Trojan.VBS.Autorun beim Einstecken eines USB-Sticks

Claudia24 · 30.07.2013, 20:43

Hallo und guten Abend,

ich hoffe, Ihr könnt mir helfen.

Meine Schwester hat sich bei einem Visitenkartenladen auf ihrem USB-Stick den o.g. Trojaner eingefangen. Als sie ihn wieder in Ihren Laptop steckte, schrie ZoneAlarm gleich auf und versuchte zu löschen. Acht von zehn Meldungen wurden gelöscht und die restlichen zwei - wurden nie wieder gesehen. Wir haben uns einen Wolf gesucht und die angehängte ZA-Log gefunden.
Weitere Scans (im abgesicherten Modus) von AntiVir, Spybot, MalwareByte und von ZA haben keine neuen Funde ergeben.
Somit wäre wohl "nur" noch der Stick infiziert - um den kümmere ich mich dann irgendwann!

Meine Schwester hat dann noch HijackThis durchlaufen lassen. Ich hatte die Log online checken lassen. Aber da die Seite nicht mehr gewartet wird, möchte ich auf Nummer sicher gehen und Euch bitten, mal über das Log drüber zu schauen.

Es wäre echt super lieb von Euch, denn ich bin mir echt nicht sicher, ob jetzt wirklich alles in Ordnung ist. Meine Schwester braucht ihren Laptop dienstlich und ist ohne ihn echt aufgeschmissen.

Vielen Dank für Eure Unterstützung
Claudia

schrauber · 31.07.2013, 06:46

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

So funktioniert es:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

Claudia24 · 01.08.2013, 18:43

Hallo Schrauber,

leider kann ich erst jetzt die Scanergebnisse posten. Ich hoffe nur, es ist alles in Ordnung.

Vielen Dank für Deine Hilfe
Liebe Grüße
Claudia

schrauber · 02.08.2013, 10:49

Logs bitte wie oben beschrieben in Codetags in den Thread posten.

Claudia24 · 02.08.2013, 14:37

Hallo Schrauber,
bin wohl zu blind gewesen. Hier also der richtige Datenpost

- FRST.txt

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03
Ran by ... (administrator) on 01-08-2013 17:46:29
Running from C:\Users\...\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieSvc.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Dropbox, Inc.) C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe
() C:\Program Files (x86)\InternetEverywhere\WTGService.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
MountPoints2: F - F:\.\Setup.exe AUTORUN=1
MountPoints2: {323e3194-4ddd-11e2-8c2c-00235afc196c} - G:\.\Setup.exe AUTORUN=1
MountPoints2: {323e31a4-4ddd-11e2-8c2c-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {472ab179-4872-11e2-9c74-00235afc196c} - G:\.\Setup.exe AUTORUN=1
MountPoints2: {472ab185-4872-11e2-9c74-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {472ab197-4872-11e2-9c74-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {77248199-4696-11e2-97fb-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {772481b0-4696-11e2-97fb-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {98b8ebb1-b185-11e1-a0b8-806e6f6e6963} - D:\install_7.exe
MountPoints2: {b44727e1-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {b44727f0-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {b44727fc-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {b4472809-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {b4472817-4ddf-11e2-b1ee-00235afc196c} - F:\.\Setup.exe AUTORUN=1
MountPoints2: {be9b6376-4698-11e2-8b8e-00235afc196c} - F:\.\Setup.exe AUTORUN=1
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2009-06-02] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
SearchScopes: HKCU - DefaultScope {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={CA5D92D3-F190-4120-AB20-A0DE4401FBF4}&mid=f1f1225ee9d147d0a01bd16a1c18f09f-6f542a97238478dd8c9e91d3fb1cc4b5b3e35281&lang=de&ds=st011&pr=sa&d=2012-06-16 18:45:16&v=9.0.0.23&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=rbox&toolbarid=adawaretb&u=BB9CCE2F3C2A4F81A0BCA150843F334C&q={searchTerms}
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = hxxp://isearch.avg.com/search?cid={CA5D92D3-F190-4120-AB20-A0DE4401FBF4}&mid=f1f1225ee9d147d0a01bd16a1c18f09f-6f542a97238478dd8c9e91d3fb1cc4b5b3e35281&lang=de&ds=st011&pr=sa&d=2012-06-16 18:45:16&v=9.0.0.23&sap=dsp&q={searchTerms}
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default
FF user.js: detected! => C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\user.js
FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\zonealarm.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\adawaretb.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\avg-secure-search.xml
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Deutsches Wörterbuch - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: British English Dictionary - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\en-GB@dictionaries.addons.mozilla.org
FF Extension: zonealarm.com - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\ffxtlbr@zonealarm.com
FF Extension: Lavasoft Search Plugin - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\nostmp
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\sfStatistics.xml
FF Extension: tabutils - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\tabutils@ithinc.cn.xpi
FF Extension: toolbar - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\toolbar@gmx.net.xpi
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-12-16] (SANDBOXIE L.T.D)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)
R2 WTGService; C:\Program Files (x86)\InternetEverywhere\WTGService.exe [312784 2010-05-21] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-01-02] (GFI Software)
R1 HWiNFO32; C:\Program Files\HWiNFO64\HWiNFO64A.SYS [30592 2012-05-10] (REALiX(tm))
R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-12-16] (SANDBOXIE L.T.D)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-01 17:46 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe
2013-08-01 17:45 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Downloads\FRST64.exe
2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
2013-07-31 10:17 - 2013-07-31 10:21 - 00000000 ____D C:\Windows\system32\MRT
2013-07-30 19:26 - 2013-07-30 19:26 - 00010376 _____ C:\Users\...\Desktop\hijackthis.log
2013-07-30 18:18 - 2013-07-30 18:18 - 00010379 _____ C:\Users\...\Downloads\hijackthis.log
2013-07-30 17:01 - 2013-07-30 18:15 - 00000645 _____ C:\Users\...\Downloads\Stinger_30072013_170103.html
2013-07-30 16:07 - 2013-07-30 16:07 - 00388608 _____ (Trend Micro Inc.) C:\Users\...\Downloads\HijackThis.exe
2013-07-29 18:16 - 2013-07-30 18:17 - 00000116 ___RH C:\Users\...\Downloads\Stinger.opt
2013-07-29 15:56 - 2013-07-30 16:35 - 00000000 ____D C:\Stinger_Quarantine
2013-07-29 15:56 - 2013-07-29 18:13 - 00000635 _____ C:\Users\...\Downloads\Stinger_29072013_155650.html
2013-07-29 08:47 - 2013-07-30 18:17 - 00000000 ____D C:\Program Files\stinger
2013-07-29 08:47 - 2013-07-29 08:47 - 00490268 _____ C:\Users\...\Downloads\runtime.dat
2013-07-29 08:46 - 2013-07-29 08:47 - 12511264 _____ (McAfee Inc) C:\Users\...\Downloads\stinger64.exe
2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup
2013-07-28 12:30 - 2013-04-29 07:42 - 00446463 _____ C:\Windows\system32\Drivers\etc\hosts.20130728-123008.backup
2013-07-28 12:01 - 2013-07-28 12:02 - 11394080 _____ (McAfee Inc) C:\Users\...\Downloads\stinger32.exe
2013-07-28 11:37 - 2013-07-28 11:37 - 00000666 _____ C:\Windows\PFRO.log
2013-07-28 08:55 - 2013-07-28 08:55 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih(1).exe
2013-07-27 12:49 - 2013-07-27 12:49 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih.exe
2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2
2013-07-12 18:26 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1
2013-07-12 11:45 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 11:45 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 11:45 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 11:45 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 11:45 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 11:45 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 18:52 - 2013-07-11 18:53 - 00000000 ____D C:\Users\...\Downloads\Akouda
2013-07-11 16:07 - 2013-05-13 06:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-11 16:07 - 2013-05-13 06:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-11 16:07 - 2013-05-13 06:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-11 16:07 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-11 16:07 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-11 16:07 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-11 16:07 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23
2013-07-10 17:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 17:31 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 17:31 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 17:31 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 17:31 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 17:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 17:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-03 18:56 - 2013-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 09:10 - 2013-07-03 09:10 - 06018531 _____ C:\Users\...\Downloads\URS dokumentacija.zip
2013-07-03 09:07 - 2013-07-03 09:07 - 08646812 _____ C:\Users\...\Downloads\URC dokumentacija.zip
2013-07-02 17:11 - 2013-07-08 15:23 - 00000000 ____D C:\Users\...\Downloads\PREDD
103

