe
2013-07-10 14:52 - 2013-07-10 14:52 - 00046501 ____A C:\Users\mweber\Desktop\bookmarks-2013-07-10.json
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 14:47 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-10 13:57 - 2013-06-12 01:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 13:57 - 2013-06-12 01:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 13:57 - 2013-06-12 00:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 13:57 - 2013-06-12 00:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 13:57 - 2013-06-07 05:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 13:57 - 2013-06-07 04:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 13:54 - 2013-07-10 13:54 - 00019534 ____A C:\Users\mweber\Desktop\AVSCAN-20130708-153233-ED44747B.LOG
2013-07-10 13:50 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 13:50 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 13:49 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 13:49 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 13:49 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 13:49 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 13:49 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 11:50 - 2013-07-11 10:39 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client
2013-07-10 11:50 - 2013-07-10 11:50 - 00000000 ____D C:\Program Files (x86)\Astaro
2013-07-10 10:24 - 2013-07-10 17:22 - 00013524 ____A
2013-07-08 15:33 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-08 15:33 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-08 15:33 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-08 15:33 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-08 15:33 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-08 15:33 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-08 15:33 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-08 15:33 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-08 15:33 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-07-08 15:33 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-07-08 15:32 - 2013-07-08 15:32 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Avira
2013-07-08 10:43 - 2013-07-11 14:08 - 00000302 ____A C:\Windows\Tasks\BNIJ.job
2013-07-08 10:43 - 2013-07-08 10:43 - 00471040 _RASH C:\Windows\SysWOW64\C_1361D.dll
2013-07-08 10:43 - 2013-07-08 10:43 - 00002582 ____A C:\Windows\System32\Tasks\BNIJ
2013-07-07 17:38 - 2013-07-07 17:38 - 00181064 ____A (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-07-07 08:59 - 2013-07-09 16:46 - 00012585 ____A C:\Users\mweber\Desktop\***.xlsx
2013-07-06 22:50 - 2013-07-08 10:30 - 00022330 ____A C:\Users\mweber\Desktop\Commitment calculation 130705 (rm)-we.xlsx
2013-07-05 17:31 - 2013-07-05 17:38 - 00383914 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v1.pptx
2013-07-04 17:55 - 2013-07-04 17:55 - 01862079 ____A C:\Users\mweber\Desktop\20130704 HV Intro.pptx
2013-07-04 17:47 - 2013-07-04 17:47 - 00012992 ____A C:\Users\mweber\Desktop\GvH Kapitalbindung Aufstellung Fund 4 5.xlsx
2013-07-04 15:03 - 2013-07-04 15:03 - 00230519 ____A C:\Users\mweber\Desktop\2013-05-31 Lecturio Reporting.xlsx
2013-07-04 15:00 - 2013-07-04 15:00 - 00046548 ____A C:\Users\mweber\Desktop\2013-02-26 Lecturio captable current.xlsx
2013-07-03 17:03 - 2013-07-04 14:53 - 00365296 ____A C:\Users\mweber\Desktop\2013-07-22 250togo.pptx
2013-07-03 10:29 - 2013-07-03 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 19:36 - 2013-07-02 19:36 - 02975466 ____A C:\Users\mweber\Desktop\Kopie von Delivery Hero Consolidated Budget v26 (Output Sheets Only).xlsx
2013-06-27 17:05 - 2013-06-27 17:05 - 04780759 ____A C:\Users\mweber\Desktop\20130627 Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 13:41 - 2013-06-27 13:41 - 04782146 ____A C:\Users\mweber\Desktop\Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-26 18:13 - 2013-06-26 18:13 - 02022001 ____A C:\Users\mweber\Documents\Track record Q4_2011 versus Q1_2013.xlsx
2013-06-26 16:08 - 2013-06-26 16:08 - 00003086 ____A C:\Windows\System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8}
2013-06-25 19:54 - 2013-06-28 10:41 - 00747171 ____A C:\Users\mweber\Desktop\Jabong India May-13.xlsx
2013-06-25 19:54 - 2013-06-28 10:41 - 00496909 ____A C:\Users\mweber\Desktop\Lamoda Kazakhstan May-13.xlsx
2013-06-25 19:54 - 2013-06-28 10:41 - 00492047 ____A C:\Users\mweber\Desktop\Lamoda Russia May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00535177 ____A C:\Users\mweber\Desktop\Dafiti Group May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00489732 ____A C:\Users\mweber\Desktop\Dafiti Brazil May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00479399 ____A C:\Users\mweber\Desktop\Lamoda Group May-13.xlsx
2013-06-25 19:07 - 2013-06-28 10:42 - 00739591 ____A C:\Users\mweber\Desktop\Linio Venezuela May-13.xlsx
2013-06-25 19:06 - 2013-06-28 10:42 - 00759246 ____A C:\Users\mweber\Desktop\Linio Peru May-13.xlsx
2013-06-25 19:05 - 2013-06-28 10:42 - 00683642 ____A C:\Users\mweber\Desktop\Linio Mexico May-13.xlsx
2013-06-25 19:03 - 2013-06-28 10:42 - 00844432 ____A C:\Users\mweber\Desktop\Linio Group May-13.xlsx
2013-06-25 19:02 - 2013-06-28 10:42 - 00794280 ____A C:\Users\mweber\Desktop\Linio Colombia May-13.xlsx
2013-06-25 19:01 - 2013-06-28 10:41 - 00577941 ____A C:\Users\mweber\Desktop\Lazada Vietnam May-13.xlsx
2013-06-25 19:00 - 2013-06-28 10:41 - 00699036 ____A C:\Users\mweber\Desktop\Lazada Thailand May-13.xlsx
2013-06-25 18:59 - 2013-06-28 10:41 - 01232783 ____A C:\Users\mweber\Desktop\Lazada Group May-13.xlsx
2013-06-25 18:57 - 2013-06-28 10:41 - 00777564 ____A C:\Users\mweber\Desktop\Lazada Philippines May-13.xlsx
2013-06-25 18:56 - 2013-06-28 10:41 - 00672022 ____A C:\Users\mweber\Desktop\Lazada Malaysia May-13.xlsx
2013-06-25 18:55 - 2013-06-28 10:41 - 00484396 ____A C:\Users\mweber\Desktop\Lazada Indonesia May-13.xlsx
2013-06-25 14:02 - 2013-06-26 09:00 - 00014417 ____A C:\Users\mweber\Desktop\Interne Erlösverteilung HV4.xlsx
2013-06-25 13:56 - 2013-06-25 13:56 - 00010707 ____A C:\Users\mweber\Desktop\Mappe1.xlsx
2013-06-25 10:21 - 2013-06-25 10:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-19 09:55 - 2013-06-19 09:57 - 00086355 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19-after KV step put.xlsx
2013-06-17 18:56 - 2013-06-17 18:56 - 00040665 ____A C:\Users\mweber\Desktop\Cap Table Secondary KV_v5 (rm) we.xlsx
2013-06-17 15:28 - 2013-06-17 15:28 - 05575116 ____A C:\Users\mweber\Desktop\2013-06-14 Westwing Group Financial Reporting May 2013-we.xlsm
2013-06-17 08:57 - 2013-06-17 08:57 - 00064201 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19.xlsx
==================== One Month Modified Files and Folders =======
2013-07-11 14:16 - 2013-07-11 14:16 - 01777775 ____A (Farbar) C:\Users\mweber\Desktop\FRST64.exe
2013-07-11 14:13 - 2009-07-14 06:45 - 00021680 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:13 - 2009-07-14 06:45 - 00021680 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:12 - 2011-04-12 09:43 - 00647376 ____A C:\Windows\system32\perfh007.dat
2013-07-11 14:12 - 2011-04-12 09:43 - 00127404 ____A C:\Windows\system32\perfc007.dat
2013-07-11 14:12 - 2009-07-14 07:13 - 01480602 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 14:11 - 2013-07-11 14:11 - 00001799 ____A C:\Users\mweber\Desktop\JRT.txt
2013-07-11 14:08 - 2013-07-08 10:43 - 00000302 ____A C:\Windows\Tasks\BNIJ.job
2013-07-11 14:07 - 2013-07-11 14:07 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 14:06 - 2013-02-20 17:27 - 00000120 ____A C:\Windows\system32\config\netlogon.ftl
2013-07-11 14:06 - 2013-02-20 17:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-11 14:06 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 14:06 - 2009-07-14 06:51 - 00068163 ____A C:\Windows\setupact.log
2013-07-11 14:05 - 2013-07-11 14:05 - 00001510 ____A C:\AdwCleaner[S1].txt
2013-07-11 14:05 - 2013-02-20 17:17 - 01902574 ____A C:\Windows\WindowsUpdate.log
2013-07-11 14:04 - 2013-07-11 14:04 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\mweber\Desktop\JRT.exe
2013-07-11 14:01 - 2013-07-11 14:01 - 00650027 ____A C:\Users\mweber\Desktop\adwcleaner.exe
2013-07-11 13:23 - 2010-11-21 05:47 - 00150840 ____A C:\Windows\PFRO.log
2013-07-11 13:21 - 2013-07-11 13:21 - 00016991 ____A C:\ComboFix.txt
2013-07-11 13:21 - 2013-07-11 13:16 - 00000000 ____D C:\ComboFix
2013-07-11 13:21 - 2013-07-11 12:13 - 00000000 ____D C:\Qoobox
2013-07-11 13:21 - 2011-12-05 15:39 - 00000000 ____D C:\Users\mweberInfotriever
2013-07-11 13:21 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-11 13:20 - 2013-07-11 12:13 - 00000000 ____D C:\Windows\erdnt
2013-07-11 13:20 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-11 12:13 - 2013-07-11 12:12 - 05087643 ____R (Swearware) C:\Users\mweber\Desktop\ComboFix.exe
2013-07-11 11:50 - 2013-02-20 19:19 - 00000000 ____D C:\Persönliche Ordner Outlook