==================== One Month Modified Files and Folders =======

2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST
2013-08-01 17:45 - 2013-08-01 17:46 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe
2013-08-01 17:45 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Downloads\FRST64.exe
2013-08-01 17:43 - 2012-07-26 12:18 - 00000000 ____D C:\Users\...\AppData\Roaming\Dropbox
2013-08-01 17:29 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-01 17:29 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-01 17:20 - 2013-06-29 07:58 - 00002576 _____ C:\Windows\setupact.log
2013-07-31 19:32 - 2012-06-08 17:21 - 02027801 _____ C:\Windows\WindowsUpdate.log
2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
2013-07-31 19:31 - 2012-06-09 16:16 - 00000000 ____D C:\Users\...\AppData\Roaming\Skype
2013-07-31 10:21 - 2013-07-31 10:17 - 00000000 ____D C:\Windows\system32\MRT
2013-07-31 10:15 - 2009-07-14 18:58 - 00657910 _____ C:\Windows\system32\perfh007.dat
2013-07-31 10:15 - 2009-07-14 18:58 - 00131250 _____ C:\Windows\system32\perfc007.dat
2013-07-31 10:15 - 2009-07-14 06:13 - 01529334 _____ C:\Windows\system32\PerfStringBackup.INI
2013-07-30 19:26 - 2013-07-30 19:26 - 00010376 _____ C:\Users\...\Desktop\hijackthis.log
2013-07-30 18:18 - 2013-07-30 18:18 - 00010379 _____ C:\Users\...\Downloads\hijackthis.log
2013-07-30 18:17 - 2013-07-29 18:16 - 00000116 ___RH C:\Users\...\Downloads\Stinger.opt
2013-07-30 18:17 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\stinger
2013-07-30 18:15 - 2013-07-30 17:01 - 00000645 _____ C:\Users\...\Downloads\Stinger_30072013_170103.html
2013-07-30 16:35 - 2013-07-29 15:56 - 00000000 ____D C:\Stinger_Quarantine
2013-07-30 16:10 - 2012-06-09 10:49 - 00000000 ____D C:\Users\...\Desktop\Sicherheit
2013-07-30 16:07 - 2013-07-30 16:07 - 00388608 _____ (Trend Micro Inc.) C:\Users\...\Downloads\HijackThis.exe
2013-07-29 21:34 - 2013-04-03 13:12 - 00000000 ____D C:\Users\...\Downloads\Software
2013-07-29 18:13 - 2013-07-29 15:56 - 00000635 _____ C:\Users\...\Downloads\Stinger_29072013_155650.html
2013-07-29 08:47 - 2013-07-29 08:47 - 00490268 _____ C:\Users\...\Downloads\runtime.dat
2013-07-29 08:47 - 2013-07-29 08:46 - 12511264 _____ (McAfee Inc) C:\Users\...\Downloads\stinger64.exe
2013-07-28 14:24 - 2012-12-24 19:19 - 00000000 ____D C:\Program Files (x86)\stinger
2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup
2013-07-28 12:02 - 2013-07-28 12:01 - 11394080 _____ (McAfee Inc) C:\Users\...\Downloads\stinger32.exe
2013-07-28 11:37 - 2013-07-28 11:37 - 00000666 _____ C:\Windows\PFRO.log
2013-07-28 08:57 - 2012-07-16 07:53 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-28 08:57 - 2012-06-09 20:52 - 00000000 ____D C:\Users\...\AppData\Local\Adobe
2013-07-28 08:57 - 2012-06-09 15:53 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-28 08:57 - 2012-06-09 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-28 08:55 - 2013-07-28 08:55 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih(1).exe
2013-07-27 12:49 - 2013-07-27 12:49 - 01067456 _____ (Solid State Networks) C:\Users\...\Downloads\install_flashplayer11x32au_mssd_aaa_aih.exe
2013-07-18 10:49 - 2013-06-11 19:25 - 00000000 ____D C:\Users\...\Downloads\Forum Citoyen pour l'Environnement_FORCE 2013
2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2
2013-07-12 18:28 - 2013-07-12 18:26 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1
2013-07-12 18:27 - 2012-06-09 16:49 - 00000000 ____D C:\Users\...\AppData\Roaming\vlc
2013-07-12 18:23 - 2012-06-09 13:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-12 11:58 - 2012-06-08 18:18 - 00000000 ____D C:\Windows\Panther
2013-07-11 18:53 - 2013-07-11 18:52 - 00000000 ____D C:\Users\...\Downloads\Akouda
2013-07-11 14:50 - 2012-06-09 21:02 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23
2013-07-10 17:41 - 2009-07-14 05:45 - 00413624 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-10 17:37 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-08 15:23 - 2013-07-02 17:11 - 00000000 ____D C:\Users\...\Downloads\PREDD
2013-07-04 11:39 - 2012-06-15 22:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-07-03 18:56 - 2013-07-03 18:56 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-03 09:10 - 2013-07-03 09:10 - 06018531 _____ C:\Users\...\Downloads\URS dokumentacija.zip
2013-07-03 09:07 - 2013-07-03 09:07 - 08646812 _____ C:\Users\...\Downloads\URC dokumentacija.zip