2013-07-11 11:50 - 2013-02-20 19:14 - 00000000 ____D C:\Users\mweber\Persönliche Ordner Outlook
2013-07-11 11:01 - 2013-07-11 11:01 - 00020351 ____A C:\Users\mweber\Desktop\Addition.txt
2013-07-11 11:00 - 2013-07-11 11:00 - 00000000 ____D C:\FRST
2013-07-11 10:39 - 2013-07-10 11:50 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client
2013-07-11 09:25 - 2013-07-11 09:21 - 00134370 ____A C:\OTL.Txt
2013-07-10 16:03 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-10 15:54 - 2013-07-11 09:18 - 00602112 ____A (OldTimer Tools) C:\OTL.exe
2013-07-10 14:58 - 2013-02-20 19:50 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-10 14:58 - 2013-02-20 19:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-10 14:58 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 14:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 14:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 14:58 - 2009-07-14 06:45 - 00337128 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-10 14:52 - 2013-07-10 14:52 - 00046501 ____A C:\Users\mweber\Desktop\bookmarks-2013-07-10.json
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 13:58 - 2013-02-20 17:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-10 13:56 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2013-07-10 13:54 - 2013-07-10 13:54 - 00019534 ____A C:\Users\mweber\Desktop\AVSCAN-20130708-153233-ED44747B.LOG
2013-07-10 11:50 - 2013-07-10 11:50 - 00000000 ____D C:\Program Files (x86)\Astaro
2013-07-10 10:22 - 2013-07-10 10:22 - 00014491 ____A C:\Users\mweber\Documents\*** v1.xlsx
2013-07-10 09:59 - 2013-07-09 16:41 - 00000000 ____D C:\Users\mweber\Documents\stinger64-epo
2013-07-10 09:59 - 2013-07-09 16:41 - 00000000 ____D C:\Program Files\stinger
2013-07-09 22:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-09 17:12 - 2013-07-09 17:12 - 00047514 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6 v2.xlsx
2013-07-09 16:46 - 2013-07-07 08:59 - 00012585 ____A C:\Users\mweber\Desktop\***.xlsx
2013-07-09 16:42 - 2013-07-09 16:42 - 00177680 ____A (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.45d9.deleteme
2013-07-09 16:40 - 2013-07-09 16:40 - 00000116 ___RH C:\Users\mweber\Downloads\Stinger.opt
2013-07-09 16:40 - 2013-07-08 16:11 - 00000000 ____D C:\Program Files (x86)\stinger
2013-07-09 13:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-09 10:06 - 2013-07-09 10:06 - 01864358 ____A C:\Users\mweber\Desktop\LP introduction master_Juli-we.pptx
2013-07-09 09:49 - 2013-04-10 17:58 - 00000000 ____A C:\ctapi_out_gr.txt
2013-07-08 22:16 - 2013-07-08 22:16 - 00047935 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6 v1.xlsx
2013-07-08 22:12 - 2013-07-08 22:08 - 00389807 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v2.pptx
2013-07-08 21:18 - 2013-07-08 21:18 - 00047506 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6.xlsx
2013-07-08 16:11 - 2013-07-08 16:11 - 00490268 ____A C:\Users\mweber\Downloads\runtime.dat
2013-07-08 16:11 - 2013-07-08 16:11 - 00000000 ____D C:\Stinger_Quarantine
2013-07-08 16:07 - 2013-07-08 16:07 - 01808985 ____A C:\Users\mweber\Desktop\2013-06-26 Drawdowns distributions overview Fund IV LP.xlsx
2013-07-08 16:07 - 2013-07-08 16:07 - 00046545 ____A C:\Users\mweber\Desktop\Commitment calculation 130708 (rm).xlsx
2013-07-08 15:46 - 2013-07-08 15:46 - 00036704 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Cange of Reinvest pool.xlsx
2013-07-08 15:43 - 2013-07-08 15:43 - 00046832 ____A C:\Users\mweber\Documents\20130708 Commitment calculation Cange of Reinvest pool.xlsx
2013-07-08 15:32 - 2013-07-08 15:32 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Avira
2013-07-08 10:43 - 2013-07-08 10:43 - 00471040 _RASH C:\Windows\SysWOW64\C_1361D.dll
2013-07-08 10:43 - 2013-07-08 10:43 - 00002582 ____A C:\Windows\System32\Tasks\BNIJ
2013-07-08 10:30 - 2013-07-06 22:50 - 00022330 ____A C:\Users\mweber\Desktop\Commitment calculation 130705 (rm)-we.xlsx
2013-07-07 17:38 - 2013-07-07 17:38 - 00181064 ____A (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-07-07 17:38 - 2013-04-09 16:38 - 00001151 ____A C:\Users\Public\Desktop\HMA! Pro VPN.lnk
2013-07-07 17:38 - 2013-04-09 16:38 - 00000000 ____D C:\Program Files (x86)\HMA! Pro VPN
2013-07-05 17:38 - 2013-07-05 17:31 - 00383914 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v1.pptx
2013-07-04 17:55 - 2013-07-04 17:55 - 01862079 ____A C:\Users\mweber\Desktop\20130704 HV Intro.pptx
2013-07-04 17:47 - 2013-07-04 17:47 - 00012992 ____A C:\Users\mweber\Desktop\GvH Kapitalbindung Aufstellung Fund 4 5.xlsx
2013-07-04 15:03 - 2013-07-04 15:03 - 00230519 ____A C:\Users\mweber\Desktop\2013-05-31 Lecturio Reporting.xlsx
2013-07-04 15:00 - 2013-07-04 15:00 - 00046548 ____A C:\Users\mweber\Desktop\2013-02-26 Lecturio captable current.xlsx
2013-07-04 14:53 - 2013-07-03 17:03 - 00365296 ____A C:\Users\mweber\Desktop\2013-07-22 250togo.pptx
2013-07-03 22:13 - 2013-02-20 18:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 12:42 - 2013-07-03 10:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 19:36 - 2013-07-02 19:36 - 02975466 ____A C:\Users\mweber\Desktop\Kopie von Delivery Hero Consolidated Budget v26 (Output Sheets Only).xlsx
2013-06-30 19:59 - 2013-02-20 19:38 - 00000000 ____D C:\Users\mweber\AppData\Local\Lookeen
2013-06-28 10:42 - 2013-06-25 19:07 - 00739591 ____A C:\Users\mweber\Desktop\Linio Venezuela May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:06 - 00759246 ____A C:\Users\mweber\Desktop\Linio Peru May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:05 - 00683642 ____A C:\Users\mweber\Desktop\Linio Mexico May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:03 - 00844432 ____A C:\Users\mweber\Desktop\Linio Group May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:02 - 00794280 ____A C:\Users\mweber\Desktop\Linio Colombia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00747171 ____A C:\Users\mweber\Desktop\Jabong India May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00496909 ____A C:\Users\mweber\Desktop\Lamoda Kazakhstan May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00492047 ____A C:\Users\mweber\Desktop\Lamoda Russia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00535177 ____A C:\Users\mweber\Desktop\Dafiti Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00489732 ____A C:\Users\mweber\Desktop\Dafiti Brazil May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00479399 ____A C:\Users\mweber\Desktop\Lamoda Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:01 - 00577941 ____A C:\Users\mweber\Desktop\Lazada Vietnam May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:00 - 00699036 ____A C:\Users\mweber\Desktop\Lazada Thailand May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:59 - 01232783 ____A C:\Users\mweber\Desktop\Lazada Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:57 - 00777564 ____A C:\Users\mweber\Desktop\Lazada Philippines May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:56 - 00672022 ____A C:\Users\mweber\Desktop\Lazada Malaysia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:55 - 00484396 ____A C:\Users\mweber\Desktop\Lazada Indonesia May-13.xlsx
2013-06-28 10:23 - 2013-04-09 22:24 - 00011121 ____A C:\Users\mweber\Desktop\Stromkosten.xlsx
2013-06-27 17:05 - 2013-06-27 17:05 - 04780759 ____A C:\Users\mweber\Desktop\20130627 Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 13:41 - 2013-06-27 13:41 - 04782146 ____A C:\Users\mweber\Desktop\Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 10:58 - 2011-09-16 17:54 - 00000072 ____A C:\Users\Public\LMDebug.log
2013-06-27 09:37 - 2013-02-20 19:56 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Skype
2013-06-26 18:13 - 2013-06-26 18:13 - 02022001 ____A C:\Users\mweber\Documents\Track record Q4_2011 versus Q1_2013.xlsx
2013-06-26 16:08 - 2013-06-26 16:08 - 00003086 ____A C:\Windows\System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8}
2013-06-26 09:00 - 2013-06-25 14:02 - 00014417 ____A C:\Users\mweber\Desktop\Interne Erlösverteilung HV4.xlsx
2013-06-25 13:56 - 2013-06-25 13:56 - 00010707 ____A C:\Users\mweber\Desktop\Mappe1.xlsx
2013-06-25 10:22 - 2013-06-25 10:21 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-25 10:19 - 2013-02-20 19:37 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-25 10:19 - 2013-02-20 19:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-25 10:19 - 2013-02-20 19:36 - 00000000 ____D C:\Users\mweber\AppData\Local\Adobe
2013-06-24 10:07 - 2013-06-05 09:56 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Jcfob
2013-06-24 00:57 - 2013-02-20 18:40 - 78277128 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-19 09:57 - 2013-06-19 09:55 - 00086355 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19-after KV step put.xlsx
2013-06-17 18:56 - 2013-06-17 18:56 - 00040665 ____A C:\Users\mweber\Desktop\Cap Table Secondary KV_v5 (rm) we.xlsx