Files to move or delete:
====================
C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job
C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job
C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job
C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job
C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-06-08 18:10

==================== End Of Log ============================

--- --- ---

--- --- ---

- Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-07-2013 03
Ran by Sabine at 2013-08-01 17:47:50
Running from C:\Users\...\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
7-Zip 9.20 (x32)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Ashampoo Burning Studio 2012 v.10.0.15 (x32 Version: 10.0.15)
ATI Catalyst Install Manager (Version: 3.0.732.0)
Avira Free Antivirus (x32 Version: 13.0.0.3884)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center Core Implementation (x32 Version: 2009.0729.2238.38827)
Catalyst Control Center Graphics Full Existing (x32 Version: 2009.0729.2238.38827)
Catalyst Control Center Graphics Full New (x32 Version: 2009.0729.2238.38827)
Catalyst Control Center Graphics Light (x32 Version: 2009.0729.2238.38827)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.0729.2238.38827)
Catalyst Control Center InstallProxy (x32 Version: 2009.0729.2238.38827)
Catalyst Control Center Localization All (x32 Version: 2009.0729.2238.38827)
CCC Help Chinese Standard (x32 Version: 2009.0729.2237.38827)
CCC Help Chinese Traditional (x32 Version: 2009.0729.2237.38827)
CCC Help Czech (x32 Version: 2009.0729.2237.38827)
CCC Help Danish (x32 Version: 2009.0729.2237.38827)
CCC Help Dutch (x32 Version: 2009.0729.2237.38827)
CCC Help English (x32 Version: 2009.0729.2237.38827)
CCC Help Finnish (x32 Version: 2009.0729.2237.38827)
CCC Help French (x32 Version: 2009.0729.2237.38827)
CCC Help German (x32 Version: 2009.0729.2237.38827)
CCC Help Greek (x32 Version: 2009.0729.2237.38827)
CCC Help Hungarian (x32 Version: 2009.0729.2237.38827)
CCC Help Italian (x32 Version: 2009.0729.2237.38827)
CCC Help Japanese (x32 Version: 2009.0729.2237.38827)
CCC Help Korean (x32 Version: 2009.0729.2237.38827)
CCC Help Norwegian (x32 Version: 2009.0729.2237.38827)
CCC Help Polish (x32 Version: 2009.0729.2237.38827)
CCC Help Portuguese (x32 Version: 2009.0729.2237.38827)
CCC Help Russian (x32 Version: 2009.0729.2237.38827)
CCC Help Spanish (x32 Version: 2009.0729.2237.38827)
CCC Help Swedish (x32 Version: 2009.0729.2237.38827)
CCC Help Thai (x32 Version: 2009.0729.2237.38827)
CCC Help Turkish (x32 Version: 2009.0729.2237.38827)
ccc-core-static (x32 Version: 2009.0729.2238.38827)
ccc-utility64 (Version: 2009.0729.2238.38827)
Dropbox (HKCU Version: 2.0.22)
eaner (Version: 4.01)
EVEREST Home Edition v2.20 (x32 Version: 2.20)
Google Update Helper (x32 Version: 1.3.21.153)
HP Deskjet 3000 J310 series - Grundlegende Software für das Gerät (Version: 28.0.1315.0)
HWiNFO64 Version 3.96 (Version: 3.96)
Intel® Matrix Storage Manager
Internet Everywhere (x32 Version: )
IrfanView (remove only) (x32 Version: 4.32)
Java Auto Updater (x32 Version: 2.1.6.0)
Java(TM) 7 Update 4 (x32 Version: 7.0.40)
JavaFX 2.1.0 (x32 Version: 2.1.0)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Groove MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0)
Mozilla Maintenance Service (x32 Version: 22.0)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
NetCologne-Installationsdateien entfernen (x32)
Opera 12.16 (x32 Version: 12.16.1860)
PDFCreator (x32 Version: 1.3.2)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Realtek Ethernet Controller Driver For Windows Vista and Later (x32 Version: 1.00.0011)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.5904)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30101)
SAGEM F@st 1704 (x32 Version: 1.00.000)
Sandboxie 3.76 (64-bit) (Version: 3.76)
Skype™ 6.5 (x32 Version: 6.5.158)
SpeedFan (remove only) (x32)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Synaptics Pointing Device Driver (Version: 13.2.6.1)
TOSHIBA Assist (x32 Version: 2.01.11)
TOSHIBA Bulletin Board (Version: 1.0.04.64)
TOSHIBA Bulletin Board (x32 Version: 1.0.04.64)
TOSHIBA ConfigFree (x32 Version: 8.0.23)
TOSHIBA Disc Creator (Version: 2.1.0.1 for x64)
TOSHIBA DVD PLAYER (x32 Version: 3.01.0.11-A)
TOSHIBA eco Utility (Version: 1.1.11.64)
TOSHIBA eco Utility (x32 Version: 1.1.11.64)
TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00)
TOSHIBA Extended Tiles for Windows Mobility Center (x32 Version: )
TOSHIBA Face Recognition (Version: 3.1.1.64)
TOSHIBA Face Recognition (x32 Version: 3.1.1.64)
TOSHIBA Flash Cards Support Utility (x32 Version: 1.63.0.4C)
TOSHIBA Hardware Setup (x32 Version: 1.63.0.11C)
TOSHIBA HDD/SSD Alert (Version: 3.1.64.0)
TOSHIBA HDD/SSD Alert (x32 Version: 3.1.64.0)
TOSHIBA PC Health Monitor (Version: 1.4.1.64)
TOSHIBA ReelTime (Version: 1.0.04.64)
TOSHIBA ReelTime (x32 Version: 1.0.04.64)
TOSHIBA SD Memory Utilities (Version: 1.9.1.12)
TOSHIBA Service Station (x32 Version: 2.1.33)
TOSHIBA Supervisor Password (x32 Version: 1.63.0.7C)
TOSHIBA Supervisorkennwort (x32 Version: 1.63.0.7C)
TOSHIBA TEMPRO (x32 Version: 3.35)
TOSHIBA Value Added Package (Version: 1.2.34.64)
TOSHIBA Value Added Package (x32 Version: 1.2.34.64)
TOSHIBA Web Camera Application (x32 Version: 1.1.1.4)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Utility Common Driver (x32 Version: 1.0.50.27C)
VC 9.0 Runtime (x32 Version: 1.0.0)
VLC media player 2.0.2 (x32 Version: 2.0.2)
WinRAR archiver (x32)
xp-AntiSpy 3.98-2 (x32)
ZoneAlarm Antivirus (x32 Version: 10.2.078.000)
ZoneAlarm Firewall (x32 Version: 11.0.000.504)
ZoneAlarm Free Firewall (x32 Version: 11.0.000.504)
ZoneAlarm LTD Toolbar
ZoneAlarm Security (x32 Version: 11.0.000.504)
ZoneAlarm Security Toolbar  (x32 Version: 1.8.11.11)