2013-06-17 15:28 - 2013-06-17 15:28 - 05575116 ____A C:\Users\mweber\Desktop\2013-06-14 Westwing Group Financial Reporting May 2013-we.xlsm
2013-06-17 08:57 - 2013-06-17 08:57 - 00064201 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19.xlsx
2013-06-12 14:59 - 2013-06-10 10:55 - 00021389 ____A C:\Users\mweber\Desktop\fundkpichj11062013 (3).xlsx
2013-06-12 01:43 - 2013-07-10 13:57 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-12 01:25 - 2013-07-10 13:57 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-12 00:51 - 2013-07-10 13:57 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 00:50 - 2013-07-10 13:57 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 09:21
==================== End Of Log ============================
--- --- --- --- --- --- Und last not least die addition.txt Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-07-2013 04 Ran by MWeber at 2013-07-11 14:17:11 Running from C:\Users\mweber\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe AIR (x32 Version: 3.6.0.5970) Adobe Flash Player 10 ActiveX (x32 Version: 10.0.12.36) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122) Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) Astaro SSL VPN Client 1.7 (x32 Version: 1.7) Attachments Processor for Outlook (x32 Version: 4.4.2) Avira Professional Security (x32 Version: 12.1.9.1580) BlackBerry Desktop Software 7.1 (x32 Version: 7.1.0.37) Bonjour (Version: 3.0.0.10) Burn.Now 4.5 (x32 Version: 4.5.0) Business-in-a-Box (x32 Version: 5.0.4) Canon MX870 series MP Drivers Canon My Printer (x32 Version: 3.0.0) Conexant 20672 SmartAudio HD (Version: 8.32.23.5) Corel Burn.Now Lenovo Edition (x32 Version: 4.5.0) Corel DVD MovieFactory 7 (x32 Version: 7.0.0) Corel DVD MovieFactory Lenovo Edition (x32 Version: 7.0.0) Corel WinDVD (x32 Version: 10.0.5.828) CutePDF Writer 3.0 (Version: 3.0) Direct DiscRecorder (x32 Version: 1.00.0000) dows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (Version: 07/07/2009 1.12.2) Fuze Meeting (x32 Version: 1.10.44835) Garmin ANT Agent (x32 Version: 2.3.3) Garmin Training Center (x32 Version: 3.6.5) Garmin USB Drivers (x32 Version: 2.3.1.0) History CL 1.0 (x32) HMA! Pro VPN 2.8.0.7 (x32 Version: 2.8.0.7) homeputer CL Studio Version 4.0 (x32) Integrated Camera Driver Installer Package Ver.1.1.0.1147 (x32 Version: 1.1.0.1147) Integrated Camera TWAIN (x32 Version: 1.0.11.1223) Intel PROSet Wireless Intel PROSet Wireless (x32) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0) Intel(R) Management Engine Components (x32 Version: 7.1.50.1172) Intel(R) Network Connections Drivers (Version: 16.8) Intel(R) Processor Graphics (x32 Version: 8.15.10.2538) Intel(R) PROSet/Wireless WiFi-Software (Version: 14.03.0000) Intel(R) Wireless Display Intel(R) Wireless Display (x32 Version: 2.0.31.0) iTunes (Version: 11.0.1.12) Lenovo Power Management Driver (Version: 1.67.00.02) Lookeen Version 8.3.1.5156 (x32 Version: 8.3.1.5156) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Outlook-Sicherung für Persönliche Ordner (x32 Version: 1.10.0.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0) NVIDIA 3D Vision Treiber 311.00 (Version: 311.00) NVIDIA Grafiktreiber 311.00 (Version: 311.00) NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA Optimus 1.11.3 (Version: 1.11.3) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1100) NVIDIA Systemsteuerung 311.00 (Version: 311.00) NVIDIA Update Components (Version: 1.11.3) PicPick (x32 Version: 3.2.4) PSPad editor (x32 Version: 4.5.7.2450) QuickTime (x32 Version: 7.74.80.86) RICOH_Media_Driver_v2.14.18.01 (x32 Version: 2.14.18.01) Skype™ 6.2 (x32 Version: 6.2.106) Spotify (HKCU Version: 0.8.5.1356.gd1d40f3a) swMSM (x32 Version: 12.0.0.1) ThinkPad UltraNav Driver (Version: 16.2.19.7) ThinkVantage Fingerprint Software (Version: 5.9.8.7264) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32) VIPAccess (x32 Version: 2.0.1.91) Wartung Samsung CLX-6220 Series (x32) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0) ==================== Restore Points ========================= 11-07-2013 09:29:03 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-07-11 13:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {165113B5-9B7B-4F21-A583-24010DA54A0C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {28166543-1E87-4130-9536-0420D1A40FE0} - System32\Tasks\Microsoft\Windows\SyncCenter\S-1-5-21-606747145-1425521274-725345543-1124\{750FDF10-2A26-11D1-A3EA-080036587F03}\Synchronisierung beim Start => C:\Windows\system32\mobsync.exe [2010-11-21] (Microsoft Corporation) Task: {548E9983-355E-4153-A1FA-C7008673E590} - System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8} => C:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03] (Mozilla Corporation) Task: {AD46FD5E-E79C-4CD3-9F98-E88A08ACAAEB} - System32\Tasks\BNIJ => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: {EDF7A6FD-7C64-4294-9D1C-F577DCC6E119} - System32\Tasks\WPD\SqmUpload_S-1-5-21-606747145-1425521274-725345543-1124 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) Task: C:\Windows\Tasks\BNIJ.job => C:\Windows\system32\rundll32.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== System errors: ============= Microsoft Office Sessions: ========================= Error: (06/30/2013 00:53:12 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3558 seconds with 60 seconds of active time. This session ended with a crash. Error: (06/24/2013 03:58:33 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 21046 seconds with 6960 seconds of active time. This session ended with a crash. Error: (04/10/2013 04:54:51 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 27862 seconds with 7680 seconds of active time. This session ended with a crash. Error: (04/09/2013 04:36:15 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 25785 seconds with 4680 seconds of active time. This session ended with a crash. Error: (04/09/2013 09:26:18 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1977 seconds with 960 seconds of active time. This session ended with a crash. Error: (04/08/2013 04:45:27 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 26621 seconds with 9720 seconds of active time. This session ended with a crash. Error: (04/05/2013 08:26:04 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 262 seconds with 180 seconds of active time. This session ended with a crash. Error: (03/29/2013 11:53:28 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2314 seconds with 1080 seconds of active time. This session ended with a crash. Error: (03/21/2013 02:10:45 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3049 seconds with 1620 seconds of active time. This session ended with a crash. Error: (03/12/2013 06:19:01 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 31 seconds with 0 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2013-07-11 13:19:58.161 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-11 13:19:58.141 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 25% Total physical RAM: 8075.23 MB Available physical RAM: 6044.09 MB Total Pagefile: 16148.65 MB Available Pagefile: 14057.5 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:238.37 GB) (Free:85.91 GB) NTFS (Disk=0 Partition=2) Drive p: (Volume) (Network) (Total:1116.75 GB) (Free:770.33 GB) NTFS Drive s: () (Network) (Total:927.63 GB) (Free:622.82 GB) NTFS Drive w: (Volume) (Network) (Total:1116.75 GB) (Free:770.33 GB) NTFS Drive x: (Volume) (Network) (Total:1116.75 GB) (Free:770.33 GB) NTFS Drive y: () (Network) (Total:927.63 GB) (Free:622.82 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238 GB) (Disk ID: 011564D3) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=238 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Martina |
|
11.07.2013, 13:30
| #8 |
| /// the machine /// TB-Ausbilder | Trojanerbefall: Umleitung von Links Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter 2013-07-08 10:43 - 2013-07-11 14:08 - 00000302 ____A C:\Windows\Tasks\BNIJ.job
2013-07-08 10:43 - 2013-07-08 10:43 - 00471040 _RASH C:\Windows\SysWOW64\C_1361D.dll
Task: {AD46FD5E-E79C-4CD3-9F98-E88A08ACAAEB} - System32\Tasks\BNIJ => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\BNIJ.job => C:\Windows\system32\rundll32.exe
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST Log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 14:40
| #9 |
| | Trojanerbefall: Umleitung von Links Ich bin beeindruckt. Ob es noch Probleme gibt, kannst Du mir sicher sagen Es wurde tatsächlich noch ein Trojaner gefunden. Aber von vorne:Fixlog.txt Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-07-2013 04
Ran by MWeber at 2013-07-11 14:44:25 Run:1
Running from C:\Users\mweber\Desktop
Boot Mode: Normal
==============================================
C:\Windows\Tasks\BNIJ.job => Moved successfully.
Could not move "C:\Windows\SysWOW64\C_1361D.dll" => Scheduled to move on reboot.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Boot\{AD46FD5E-E79C-4CD3-9F98-E88A08ACAAEB} => Key deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{AD46FD5E-E79C-4CD3-9F98-E88A08ACAAEB} => Key deleted successfully.
C:\Windows\System32\Tasks\BNIJ => Moved successfully.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\BNIJ => Key deleted successfully.
C:\Windows\Tasks\BNIJ.job not found.
=========== Result of Scheduled Files to move ===========
C:\Windows\SysWOW64\C_1361D.dll => File moved successfully.
==== End of Fixlog ====
Code:
ATTFilter # version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=48615b13259bb341b21582f926d96b59
# engine=14352
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-07-11 01:33:52
# local_time=2013-07-11 03:33:52 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1802 16775166 100 98 8705 144217335 0 0
# compatibility_mode=5893 16776574 100 94 88539 125179482 0 0
# scanned=148485
# found=1
# cleaned=0
# scan_time=2620
sh=78DABDE2C444709EA4C11D59D08C9CA7B7E741D0 ft=1 fh=0eac75c8231d31ee vn="a variant of Win32/Kryptik.BFNW trojan" ac=I fn="C:\FRST\Quarantine\C_1361D.dll"
Code:
ATTFilter Results of screen317's Security Check version 0.99.68 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.7.700.224 Adobe Reader XI Mozilla Firefox (22.0) ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2013 04
Ran by MWeber (administrator) on 11-07-2013 15:38:05
Running from C:\Users\mweber\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(Lenovo.) C:\Windows\system32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SAsrv.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Microsoft Corporation) C:\Windows\System32\mobsync.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Spotify Ltd) C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
() C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(NTeWORKS) C:\Program Files (x86)\PicPick\picpick.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
() C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [ForteConfig] - C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [IgfxTray] - C:\Windows\system32\igfxtray.exe [167704 2011-10-14] (Intel Corporation)
HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [392472 2011-10-14] (Intel Corporation)
HKLM\...\Run: [Persistence] - C:\Windows\system32\igfxpers.exe [416024 2011-10-14] (Intel Corporation)
HKLM\...\Run: [PSQLLauncher] - "C:\Program Files\ThinkVantage Fingerprint Software\launcher.exe" /startup [85864 2012-09-21] (Authentec Inc.)
HKLM\...\Run: [SynTPEnh] - %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKCU\...\Run: [Spotify Web Helper] - "C:\Users\mweber\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1199000 2013-02-20] (Spotify Ltd)
HKCU\...\Run: [BIBLauncher] - C:\Program Files (x86)\Business-in-a-Box\BIBLauncher.exe [912688 2012-12-10] ()
HKCU\...\Run: [PicPick Start] - C:\Program Files (x86)\PicPick\picpick.exe /startup [11479896 2013-04-05] (NTeWORKS)
HKCU\...\Run: [Speech Recognition] - "C:\Windows\Speech\Common\sapisvr.exe" -SpeechUX -Startup [44544 2009-07-14] (Microsoft Corporation)
HKCU\...\Policies\system: [DisableRegistryTools] 0
HKCU\...\Policies\system: [DisableTaskMgr] 0
HKLM-x32\...\Run: [RotateImage] - C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [IMSS] - "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [112408 2012-04-17] (Intel Corporation)
HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152544 2012-12-12] (Apple Inc.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-02] (Research In Motion Limited)
HKLM-x32\...\Run: [Adobe ARM] - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [NUSB3MON] - "C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [106496 2009-11-20] (NEC Electronics Corporation)
HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [openvpn-gui] - C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpn-gui.exe [264704 2010-03-17] ()
HKLM-x32\...\Run: [avgnt] - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [348664 2012-07-18] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [DPAPIKeyMig] - %SystemRoot%\system32\dpapimig.exe -quiet [74752 2009-07-14] (Microsoft Corporation)
HKU\martin\...\RunOnce: [WAB Migrate] - %ProgramFiles%\Windows Mail\wab.exe /Upgrade [516096 2010-11-21] (Microsoft Corporation)
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [245872 2013-01-11] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [201576 2013-01-11] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
BHO: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\64bit\VIPAddOnForIE64.dll (Symantec Corporation)
BHO-x32: Symantec VIP Access Add-On - {C63CD127-A1CB-4D49-A4F7-D6F88A917BE6} - C:\Program Files (x86)\Symantec\VIP Access Client\VIPAddOnForIE.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.100.241
FireFox:
========
FF ProfilePath: C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default
FF Homepage: hxxp://google.de
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @fuzebox.com/Fuze Meeting NPAPI Plugin,version=1.0.0.1 - C:\Users\mweber\AppData\Local\Fuze Box\Fuze Meeting\npfuzeshare.dll ( )
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF Extension: undoclosedtabsbutton - C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\Extensions\undoclosedtabsbutton@supernova00.biz.xpi
FF Extension: No Name - C:\Users\mweber\AppData\Roaming\Mozilla\Firefox\Profiles\scmdb34j.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [VIP@verisign.com] C:\Program Files (x86)\Symantec\VIP Access Client\
FF Extension: Symantec VIP Access Add-On - C:\Program Files (x86)\Symantec\VIP Access Client\
==================== Services (Whitelisted) =================
S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe [375760 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [86224 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [110032 2012-07-18] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [465360 2012-07-18] (Avira Operations GmbH & Co. KG)
R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
S3 OpenVPNService; C:\Program Files (x86)\Astaro\Astaro SSL VPN Client\bin\openvpnserv.exe [39936 2010-03-17] ()
R2 VIPAppService; C:\Program Files (x86)\Symantec\VIP Access Client\VIPAppService.exe [84088 2011-04-13] (Symantec Corporation)
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-07-18] (Avira GmbH)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-07-18] (Avira GmbH)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2012-07-18] (Avira GmbH)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-01-11] (NVIDIA Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 SmbDrvI; C:\Windows\System32\DRIVERS\Smb_driver_Intel.sys [44344 2012-10-18] (Synaptics Incorporated)
R2 smihlp; C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [13128 2011-05-30] (Authentec Inc.)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-07-11 15:35 - 2013-07-11 14:48 - 00890988 ____A C:\Users\mweber\Desktop\SecurityCheck.exe
2013-07-11 14:47 - 2013-07-11 14:47 - 02347384 ____A (ESET) C:\Users\mweber\Desktop\esetsmartinstaller_enu.exe
2013-07-11 14:16 - 2013-07-11 14:16 - 01777775 ____A (Farbar) C:\Users\mweber\Desktop\FRST64.exe
2013-07-11 14:11 - 2013-07-11 14:11 - 00001799 ____A C:\Users\mweber\Desktop\JRT.txt
2013-07-11 14:07 - 2013-07-11 14:07 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 14:05 - 2013-07-11 14:05 - 00001510 ____A C:\AdwCleaner[S1].txt
2013-07-11 14:04 - 2013-07-11 14:04 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\mweber\Desktop\JRT.exe
2013-07-11 14:01 - 2013-07-11 14:01 - 00650027 ____A C:\Users\mweber\Desktop\adwcleaner.exe
2013-07-11 13:21 - 2013-07-11 13:21 - 00016991 ____A C:\ComboFix.txt
2013-07-11 13:16 - 2013-07-11 13:21 - 00000000 ____D C:\ComboFix
2013-07-11 13:16 - 2011-06-26 08:45 - 00256000 ____A C:\Windows\PEV.exe
2013-07-11 13:16 - 2010-11-07 19:20 - 00208896 ____A C:\Windows\MBR.exe
2013-07-11 13:16 - 2009-04-20 06:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00098816 ____A C:\Windows\sed.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00080412 ____A C:\Windows\grep.exe
2013-07-11 13:16 - 2000-08-31 02:00 - 00068096 ____A C:\Windows\zip.exe
2013-07-11 12:13 - 2013-07-11 13:21 - 00000000 ____D C:\Qoobox
2013-07-11 12:13 - 2013-07-11 13:20 - 00000000 ____D C:\Windows\erdnt