==================== Restore Points  =========================

31-07-2013 09:12:14 Windows Update

==================== Hosts content: ==========================

2013-04-07 10:21 - 2013-07-28 12:30 - 00449062 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	www.10sek.com
127.0.0.1	10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	www.123fporn.info
127.0.0.1	123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {06344D3C-C3F4-435E-A413-1B6A9E7F8EE9} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-14] (Microsoft Corporation)
Task: {09A1E7A4-A072-4241-8177-05C6EA488BDA} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe No File
Task: {43009BA6-18B0-4644-A5F4-E85D2EB979FC} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation)
Task: {C90BF6F2-B51B-409F-AA26-A0D3A3A96486} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-09-03] (TOSHIBA CORPORATION)
Task: {D9792FE2-6593-43B3-8A59-47733010C68A} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: C:\Windows\Tasks\Ad-Aware Antivirus Scheduled Scan.job => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\ConfigFree Startup Programs.job => C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Deskjet 3000 J310 series.exe_{3D3BC974-AF55-4E5A-9E50-038BDE7B2237}.job => C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\HP Deskjet 3000 J310 series.exe
Task: C:\Windows\Tasks\Toolbox.exe_{55AE83F5-9CC3-466D-9C61-0246AB5F891A}.job => C:\Program Files\HP\HP Deskjet 3000 J310 series\Bin\Toolbox.exe
Task: C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job => c:\program files (x86)\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job => c:\program files (x86)\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job => c:\program files (x86)\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job => c:\program files (x86)\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job => c:\program files (x86)\mozilla firefox\firefox.exe
Task: C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job => c:\program files (x86)\mozilla firefox\firefox.exe

==================== Faulty Device Manager Devices =============

Name: USB2.0 UVC WebCam
Description: USB-Videogerät
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: Microsoft
Service: usbvideo
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Intel(R) WiFi Link 5100 AGN
Description: Intel(R) WiFi Link 5100 AGN
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel Corporation
Service: NETw5s64
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/29/2013 02:59:50 PM) (Source: Avira Antivirus) (User: NT-AUTORITÄT)
Description: AUSNAHMEFEHLER beim Aufruf der Funktion AVEPROC_TestFile() für die Datei
D:\Eigene Dateien\Eigene Dateien\Eigene Bilder\Kuba\3\PICT0400.JPG.
 [ACCESS_VIOLATION Exception!! EIP = 0x70248c32]
 Bitte Avira informieren und die obige Datei übersenden!

Error: (07/28/2013 03:05:46 PM) (Source: Microsoft-Windows-CAPI2) (User: )
Description: Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer" nicht initialisiert werden.


Details:
Could not query the status of the EventSystem service.

System Error:
Der Computer wird heruntergefahren.
.

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )
Description: Der Index kann nicht initialisiert werden.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )
Description: Die Anwendung kann nicht initialisiert werden.

Kontext: Windows Anwendung


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )
Description: Das Gatherer-Objekt kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (06/22/2013 08:40:43 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Element nicht gefunden.  (HRESULT : 0x80070490) (0x80070490)

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )
Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )
Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden.

Kontext: Windows Anwendung, SystemIndex Katalog


Details:
	Die Inhaltsindexdatenbank ist fehlerhaft.  (HRESULT : 0xc0041800) (0xc0041800)

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )
Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)

Error: (06/22/2013 08:40:41 AM) (Source: Windows Search Service) (User: )
Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben.


Details:
	Der Inhaltsindexkatalog ist fehlerhaft.  (HRESULT : 0xc0041801) (0xc0041801)


System errors:
=============
Error: (08/01/2013 05:23:51 PM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (08/01/2013 05:20:26 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (08/01/2013 05:20:26 PM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (07/31/2013 06:49:57 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (07/31/2013 04:38:02 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (07/31/2013 02:12:51 PM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (07/31/2013 09:39:51 AM) (Source: DCOM) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (07/31/2013 09:38:17 AM) (Source: atikmdag) (User: )
Description: Display is not active

Error: (07/31/2013 09:38:17 AM) (Source: atikmdag) (User: )
Description: CPLIB :: General - Invalid Parameter

Error: (07/30/2013 08:33:33 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung von Dienst TOSHIBA eco Utility Service erreicht.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-08-01 17:48:02.178
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-31 19:31:04.545
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-31 16:38:18.191
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-31 14:22:34.101
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-31 14:13:29.666
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-31 10:56:35.906
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-31 10:12:44.231
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-30 20:32:38.495
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-30 19:54:17.723
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-07-30 16:07:08.250
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 50%
Total physical RAM: 4060.88 MB
Available physical RAM: 1994.95 MB
Total Pagefile: 8119.93 MB
Available Pagefile: 5700.57 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:48.73 GB) (Free:14.03 GB) NTFS (Disk=0 Partition=2)
Drive d: (Daten) (Fixed) (Total:117.19 GB) (Free:63.99 GB) NTFS (Disk=0 Partition=3)
Drive e: (Media) (Fixed) (Total:117.19 GB) (Free:114.34 GB) NTFS (Disk=0 Partition=4)
Drive s: (Sicherung) (Fixed) (Total:182.56 GB) (Free:157.43 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: F078D84B)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=49 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=117 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=300 GB) - (Type=OF Extended)

==================== End Of Log ============================

Ich hoffe, jetzt kannst Du alles lesen.