2013-07-11 12:12 - 2013-07-11 12:13 - 05087643 ____R (Swearware) C:\Users\mweber\Desktop\ComboFix.exe
2013-07-11 11:01 - 2013-07-11 14:17 - 00013597 ____A C:\Users\mweber\Desktop\Addition.txt
2013-07-11 11:00 - 2013-07-11 14:45 - 00000000 ____D C:\FRST
2013-07-11 09:21 - 2013-07-11 09:25 - 00134370 ____A C:\OTL.Txt
2013-07-11 09:18 - 2013-07-10 15:54 - 00602112 ____A (OldTimer Tools) C:\OTL.exe
2013-07-10 14:52 - 2013-07-10 14:52 - 00046501 ____A C:\Users\mweber\Desktop\bookmarks-2013-07-10.json
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 14:47 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-10 13:57 - 2013-06-12 01:43 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-10 13:57 - 2013-06-12 01:43 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-10 13:57 - 2013-06-12 01:42 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-10 13:57 - 2013-06-12 01:26 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-10 13:57 - 2013-06-12 01:25 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-10 13:57 - 2013-06-12 01:25 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-10 13:57 - 2013-06-12 00:51 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-10 13:57 - 2013-06-12 00:50 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-10 13:57 - 2013-06-07 05:22 - 02706432 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-10 13:57 - 2013-06-07 04:37 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-10 13:54 - 2013-07-10 13:54 - 00019534 ____A C:\Users\mweber\Desktop\AVSCAN-20130708-153233-ED44747B.LOG
2013-07-10 13:50 - 2013-05-06 08:03 - 01887744 ____A (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 13:50 - 2013-05-06 06:56 - 01620480 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 13:49 - 2013-06-05 05:34 - 03153920 ____A (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 13:49 - 2013-06-04 08:00 - 00624128 ____A (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 13:49 - 2013-06-04 06:53 - 00509440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 13:49 - 2013-04-10 01:34 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 13:49 - 2013-04-03 00:51 - 01643520 ____A (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-10 11:50 - 2013-07-11 10:39 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client
2013-07-10 11:50 - 2013-07-10 11:50 - 00000000 ____D C:\Program Files (x86)\Astaro
2013-07-08 15:33 - 2013-05-13 07:51 - 01464320 ____A (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-08 15:33 - 2013-05-13 07:51 - 00184320 ____A (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-08 15:33 - 2013-05-13 07:51 - 00139776 ____A (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-08 15:33 - 2013-05-13 07:50 - 00052224 ____A (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 01160192 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-08 15:33 - 2013-05-13 06:45 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-08 15:33 - 2013-05-13 05:43 - 01192448 ____A (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-08 15:33 - 2013-05-13 05:08 - 00903168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-08 15:33 - 2013-05-13 05:08 - 00043008 ____A (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-08 15:33 - 2013-05-08 08:39 - 01910632 ____A (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-07-08 15:33 - 2013-04-26 07:51 - 00751104 ____A (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2013-07-08 15:33 - 2013-04-26 06:55 - 00492544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll
2013-07-08 15:32 - 2013-07-08 15:32 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Avira
2013-07-07 17:38 - 2013-07-07 17:38 - 00181064 ____A (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-07-07 08:59 - 2013-07-09 16:46 - 00012585 ____A C:\Users\mweber\Desktop\***.xlsx
2013-07-06 22:50 - 2013-07-08 10:30 - 00022330 ____A C:\Users\mweber\Desktop\Commitment calculation 130705 (rm)-we.xlsx
2013-07-05 17:31 - 2013-07-05 17:38 - 00383914 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v1.pptx
2013-07-04 17:55 - 2013-07-04 17:55 - 01862079 ____A C:\Users\mweber\Desktop\20130704 HV Intro.pptx
2013-07-04 17:47 - 2013-07-04 17:47 - 00012992 ____A C:\Users\mweber\Desktop\GvH Kapitalbindung Aufstellung Fund 4 5.xlsx
2013-07-04 15:03 - 2013-07-04 15:03 - 00230519 ____A C:\Users\mweber\Desktop\2013-05-31 Lecturio Reporting.xlsx
2013-07-04 15:00 - 2013-07-04 15:00 - 00046548 ____A C:\Users\mweber\Desktop\2013-02-26 Lecturio captable current.xlsx
2013-07-03 17:03 - 2013-07-04 14:53 - 00365296 ____A C:\Users\mweber\Desktop\2013-07-22 250togo.pptx
2013-07-03 10:29 - 2013-07-03 12:42 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 19:36 - 2013-07-02 19:36 - 02975466 ____A C:\Users\mweber\Desktop\Kopie von Delivery Hero Consolidated Budget v26 (Output Sheets Only).xlsx
2013-06-27 17:05 - 2013-06-27 17:05 - 04780759 ____A C:\Users\mweber\Desktop\20130627 Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 13:41 - 2013-06-27 13:41 - 04782146 ____A C:\Users\mweber\Desktop\Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-26 18:13 - 2013-06-26 18:13 - 02022001 ____A C:\Users\mweber\Documents\Track record Q4_2011 versus Q1_2013.xlsx
2013-06-26 16:08 - 2013-06-26 16:08 - 00003086 ____A C:\Windows\System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8}
2013-06-25 19:54 - 2013-06-28 10:41 - 00747171 ____A C:\Users\mweber\Desktop\Jabong India May-13.xlsx
2013-06-25 19:54 - 2013-06-28 10:41 - 00496909 ____A C:\Users\mweber\Desktop\Lamoda Kazakhstan May-13.xlsx
2013-06-25 19:54 - 2013-06-28 10:41 - 00492047 ____A C:\Users\mweber\Desktop\Lamoda Russia May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00535177 ____A C:\Users\mweber\Desktop\Dafiti Group May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00489732 ____A C:\Users\mweber\Desktop\Dafiti Brazil May-13.xlsx
2013-06-25 19:53 - 2013-06-28 10:41 - 00479399 ____A C:\Users\mweber\Desktop\Lamoda Group May-13.xlsx
2013-06-25 19:07 - 2013-06-28 10:42 - 00739591 ____A C:\Users\mweber\Desktop\Linio Venezuela May-13.xlsx
2013-06-25 19:06 - 2013-06-28 10:42 - 00759246 ____A C:\Users\mweber\Desktop\Linio Peru May-13.xlsx
2013-06-25 19:05 - 2013-06-28 10:42 - 00683642 ____A C:\Users\mweber\Desktop\Linio Mexico May-13.xlsx
2013-06-25 19:03 - 2013-06-28 10:42 - 00844432 ____A C:\Users\mweber\Desktop\Linio Group May-13.xlsx
2013-06-25 19:02 - 2013-06-28 10:42 - 00794280 ____A C:\Users\mweber\Desktop\Linio Colombia May-13.xlsx
2013-06-25 19:01 - 2013-06-28 10:41 - 00577941 ____A C:\Users\mweber\Desktop\Lazada Vietnam May-13.xlsx
2013-06-25 19:00 - 2013-06-28 10:41 - 00699036 ____A C:\Users\mweber\Desktop\Lazada Thailand May-13.xlsx
2013-06-25 18:59 - 2013-06-28 10:41 - 01232783 ____A C:\Users\mweber\Desktop\Lazada Group May-13.xlsx
2013-06-25 18:57 - 2013-06-28 10:41 - 00777564 ____A C:\Users\mweber\Desktop\Lazada Philippines May-13.xlsx
2013-06-25 18:56 - 2013-06-28 10:41 - 00672022 ____A C:\Users\mweber\Desktop\Lazada Malaysia May-13.xlsx
2013-06-25 18:55 - 2013-06-28 10:41 - 00484396 ____A C:\Users\mweber\Desktop\Lazada Indonesia May-13.xlsx
2013-06-25 14:02 - 2013-06-26 09:00 - 00014417 ____A C:\Users\mweber\Desktop\Interne Erlösverteilung HV4.xlsx
2013-06-25 13:56 - 2013-06-25 13:56 - 00010707 ____A C:\Users\mweber\Desktop\Mappe1.xlsx
2013-06-25 10:21 - 2013-06-25 10:22 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-19 09:55 - 2013-06-19 09:57 - 00086355 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19-after KV step put.xlsx
2013-06-17 18:56 - 2013-06-17 18:56 - 00040665 ____A C:\Users\mweber\Desktop\Cap Table Secondary KV_v5 (rm) we.xlsx
2013-06-17 15:28 - 2013-06-17 15:28 - 05575116 ____A C:\Users\mweber\Desktop\2013-06-14 Westwing Group Financial Reporting May 2013-we.xlsm
2013-06-17 08:57 - 2013-06-17 08:57 - 00064201 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19.xlsx
==================== One Month Modified Files and Folders =======
2013-07-11 15:22 - 2013-02-20 19:19 - 00000000 ____D C:\Persönliche Ordner Outlook
2013-07-11 15:22 - 2013-02-20 19:14 - 00000000 ____D C:\Users\mweber\Persönliche Ordner Outlook
2013-07-11 14:52 - 2011-04-12 09:43 - 00647376 ____A C:\Windows\system32\perfh007.dat
2013-07-11 14:52 - 2011-04-12 09:43 - 00127404 ____A C:\Windows\system32\perfc007.dat
2013-07-11 14:52 - 2009-07-14 07:13 - 01480602 ____A C:\Windows\system32\PerfStringBackup.INI
2013-07-11 14:52 - 2009-07-14 06:45 - 00021680 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:52 - 2009-07-14 06:45 - 00021680 ___AH C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-11 14:48 - 2013-07-11 15:35 - 00890988 ____A C:\Users\mweber\Desktop\SecurityCheck.exe
2013-07-11 14:48 - 2013-02-20 17:17 - 01906115 ____A C:\Windows\WindowsUpdate.log
2013-07-11 14:47 - 2013-07-11 14:47 - 02347384 ____A (ESET) C:\Users\mweber\Desktop\esetsmartinstaller_enu.exe
2013-07-11 14:45 - 2013-07-11 11:00 - 00000000 ____D C:\FRST
2013-07-11 14:45 - 2013-02-20 17:27 - 00000120 ____A C:\Windows\system32\config\netlogon.ftl
2013-07-11 14:45 - 2013-02-20 17:24 - 00000000 ____D C:\ProgramData\NVIDIA
2013-07-11 14:45 - 2009-07-14 07:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-07-11 14:45 - 2009-07-14 06:51 - 00068219 ____A C:\Windows\setupact.log
2013-07-11 14:17 - 2013-07-11 11:01 - 00013597 ____A C:\Users\mweber\Desktop\Addition.txt
2013-07-11 14:16 - 2013-07-11 14:16 - 01777775 ____A (Farbar) C:\Users\mweber\Desktop\FRST64.exe
2013-07-11 14:11 - 2013-07-11 14:11 - 00001799 ____A C:\Users\mweber\Desktop\JRT.txt
2013-07-11 14:07 - 2013-07-11 14:07 - 00000000 ____D C:\Windows\ERUNT
2013-07-11 14:05 - 2013-07-11 14:05 - 00001510 ____A C:\AdwCleaner[S1].txt
2013-07-11 14:04 - 2013-07-11 14:04 - 00559306 ____A (Oleg N. Scherbakov) C:\Users\mweber\Desktop\JRT.exe
2013-07-11 14:01 - 2013-07-11 14:01 - 00650027 ____A C:\Users\mweber\Desktop\adwcleaner.exe
2013-07-11 13:23 - 2010-11-21 05:47 - 00150840 ____A C:\Windows\PFRO.log
2013-07-11 13:21 - 2013-07-11 13:21 - 00016991 ____A C:\ComboFix.txt
2013-07-11 13:21 - 2013-07-11 13:16 - 00000000 ____D C:\ComboFix
2013-07-11 13:21 - 2013-07-11 12:13 - 00000000 ____D C:\Qoobox
2013-07-11 13:21 - 2011-12-05 15:39 - 00000000 ____D C:\Users\mweberInfotriever
2013-07-11 13:21 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-07-11 13:20 - 2013-07-11 12:13 - 00000000 ____D C:\Windows\erdnt
2013-07-11 13:20 - 2009-07-14 04:34 - 00000215 ____A C:\Windows\system.ini
2013-07-11 12:13 - 2013-07-11 12:12 - 05087643 ____R (Swearware) C:\Users\mweber\Desktop\ComboFix.exe
2013-07-11 10:39 - 2013-07-10 11:50 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Astaro SSL VPN Client
2013-07-11 09:25 - 2013-07-11 09:21 - 00134370 ____A C:\OTL.Txt
2013-07-10 16:03 - 2009-07-14 07:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-10 15:54 - 2013-07-11 09:18 - 00602112 ____A (OldTimer Tools) C:\OTL.exe
2013-07-10 14:58 - 2013-02-20 19:50 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-10 14:58 - 2013-02-20 19:50 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-10 14:58 - 2011-04-12 09:55 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 14:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 14:58 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-10 14:58 - 2009-07-14 06:45 - 00337128 ____A C:\Windows\system32\FNTCACHE.DAT
2013-07-10 14:52 - 2013-07-10 14:52 - 00046501 ____A C:\Users\mweber\Desktop\bookmarks-2013-07-10.json
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-07-10 14:47 - 2013-07-10 14:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-10 13:58 - 2013-02-20 17:34 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-10 13:56 - 2009-07-14 07:32 - 00000000 ____D C:\Windows\system32\WinBioPlugIns
2013-07-10 13:54 - 2013-07-10 13:54 - 00019534 ____A C:\Users\mweber\Desktop\AVSCAN-20130708-153233-ED44747B.LOG
2013-07-10 11:50 - 2013-07-10 11:50 - 00000000 ____D C:\Program Files (x86)\Astaro
2013-07-10 09:59 - 2013-07-09 16:41 - 00000000 ____D C:\Users\mweber\Documents\stinger64-epo
2013-07-10 09:59 - 2013-07-09 16:41 - 00000000 ____D C:\Program Files\stinger
2013-07-09 22:07 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-09 17:12 - 2013-07-09 17:12 - 00047514 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6 v2.xlsx
2013-07-09 16:46 - 2013-07-07 08:59 - 00012585 ____A C:\Users\mweber\Desktop\***.xlsx
2013-07-09 16:42 - 2013-07-09 16:42 - 00177680 ____A (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.45d9.deleteme
2013-07-09 16:40 - 2013-07-09 16:40 - 00000116 ___RH C:\Users\mweber\Downloads\Stinger.opt
2013-07-09 16:40 - 2013-07-08 16:11 - 00000000 ____D C:\Program Files (x86)\stinger
2013-07-09 13:28 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-09 10:06 - 2013-07-09 10:06 - 01864358 ____A C:\Users\mweber\Desktop\LP introduction master_Juli-we.pptx
2013-07-09 09:49 - 2013-04-10 17:58 - 00000000 ____A C:\ctapi_out_gr.txt
2013-07-08 22:16 - 2013-07-08 22:16 - 00047935 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6 v1.xlsx
2013-07-08 22:12 - 2013-07-08 22:08 - 00389807 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v2.pptx
2013-07-08 21:18 - 2013-07-08 21:18 - 00047506 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Fund 6.xlsx
2013-07-08 16:11 - 2013-07-08 16:11 - 00490268 ____A C:\Users\mweber\Downloads\runtime.dat
2013-07-08 16:11 - 2013-07-08 16:11 - 00000000 ____D C:\Stinger_Quarantine
2013-07-08 16:07 - 2013-07-08 16:07 - 01808985 ____A C:\Users\mweber\Desktop\2013-06-26 Drawdowns distributions overview Fund IV LP.xlsx
2013-07-08 16:07 - 2013-07-08 16:07 - 00046545 ____A C:\Users\mweber\Desktop\Commitment calculation 130708 (rm).xlsx
2013-07-08 15:46 - 2013-07-08 15:46 - 00036704 ____A C:\Users\mweber\Desktop\20130708 Commitment calculation Cange of Reinvest pool.xlsx
2013-07-08 15:43 - 2013-07-08 15:43 - 00046832 ____A C:\Users\mweber\Documents\20130708 Commitment calculation Cange of Reinvest pool.xlsx
2013-07-08 15:32 - 2013-07-08 15:32 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Avira
2013-07-08 10:30 - 2013-07-06 22:50 - 00022330 ____A C:\Users\mweber\Desktop\Commitment calculation 130705 (rm)-we.xlsx
2013-07-07 17:38 - 2013-07-07 17:38 - 00181064 ____A (Sysinternals) C:\Windows\PSEXESVC.EXE
2013-07-07 17:38 - 2013-04-09 16:38 - 00001151 ____A C:\Users\Public\Desktop\HMA! Pro VPN.lnk
2013-07-07 17:38 - 2013-04-09 16:38 - 00000000 ____D C:\Program Files (x86)\HMA! Pro VPN
2013-07-05 17:38 - 2013-07-05 17:31 - 00383914 ____A C:\Users\mweber\Desktop\2013-07-22 250togo-v1.pptx
2013-07-04 17:55 - 2013-07-04 17:55 - 01862079 ____A C:\Users\mweber\Desktop\20130704 HV Intro.pptx
2013-07-04 17:47 - 2013-07-04 17:47 - 00012992 ____A C:\Users\mweber\Desktop\GvH Kapitalbindung Aufstellung Fund 4 5.xlsx
2013-07-04 15:03 - 2013-07-04 15:03 - 00230519 ____A C:\Users\mweber\Desktop\2013-05-31 Lecturio Reporting.xlsx
2013-07-04 15:00 - 2013-07-04 15:00 - 00046548 ____A C:\Users\mweber\Desktop\2013-02-26 Lecturio captable current.xlsx
2013-07-04 14:53 - 2013-07-03 17:03 - 00365296 ____A C:\Users\mweber\Desktop\2013-07-22 250togo.pptx
2013-07-03 22:13 - 2013-02-20 18:22 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 12:42 - 2013-07-03 10:29 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-02 19:36 - 2013-07-02 19:36 - 02975466 ____A C:\Users\mweber\Desktop\Kopie von Delivery Hero Consolidated Budget v26 (Output Sheets Only).xlsx
2013-06-30 19:59 - 2013-02-20 19:38 - 00000000 ____D C:\Users\mweber\AppData\Local\Lookeen
2013-06-28 10:42 - 2013-06-25 19:07 - 00739591 ____A C:\Users\mweber\Desktop\Linio Venezuela May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:06 - 00759246 ____A C:\Users\mweber\Desktop\Linio Peru May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:05 - 00683642 ____A C:\Users\mweber\Desktop\Linio Mexico May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:03 - 00844432 ____A C:\Users\mweber\Desktop\Linio Group May-13.xlsx
2013-06-28 10:42 - 2013-06-25 19:02 - 00794280 ____A C:\Users\mweber\Desktop\Linio Colombia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00747171 ____A C:\Users\mweber\Desktop\Jabong India May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00496909 ____A C:\Users\mweber\Desktop\Lamoda Kazakhstan May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:54 - 00492047 ____A C:\Users\mweber\Desktop\Lamoda Russia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00535177 ____A C:\Users\mweber\Desktop\Dafiti Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00489732 ____A C:\Users\mweber\Desktop\Dafiti Brazil May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:53 - 00479399 ____A C:\Users\mweber\Desktop\Lamoda Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:01 - 00577941 ____A C:\Users\mweber\Desktop\Lazada Vietnam May-13.xlsx