Nochmals vielen Dank und
viele Grüße

Claudia

schrauber · 02.08.2013, 23:16

Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel

Link 1

WICHTIG - Speichere Combofix auf deinem Desktop

Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Claudia24 · 04.08.2013, 16:00

Hallo Schrauber,

habe meine Schwester erreicht (ist nicht so einfach - sie lebt weiter weg :-( )

Hier die Log-Datei von ComboFix:

Code:

ATTFilter

ComboFix 13-08-04.01 - ... 04.08.2013  15:25:39.1.2 - x64 MINIMAL
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4061.2804 [GMT 1:00]
ausgeführt von:: c:\users\...\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: ZoneAlarm Free Firewall Antivirus *Enabled/Updated* {DE038A5B-9EDD-18A9-2361-FF7D98D43730}
FW: ZoneAlarm Free Firewall Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: ZoneAlarm Free Firewall Anti-Spyware *Enabled/Updated* {65626BBF-B8E7-1727-19D1-C40FE3537D8D}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\xp-AntiSpy
c:\program files (x86)\xp-AntiSpy\Uninstall.exe
c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.chm
c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.exe
c:\program files (x86)\xp-AntiSpy\xp-AntiSpy.url
c:\windows\SysWow64\rnaph.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2013-07-04 bis 2013-08-04  ))))))))))))))))))))))))))))))
.
.
2013-08-04 14:30 . 2013-08-04 14:30	--------	d-----w-	c:\users\Default\AppData\Local\temp
2013-08-01 16:46 . 2013-08-01 16:46	--------	d-----w-	C:\FRST
2013-07-31 09:17 . 2013-07-31 09:21	--------	d-----w-	c:\windows\system32\MRT
2013-07-29 14:56 . 2013-07-30 15:35	--------	d-----w-	C:\Stinger_Quarantine
2013-07-29 07:47 . 2013-07-30 17:17	--------	d-----w-	c:\program files\stinger
2013-07-11 15:07 . 2013-05-13 05:51	184320	----a-w-	c:\windows\system32\cryptsvc.dll
2013-07-11 15:07 . 2013-05-13 05:51	1464320	----a-w-	c:\windows\system32\crypt32.dll
2013-07-11 15:07 . 2013-05-13 05:51	139776	----a-w-	c:\windows\system32\cryptnet.dll
2013-07-11 15:07 . 2013-05-13 05:50	52224	----a-w-	c:\windows\system32\certenc.dll
2013-07-11 15:07 . 2013-05-13 04:45	140288	----a-w-	c:\windows\SysWow64\cryptsvc.dll
2013-07-11 15:07 . 2013-05-13 04:45	1160192	----a-w-	c:\windows\SysWow64\crypt32.dll
2013-07-11 15:07 . 2013-05-13 04:45	103936	----a-w-	c:\windows\SysWow64\cryptnet.dll
2013-07-11 15:07 . 2013-05-13 03:43	1192448	----a-w-	c:\windows\system32\certutil.exe
2013-07-11 15:07 . 2013-05-13 03:08	903168	----a-w-	c:\windows\SysWow64\certutil.exe
2013-07-11 15:07 . 2013-05-13 03:08	43008	----a-w-	c:\windows\SysWow64\certenc.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-28 07:57 . 2012-06-09 14:53	71048	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-28 07:57 . 2012-06-09 14:53	692104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-27 13:06 . 2013-05-17 20:13	83672	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2013-06-23 23:57 . 2012-06-09 11:17	78277128	----a-w-	c:\windows\system32\MRT.exe
2013-05-10 05:49 . 2013-06-21 08:10	30720	----a-w-	c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-21 08:10	24576	----a-w-	c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-21 08:10	1910632	----a-w-	c:\windows\system32\drivers\tcpip.sys
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	130736	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-29 98304]
"KeNotify"="c:\program files (x86)\TOSHIBA\Utilities\KeNotify.exe" [2009-01-13 34088]
"HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2009-06-02 423936]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-27 345144]
.
c:\users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 1 (0x1)
.
R1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
R1 HWiNFO32;HWiNFO32/64 Kernel Driver;c:\program files\HWiNFO64\HWiNFO64A.SYS;c:\program files\HWiNFO64\HWiNFO64A.SYS [x]
R1 kl2;kl2;c:\windows\system32\DRIVERS\kl2.sys;c:\windows\SYSNATIVE\DRIVERS\kl2.sys [x]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
R2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
R2 cfWiMAXService;ConfigFree WiMAX Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 ConfigFree Gadget Service;ConfigFree Gadget Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe [x]
R2 ConfigFree Service;ConfigFree Service;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe;c:\program files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [x]
R2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [x]
R2 sbapifs;sbapifs;c:\windows\system32\DRIVERS\sbapifs.sys;c:\windows\SYSNATIVE\DRIVERS\sbapifs.sys [x]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 TOSHIBA eco Utility Service;TOSHIBA eco Utility Service;c:\program files\TOSHIBA\TECO\TecoService.exe;c:\program files\TOSHIBA\TECO\TecoService.exe [x]
R2 WTGService;WTGService;c:\program files (x86)\InternetEverywhere\WTGService.exe;c:\program files (x86)\InternetEverywhere\WTGService.exe [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 NETw5s64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETw5s64.sys;c:\windows\SYSNATIVE\DRIVERS\NETw5s64.sys [x]
R3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys;c:\windows\SYSNATIVE\DRIVERS\netw5v64.sys [x]
R3 PGEffect;Pangu effect driver;c:\windows\system32\DRIVERS\pgeffect.sys;c:\windows\SYSNATIVE\DRIVERS\pgeffect.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys;c:\windows\SYSNATIVE\DRIVERS\Rts516xIR.sys [x]