2013-06-28 10:41 - 2013-06-25 19:00 - 00699036 ____A C:\Users\mweber\Desktop\Lazada Thailand May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:59 - 01232783 ____A C:\Users\mweber\Desktop\Lazada Group May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:57 - 00777564 ____A C:\Users\mweber\Desktop\Lazada Philippines May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:56 - 00672022 ____A C:\Users\mweber\Desktop\Lazada Malaysia May-13.xlsx
2013-06-28 10:41 - 2013-06-25 18:55 - 00484396 ____A C:\Users\mweber\Desktop\Lazada Indonesia May-13.xlsx
2013-06-28 10:23 - 2013-04-09 22:24 - 00011121 ____A C:\Users\mweber\Desktop\Stromkosten.xlsx
2013-06-27 17:05 - 2013-06-27 17:05 - 04780759 ____A C:\Users\mweber\Desktop\20130627 Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 13:41 - 2013-06-27 13:41 - 04782146 ____A C:\Users\mweber\Desktop\Portfolio valuation (v19 1_Jun2013)-cashplanning.xlsm
2013-06-27 10:58 - 2011-09-16 17:54 - 00000072 ____A C:\Users\Public\LMDebug.log
2013-06-27 09:37 - 2013-02-20 19:56 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Skype
2013-06-26 18:13 - 2013-06-26 18:13 - 02022001 ____A C:\Users\mweber\Documents\Track record Q4_2011 versus Q1_2013.xlsx
2013-06-26 16:08 - 2013-06-26 16:08 - 00003086 ____A C:\Windows\System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8}
2013-06-26 09:00 - 2013-06-25 14:02 - 00014417 ____A C:\Users\mweber\Desktop\Interne Erlösverteilung HV4.xlsx
2013-06-25 13:56 - 2013-06-25 13:56 - 00010707 ____A C:\Users\mweber\Desktop\Mappe1.xlsx
2013-06-25 10:22 - 2013-06-25 10:21 - 00000000 ____D C:\Program Files (x86)\QuickTime
2013-06-25 10:19 - 2013-02-20 19:37 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-06-25 10:19 - 2013-02-20 19:37 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-06-25 10:19 - 2013-02-20 19:36 - 00000000 ____D C:\Users\mweber\AppData\Local\Adobe
2013-06-24 10:07 - 2013-06-05 09:56 - 00000000 ____D C:\Users\mweber\AppData\Roaming\Jcfob
2013-06-24 00:57 - 2013-02-20 18:40 - 78277128 ____A (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-06-19 09:57 - 2013-06-19 09:55 - 00086355 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19-after KV step put.xlsx
2013-06-17 18:56 - 2013-06-17 18:56 - 00040665 ____A C:\Users\mweber\Desktop\Cap Table Secondary KV_v5 (rm) we.xlsx
2013-06-17 15:28 - 2013-06-17 15:28 - 05575116 ____A C:\Users\mweber\Desktop\2013-06-14 Westwing Group Financial Reporting May 2013-we.xlsm
2013-06-17 08:57 - 2013-06-17 08:57 - 00064201 ____A C:\Users\mweber\Desktop\2013-06-07 21Diamonds captable draft v19.xlsx
2013-06-12 14:59 - 2013-06-10 10:55 - 00021389 ____A C:\Users\mweber\Desktop\fundkpichj11062013 (3).xlsx
2013-06-12 01:43 - 2013-07-10 13:57 - 14329856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-06-12 01:43 - 2013-07-10 13:57 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-06-12 01:42 - 2013-07-10 13:57 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 02241024 ____A (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 01365504 ____A (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-06-12 01:26 - 2013-07-10 13:57 - 00051712 ____A (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-06-12 01:25 - 2013-07-10 13:57 - 19238912 ____A (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 15404032 ____A (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 03958784 ____A (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 02648576 ____A (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00855552 ____A (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00603136 ____A (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00526336 ____A (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00136704 ____A (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00067072 ____A (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00053248 ____A (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-06-12 01:25 - 2013-07-10 13:57 - 00039936 ____A (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-06-12 00:51 - 2013-07-10 13:57 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-06-12 00:50 - 2013-07-10 13:57 - 00089600 ____A (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-03 09:21
==================== End Of Log ============================
--- --- --- --- --- --- und Addition.txt: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-07-2013 04 Ran by MWeber at 2013-07-11 15:38:20 Running from C:\Users\mweber\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Adobe AIR (x32 Version: 3.6.0.5970) Adobe Flash Player 10 ActiveX (x32 Version: 10.0.12.36) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03) Adobe Shockwave Player 12.0 (x32 Version: 12.0.2.122) Amazon MP3-Downloader 1.0.17 (x32 Version: 1.0.17) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.0.1.3) Apple Software Update (x32 Version: 2.1.3.127) Astaro SSL VPN Client 1.7 (x32 Version: 1.7) Attachments Processor for Outlook (x32 Version: 4.4.2) Avira Professional Security (x32 Version: 12.1.9.1580) BlackBerry Desktop Software 7.1 (x32 Version: 7.1.0.37) Bonjour (Version: 3.0.0.10) Burn.Now 4.5 (x32 Version: 4.5.0) Business-in-a-Box (x32 Version: 5.0.4) Canon MX870 series MP Drivers Canon My Printer (x32 Version: 3.0.0) Conexant 20672 SmartAudio HD (Version: 8.32.23.5) Corel Burn.Now Lenovo Edition (x32 Version: 4.5.0) Corel DVD MovieFactory 7 (x32 Version: 7.0.0) Corel DVD MovieFactory Lenovo Edition (x32 Version: 7.0.0) Corel WinDVD (x32 Version: 10.0.5.828) CutePDF Writer 3.0 (Version: 3.0) Direct DiscRecorder (x32 Version: 1.00.0000) dows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (Version: 07/07/2009 1.12.2) Fuze Meeting (x32 Version: 1.10.44835) Garmin ANT Agent (x32 Version: 2.3.3) Garmin Training Center (x32 Version: 3.6.5) Garmin USB Drivers (x32 Version: 2.3.1.0) History CL 1.0 (x32) HMA! Pro VPN 2.8.0.7 (x32 Version: 2.8.0.7) homeputer CL Studio Version 4.0 (x32) Integrated Camera Driver Installer Package Ver.1.1.0.1147 (x32 Version: 1.1.0.1147) Integrated Camera TWAIN (x32 Version: 1.0.11.1223) Intel PROSet Wireless Intel PROSet Wireless (x32) Intel(R) Control Center (x32 Version: 1.2.1.1007) Intel(R) Identity Protection Technology 1.1.2.0 (x32 Version: 1.1.2.0) Intel(R) Management Engine Components (x32 Version: 7.1.50.1172) Intel(R) Network Connections Drivers (Version: 16.8) Intel(R) Processor Graphics (x32 Version: 8.15.10.2538) Intel(R) PROSet/Wireless WiFi-Software (Version: 14.03.0000) Intel(R) Wireless Display Intel(R) Wireless Display (x32 Version: 2.0.31.0) iTunes (Version: 11.0.1.12) Lenovo Power Management Driver (Version: 1.67.00.02) Lookeen Version 8.3.1.5156 (x32 Version: 8.3.1.5156) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Standard 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Outlook-Sicherung für Persönliche Ordner (x32 Version: 1.10.0.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0) NVIDIA 3D Vision Treiber 311.00 (Version: 311.00) NVIDIA Grafiktreiber 311.00 (Version: 311.00) NVIDIA HD-Audiotreiber 1.3.18.0 (Version: 1.3.18.0) NVIDIA Install Application (Version: 2.1002.108.688) NVIDIA Optimus 1.11.3 (Version: 1.11.3) NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1100) NVIDIA Systemsteuerung 311.00 (Version: 311.00) NVIDIA Update Components (Version: 1.11.3) PicPick (x32 Version: 3.2.4) PSPad editor (x32 Version: 4.5.7.2450) QuickTime (x32 Version: 7.74.80.86) RICOH_Media_Driver_v2.14.18.01 (x32 Version: 2.14.18.01) Skype™ 6.2 (x32 Version: 6.2.106) Spotify (HKCU Version: 0.8.5.1356.gd1d40f3a) swMSM (x32 Version: 12.0.0.1) ThinkPad UltraNav Driver (Version: 16.2.19.7) ThinkVantage Fingerprint Software (Version: 5.9.8.7264) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32) VIPAccess (x32 Version: 2.0.1.91) Wartung Samsung CLX-6220 Series (x32) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (04/19/2012 2.3.1.0) (Version: 04/19/2012 2.3.1.0) ==================== Restore Points ========================= 11-07-2013 09:29:03 Geplanter Prüfpunkt ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-07-11 13:20 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {165113B5-9B7B-4F21-A583-24010DA54A0C} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {28166543-1E87-4130-9536-0420D1A40FE0} - System32\Tasks\Microsoft\Windows\SyncCenter\S-1-5-21-606747145-1425521274-725345543-1124\{750FDF10-2A26-11D1-A3EA-080036587F03}\Synchronisierung beim Start => C:\Windows\system32\mobsync.exe [2010-11-21] (Microsoft Corporation) Task: {548E9983-355E-4153-A1FA-C7008673E590} - System32\Tasks\{F07730BB-C40E-4A0F-A267-F13779B472D8} => C:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03] (Mozilla Corporation) Task: {EDF7A6FD-7C64-4294-9D1C-F577DCC6E119} - System32\Tasks\WPD\SqmUpload_S-1-5-21-606747145-1425521274-725345543-1124 => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation) ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (07/11/2013 03:31:35 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (07/11/2013 02:48:02 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (07/11/2013 02:47:52 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" in Zeile C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Komponente 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error: (07/11/2013 02:45:04 PM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (07/11/2013 02:45:24 PM) (Source: Microsoft-Windows-GroupPolicy) (User: NETWORXS) Description: Fehler bei der Verarbeitung der Gruppenrichtlinie. Der Versuch, die Datei "\\networxs\sysvol\networxs\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\gpt.ini" von einem Domänencontroller zu lesen, war nicht erfolgreich. Die Gruppenrichtlinieneinstellungen dürfen nicht angewendet werden, bis dieses Ereignis behoben ist. Dies ist möglicherweise ein vorübergehendes Problem, das mindestens eine der folgenden Ursachen haben kann: a) Namensauflösung/Netzwerkverbindung mit dem aktuellen Domänencontroller. b) Wartezeit des Dateireplikationsdienstes (eine auf einem anderen Domänencontroller erstellte Datei hat nicht auf dem aktuellen Domänencontroller repliziert). c) Der DFS-Client (Distributed File System) wurde deaktiviert. Error: (07/11/2013 02:45:10 PM) (Source: Service Control Manager) (User: ) Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: cdrom Error: (07/11/2013 02:45:05 PM) (Source: Microsoft-Windows-GroupPolicy) (User: NT-AUTORITÄT) Description: Bei der Verarbeitung der Gruppenrichtlinie ist aufgrund fehlender Netzwerkkonnektivität mit einem Domänencontroller ein Fehler aufgetreten. Dies kann eine vorübergehende Bedingung sein. Es wird eine Erfolgsmeldung generiert, wenn die Verbindung des Computers mit dem Domänencontroller wiederhergestellt wurde und wenn die Gruppenrichtlinie erfolgreich verarbeitet wurde. Falls für mehrere Stunden keine Erfolgsmeldung angezeigt wird, wenden Sie sich an den Administrator. Error: (07/11/2013 02:45:04 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "DgiVecp" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/11/2013 02:45:04 PM) (Source: NETLOGON) (User: ) Description: Der Computer konnte eine sichere Sitzung mit einem Domänencontroller in der Domäne NETWORXS aufgrund der folgenden Ursache nicht einrichten: %%1311 Dies kann zu Authentifizierungsproblemen führen. Stellen Sie sicher, dass der Computer mit dem Netzwerk verbunden ist. Wenden Sie sich an den Domänenadministrator, wenn das Problem weiterhin besteht. ZUSÄTZLICHE INFORMATIONEN Wenn dieser Computer ein Domänencontroller der bestimmten Domäne ist, wird eine sichere Sitzung zum primären Domänencontrolleremulator in der bestimmten Domäne eingerichtet. Andernfalls richtet dieser Computer eine sichere Sitzung zu einem beliebigen Domänencontroller in der bestimmten Domäne ein. Error: (07/11/2013 02:44:34 PM) (Source: DCOM) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Microsoft Office Sessions: ========================= Error: (06/30/2013 00:53:12 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3558 seconds with 60 seconds of active time. This session ended with a crash. Error: (06/24/2013 03:58:33 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 21046 seconds with 6960 seconds of active time. This session ended with a crash. Error: (04/10/2013 04:54:51 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 27862 seconds with 7680 seconds of active time. This session ended with a crash. Error: (04/09/2013 04:36:15 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 25785 seconds with 4680 seconds of active time. This session ended with a crash. Error: (04/09/2013 09:26:18 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1977 seconds with 960 seconds of active time. This session ended with a crash. Error: (04/08/2013 04:45:27 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 26621 seconds with 9720 seconds of active time. This session ended with a crash. Error: (04/05/2013 08:26:04 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 262 seconds with 180 seconds of active time. This session ended with a crash. Error: (03/29/2013 11:53:28 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 2314 seconds with 1080 seconds of active time. This session ended with a crash. Error: (03/21/2013 02:10:45 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 3049 seconds with 1620 seconds of active time. This session ended with a crash. Error: (03/12/2013 06:19:01 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 6, Application Name: Microsoft Office Outlook, Application Version: 12.0.6668.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 31 seconds with 0 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2013-07-11 13:19:58.161 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. Date: 2013-07-11 13:19:58.141 Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert. ==================== Memory info =========================== Percentage of memory in use: 28% Total physical RAM: 8075.23 MB Available physical RAM: 5766.2 MB Total Pagefile: 16148.65 MB Available Pagefile: 13947.57 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:238.37 GB) (Free:85.9 GB) NTFS (Disk=0 Partition=2) Drive p: (Volume) (Network) (Total:1116.75 GB) (Free:770.33 GB) NTFS Drive s: () (Network) (Total:927.63 GB) (Free:622.82 GB) NTFS Drive w: (Volume) (Network) (Total:1116.75 GB) (Free:770.33 GB) NTFS Drive x: (Volume) (Network) (Total:1116.75 GB) (Free:770.33 GB) NTFS Drive y: () (Network) (Total:927.63 GB) (Free:622.82 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238 GB) (Disk ID: 011564D3) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=238 GB) - (Type=07 NTFS) ==================== End Of Log ============================ Grüße Martina |
|
11.07.2013, 15:00
| #10 |
| /// the machine /// TB-Ausbilder | Trojanerbefall: Umleitung von Links Der war aber schon in Quarantäne. Flash bitte updaten. Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 15:04
| #11 |
| | Trojanerbefall: Umleitung von Links So wenig?  Voilà: Code:
ATTFilter Farbar Service Scanner Version: 10-07-2013 01
Ran by MWeber (administrator) on 11-07-2013 at 16:02:53
Running from "C:\Users\mweber\Desktop"
Microsoft Windows 7 Professional Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
wscsvc Service is not running. Checking service configuration:
The start type of wscsvc service is set to Disabled. The default start type is Auto.
The ImagePath of wscsvc service is OK.
The ServiceDll of wscsvc service is OK.
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Martina |
|
11.07.2013, 18:58
| #12 |
| /// the machine /// TB-Ausbilder | Trojanerbefall: Umleitung von Links Hi, http://download.bleepingcomputer.com...s/7/wscsvc.reg Bitte laden und ausführen, erlauben. Rebooten und frisches FSS log bitte. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
11.07.2013, 19:41
| #13 |
| | Trojanerbefall: Umleitung von Links Hi Schrauber, ist das ein Registry Eintrag zur Aktivierung des Security Center? Den Dienst hab ich vorher noch aktiviert und auf Autostart gestellt. Log schicke ich Dir morgen. Danke schonmal und schönen Abend. Grüße Martina Guten Morgen, bitteschön, ein frisches FSS.log: Code:
ATTFilter Farbar Service Scanner Version: 10-07-2013 01
Ran by MWeber (administrator) on 12-07-2013 at 08:56:27
Running from "C:\Users\mweber\Desktop"
Microsoft Windows 7 Professional Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Grüße Martina |
|
12.07.2013, 08:42
| #14 |
| /// the machine /// TB-Ausbilder | Trojanerbefall: Umleitung von Links Passt. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
12.07.2013, 09:09
| #15 |
| | Trojanerbefall: Umleitung von Links Nö, sieht gut aus. Alle Links aus google öffnen sich wie sie sollen. Tausend Dank! Ohne Deine Hilfe hätte ich das Teil plattmachen müssen! Viele Grüße Martina |
|
| Themen zu Trojanerbefall: Umleitung von Links |
| adobe, antivir, avg, avira, bho, bonjour, desktop, explorer, firefox, format, ftp, google, ihavenet newsbusters, logfile, mozilla, newsbusters, nvidia, nvpciflt.sys, opera, problem, registry, scan, schannel.dll, security, software, spotify web helper, super, symantec, usb, virus, windows |
Linear-Darstellung