R3 SBFWIMCL;GFI Software Firewall NDIS IM Filter Service;c:\windows\system32\DRIVERS\sbfwim.sys;c:\windows\SYSNATIVE\DRIVERS\sbfwim.sys [x]
R3 SBFWIMCLMP;GFI Software Firewall NDIS IM Filter Miniport;c:\windows\system32\DRIVERS\SBFWIM.sys;c:\windows\SYSNATIVE\DRIVERS\SBFWIM.sys [x]
R3 sbhips;sbhips;c:\windows\system32\drivers\sbhips.sys;c:\windows\SYSNATIVE\drivers\sbhips.sys [x]
R3 sbwtis;sbwtis;c:\windows\system32\DRIVERS\sbwtis.sys;c:\windows\SYSNATIVE\DRIVERS\sbwtis.sys [x]
R3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe;c:\program files (x86)\Toshiba TEMPRO\TemproSvc.exe [x]
R3 TMachInfo;TMachInfo;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe;c:\program files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [x]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe;c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [x]
R3 TPCHSrv;TPCH Service;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe;c:\program files\TOSHIBA\TPHM\TPCHSrv.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S0 tos_sps64;TOSHIBA tos_sps64 Service;c:\windows\system32\DRIVERS\tos_sps64.sys;c:\windows\SYSNATIVE\DRIVERS\tos_sps64.sys [x]
S1 SBRE;SBRE;c:\windows\system32\drivers\SBREdrv.sys;c:\windows\SYSNATIVE\drivers\SBREdrv.sys [x]
S2 TVALZFL;TOSHIBA ACPI-Based Value Added Logical and General Purpose Device Filter Driver;c:\windows\system32\DRIVERS\TVALZFL.sys;c:\windows\SYSNATIVE\DRIVERS\TVALZFL.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2013-07-28 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-06-09 07:57]
.
2012-06-09 c:\windows\Tasks\ConfigFree Startup Programs.job
- c:\program files (x86)\TOSHIBA\ConfigFree\NDSTray.exe [2009-09-03 13:06]
.
2013-07-12 c:\windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-11-17 22:49]
.
2012-12-31 c:\windows\Tasks\HP Deskjet 3000 J310 series.exe_{3D3BC974-AF55-4E5A-9E50-038BDE7B2237}.job
- c:\program files\HP\HP Deskjet 3000 J310 series\Bin\HP Deskjet 3000 J310 series.exe [2012-10-17 03:40]
.
2012-12-31 c:\windows\Tasks\Toolbox.exe_{55AE83F5-9CC3-466D-9C61-0246AB5F891A}.job
- c:\program files\HP\HP Deskjet 3000 J310 series\Bin\Toolbox.exe [2012-10-17 03:34]
.
2013-01-24 c:\windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job
- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]
.
2013-07-31 c:\windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]
.
2013-01-24 c:\windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job
- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]
.
2013-01-24 c:\windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job
- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]
.
2013-01-24 c:\windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job
- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]
.
2013-01-24 c:\windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job
- c:\program files (x86)\mozilla firefox\firefox.exe [2013-07-03 17:56]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36	164016	----a-w-	c:\users\...\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TosSENotify"="c:\program files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [2009-08-03 709976]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-07-28 7982112]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-11-22 1127592]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{89AAF7E2-24D0-4EC6-A604-F2331129BC1B}: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{89AAF7E2-24D0-4EC6-A604-F2331129BC1B}\6494E4B4: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&
FF - user.js: extensions.zonealarm.hpOld0 - www.benefind.de
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=base2013&Lan={dfltLng}&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&&q=
FF - user.js: extensions.zonealarm.id - 88eb38b2000000000000000000000000
FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84}
FF - user.js: extensions.zonealarm.instlDay - 15834
FF - user.js: extensions.zonealarm.vrsn - 1.8.11.11
FF - user.js: extensions.zonealarm.vrsni - 1.8.11.11
FF - user.js: extensions.zonealarm.vrsnTs - 1.8.11.1117:33
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1025
FF - user.js: extensions.zonealarm.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base2013
FF - user.js: extensions.zonealarm.instlRef - ZLN27462529832131-1001
FF - user.js: extensions.zonealarm.dfltLng - de
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.ffxUnstlRst - false
FF - user.js: extensions.zonealarm.admin - false
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm.rvrt - true
FF - user.js: extensions.zonealarm.hmpg - true
FF - user.js: extensions.zonealarm.hmpgUrl - hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&
FF - user.js: extensions.zonealarm.newTab - true
FF - user.js: extensions.zonealarm.newTabUrl - hxxp://search.zonealarm.com/?src=nt&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-TosWaitSrv - c:\program files (x86)\TOSHIBA\TPHM\TosWaitSrv.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-xp-AntiSpy - c:\program files (x86)\xp-AntiSpy\Uninstall.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-08-04  15:33:26
ComboFix-quarantined-files.txt  2013-08-04 14:33
.
Vor Suchlauf: 10 Verzeichnis(se), 15.844.839.424 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 15.669.121.024 Bytes frei
.
- - End Of File - - A1A127F0A209DC1891A8C107097F4F57
A36C5E4F47E84449FF07ED3517B43A31

Ich hoffe, Sie ist aussagekräftig!

Nochmals vielen lieben Dank für Deine Unterstützung
Liebe Grüße
Claudia

schrauber · 05.08.2013, 07:47

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

und ein frisches FRST log bitte

Claudia24 · 06.08.2013, 19:20

Hallo Schrauber,

leider konnten wir erst heute die gewünschten Scans durchführen.

AdwCleaner[S2].txt:

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 06/08/2013 um 10:34:12 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : ... - ...-PC
# Bootmodus : Abgesicherter Modus
# Ausgeführt unter : C:\Users\...\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Mozilla Firefox v22.0 (de)

Datei : C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\prefs.js

[OK] Die Datei ist sauber.

-\\ Opera v12.16.1860.0

Datei : C:\Users\...\AppData\Roaming\Opera\Opera\operaprefs.ini

[OK] Die Datei ist sauber.

*************************

AdwCleaner[S1].txt - [4546 octets] - [06/08/2013 10:27:24]
AdwCleaner[S2].txt - [928 octets] - [06/08/2013 10:34:12]

########## EOF - C:\AdwCleaner[S2].txt - [987 octets] ##########

mbam-log-2013-08-06 (11-24-42).txt:

Code:

ATTFilter

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Datenbank Version: v2013.08.06.01

Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus)
Internet Explorer 10.0.9200.16635
... :: ...-PC [Administrator]

06.08.2013 11:24:42
mbam-log-2013-08-06 (11-24-42).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|S:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM | P2P
Deaktivierte Suchlaufeinstellungen: 
Durchsuchte Objekte: 368050
Laufzeit: 43 Minute(n), 47 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

FRSTneu.txt:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 (ATTENTION: ====> FRST version is 7 days old and could be outdated)
Ran by ... (administrator) on 06-08-2013 12:16:04
Running from C:\Users\...\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation)
HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2009-06-02] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)
Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default
FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\webde-suche.xml
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Deutsches Wörterbuch - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: British English Dictionary - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\en-GB@dictionaries.addons.mozilla.org
FF Extension: zonealarm.com - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\ffxtlbr@zonealarm.com
FF Extension: Lavasoft Search Plugin - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\nostmp
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\sfStatistics.xml
FF Extension: tabutils - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\tabutils@ithinc.cn.xpi
FF Extension: toolbar - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\toolbar@gmx.net.xpi
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

==================== Services (Whitelisted) =================

S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
S2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
S2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-12-16] (SANDBOXIE L.T.D)
S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
S2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)
S2 WTGService; C:\Program Files (x86)\InternetEverywhere\WTGService.exe [312784 2010-05-21] ()

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-02] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-02] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-01-02] (GFI Software)
S1 HWiNFO32; C:\Program Files\HWiNFO64\HWiNFO64A.SYS [30592 2012-05-10] (REALiX(tm))
S2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)
S1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)
S1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)
S3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-12-16] (SANDBOXIE L.T.D)
S1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-06 10:45 - 2013-08-06 11:18 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt
2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt
2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt
2013-08-06 10:12 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-06 10:10 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe
2013-08-05 08:42 - 2013-08-06 11:14 - 00000336 _____ C:\Windows\setupact.log
2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt
2013-08-04 15:23 - 2013-08-04 15:33 - 00000000 ____D C:\Qoobox
2013-08-04 15:23 - 2013-08-04 15:31 - 00000000 ____D C:\Windows\erdnt
2013-08-04 15:23 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-04 15:23 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-04 15:23 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-04 15:22 - 2013-08-04 14:31 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe
2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe
2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST
2013-08-01 17:46 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe
2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
2013-07-31 10:17 - 2013-07-31 10:21 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 15:56 - 2013-07-30 16:35 - 00000000 ____D C:\Stinger_Quarantine
2013-07-29 08:47 - 2013-07-30 18:17 - 00000000 ____D C:\Program Files\stinger
2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup
2013-07-28 12:30 - 2013-04-29 07:42 - 00446463 _____ C:\Windows\system32\Drivers\etc\hosts.20130728-123008.backup
2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2
2013-07-12 18:26 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1
2013-07-12 11:45 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 11:45 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 11:45 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 11:45 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 11:45 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 11:45 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 18:52 - 2013-07-11 18:53 - 00000000 ____D C:\Users\...\Downloads\Akouda
2013-07-11 16:07 - 2013-05-13 06:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-11 16:07 - 2013-05-13 06:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-11 16:07 - 2013-05-13 06:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-11 16:07 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-11 16:07 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-11 16:07 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-11 16:07 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23
2013-07-10 17:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 17:31 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 17:31 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 17:31 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 17:31 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 17:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 17:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
107

==================== One Month Modified Files and Folders =======

2013-08-06 11:19 - 2012-06-08 17:21 - 01110199 _____ C:\Windows\WindowsUpdate.log
2013-08-06 11:19 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-06 11:19 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-06 11:18 - 2013-08-06 10:45 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-06 11:18 - 2012-06-09 16:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-06 11:16 - 2012-07-26 12:18 - 00000000 ____D C:\Users\...\AppData\Roaming\Dropbox
2013-08-06 11:14 - 2013-08-05 08:42 - 00000336 _____ C:\Windows\setupact.log
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt
2013-08-06 10:37 - 2012-06-09 09:22 - 00000000 ____D C:\Users\...\AppData\Roaming\CheckPoint
2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt
2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt
2013-08-06 10:11 - 2013-08-06 10:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-06 10:11 - 2013-08-06 10:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-05 17:55 - 2012-06-09 10:49 - 00000000 ____D C:\Users\...\Desktop\Sicherheit
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe
2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-08-04 17:25 - 2012-06-09 09:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-04 17:25 - 2012-06-08 18:18 - 00000000 ____D C:\Windows\Panther
2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt
2013-08-04 15:33 - 2013-08-04 15:23 - 00000000 ____D C:\Qoobox
2013-08-04 15:31 - 2013-08-04 15:23 - 00000000 ____D C:\Windows\erdnt
2013-08-04 15:30 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-08-04 14:31 - 2013-08-04 15:22 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe
2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe
2013-08-01 22:39 - 2013-04-03 13:12 - 00000000 ____D C:\Users\...\Downloads\Software
2013-08-01 22:35 - 2009-07-14 18:58 - 00657910 _____ C:\Windows\system32\perfh007.dat
2013-08-01 22:35 - 2009-07-14 18:58 - 00131250 _____ C:\Windows\system32\perfc007.dat
2013-08-01 22:35 - 2009-07-14 06:13 - 01529334 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST
2013-08-01 17:45 - 2013-08-01 17:46 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe
2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
2013-07-31 19:31 - 2012-06-09 16:16 - 00000000 ____D C:\Users\...\AppData\Roaming\Skype
2013-07-31 10:21 - 2013-07-31 10:17 - 00000000 ____D C:\Windows\system32\MRT
2013-07-30 18:17 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\stinger
2013-07-30 16:35 - 2013-07-29 15:56 - 00000000 ____D C:\Stinger_Quarantine
2013-07-28 14:24 - 2012-12-24 19:19 - 00000000 ____D C:\Program Files (x86)\stinger
2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup
2013-07-28 08:57 - 2012-07-16 07:53 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-28 08:57 - 2012-06-09 20:52 - 00000000 ____D C:\Users\...\AppData\Local\Adobe
2013-07-28 08:57 - 2012-06-09 15:53 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-28 08:57 - 2012-06-09 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-18 10:49 - 2013-06-11 19:25 - 00000000 ____D C:\Users\...\Downloads\Forum Citoyen pour l'Environnement_FORCE 2013
2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
2013-07-12 18:28 - 2013-07-12 18:28 - 00000000 ____D C:\Users\...\Desktop\Audio CD_2
2013-07-12 18:28 - 2013-07-12 18:26 - 00000000 ____D C:\Users\...\Desktop\Audio CD_1
2013-07-12 18:27 - 2012-06-09 16:49 - 00000000 ____D C:\Users\...\AppData\Roaming\vlc
2013-07-12 18:23 - 2012-06-09 13:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 18:53 - 2013-07-11 18:52 - 00000000 ____D C:\Users\...\Downloads\Akouda
2013-07-11 14:50 - 2012-06-09 21:02 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23
2013-07-10 17:41 - 2009-07-14 05:45 - 00413624 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-10 17:37 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-08 15:23 - 2013-07-02 17:11 - 00000000 ____D C:\Users\...\Downloads\PREDD

Files to move or delete:
====================
C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job
C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job
C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job
C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job
C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-06-08 18:10

==================== End Of Log ============================

--- --- ---

Meine Schwester erzählte mir, daß diesmal keine Addition.txt entstanden ist.

Viele Grüße und vielen Dank für Deine Unterstützung!
Claudia

schrauber · 07.08.2013, 03:50

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Claudia24 · 07.08.2013, 20:58

Hallo Schrauber,

meine Schwester SecurityCheck und FRST durchgeführt.

SecurityCheck:

Code:

ATTFilter

Results of screen317's Security Check version 0.99.71  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 10  
``````````````Antivirus/Firewall Check:`````````````` 
ZoneAlarm Free Firewall Antivirus   
Avira Desktop                       
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 xp-AntiSpy 3.98-2    
 Spybot - Search & Destroy 
 Malwarebytes Anti-Malware Version 1.75.0.1300  
 JavaFX 2.1.0    
 Java(TM) 7 Update 4  
 Java version out of Date! 
 Adobe Flash Player 11.8.800.94  
 Adobe Reader XI  
 Mozilla Firefox (22.0) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
 CheckPoint ZoneAlarm vsmon.exe  
 CheckPoint ZoneAlarm zatray.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 (ATTENTION: ====> FRST version is 8 days old and could be outdated)
Ran by ... (administrator) on 07-08-2013 18:05:06
Running from C:\Users\...\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(SANDBOXIE L.T.D) C:\Program Files\Sandboxie\SbieSvc.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe
() C:\Program Files (x86)\InternetEverywhere\WTGService.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Dropbox, Inc.) C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
(Microsoft Corporation) C:\Windows\splwow64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe
(Opera Software) C:\Program Files (x86)\Opera\opera.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AcroRd32.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Almico Software (www.almico.com)) C:\Program Files (x86)\SpeedFan\speedfan.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2009-08-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosWaitSrv] - C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [711000 2009-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
HKLM\...\InprocServer32: [Default-cscui]  <==== ATTENTION!
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34088 2009-01-13] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2009-06-02] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)
Startup: C:\Users\...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\...\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://safesearchr.lavasoft.com/?source=3336ca5f&tbp=homepage&toolbarid=adawaretb&v=2_2&u=BB9CCE2F3C2A4F81A0BCA1507DB50408
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll (Safer Networking Limited)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default
FF Homepage: hxxp://search.zonealarm.com/?src=hp&tbid=base2013&Lan=de&gu=866e590beaf945308949e22b5ec8d8a1&tu=10GX0007y1B0008&sku=&tstsId=&ver=&
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.4.1 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.4.1 - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\ecosia.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\searchplugins\webde-suche.xml
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: Deutsches Wörterbuch - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\de-DE@dictionaries.addons.mozilla.org
FF Extension: British English Dictionary - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\en-GB@dictionaries.addons.mozilla.org
FF Extension: zonealarm.com - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\ffxtlbr@zonealarm.com
FF Extension: Lavasoft Search Plugin - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\jid1-yZwVFzbsyfMrqQ@jetpack
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\nostmp
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\sfStatistics.xml
FF Extension: tabutils - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\tabutils@ithinc.cn.xpi
FF Extension: toolbar - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\toolbar@gmx.net.xpi
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi
FF Extension: No Name - C:\Users\...\AppData\Roaming\Mozilla\Firefox\Profiles\gfb7scdz.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

==================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG)
R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
R2 SbieSvc; C:\Program Files\Sandboxie\SbieSvc.exe [123664 2012-12-16] (SANDBOXIE L.T.D)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
S3 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)
R2 WTGService; C:\Program Files (x86)\InternetEverywhere\WTGService.exe [312784 2010-05-21] ()

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-02] (Avira Operations GmbH & Co. KG)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-01-02] (GFI Software)
R1 HWiNFO32; C:\Program Files\HWiNFO64\HWiNFO64A.SYS [30592 2012-05-10] (REALiX(tm))
R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2012-01-09] (Kaspersky Lab ZAO)
R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2012-01-09] (Kaspersky Lab ZAO)
R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [485680 2012-01-09] (Kaspersky Lab)
R3 SbieDrv; C:\Program Files\Sandboxie\SbieDrv.sys [202632 2012-12-16] (SANDBOXIE L.T.D)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [x]
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-07 18:03 - 2013-08-07 18:03 - 00001031 _____ C:\Users\...\Desktop\checkup.txt
2013-08-07 17:54 - 2013-08-07 17:54 - 00891098 _____ C:\Users\...\Downloads\SecurityCheck.exe
2013-08-07 12:53 - 2013-08-07 12:53 - 02347384 _____ (ESET) C:\Users\...\Downloads\esetsmartinstaller_enu.exe
2013-08-06 12:23 - 2013-08-06 12:23 - 00027317 _____ C:\Users\...\Desktop\FRSTneu.txt
2013-08-06 10:45 - 2013-08-06 11:18 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt
2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt
2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt
2013-08-06 10:12 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-06 10:10 - 2013-08-06 10:11 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe
2013-08-05 08:42 - 2013-08-06 12:30 - 00000392 _____ C:\Windows\setupact.log
2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt
2013-08-04 15:23 - 2013-08-04 15:33 - 00000000 ____D C:\Qoobox
2013-08-04 15:23 - 2013-08-04 15:31 - 00000000 ____D C:\Windows\erdnt
2013-08-04 15:23 - 2011-06-26 07:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-04 15:23 - 2010-11-07 18:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-04 15:23 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-04 15:23 - 2000-08-31 01:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-04 15:22 - 2013-08-04 14:31 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe
2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe
2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST
2013-08-01 17:46 - 2013-08-01 17:45 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe
2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
2013-07-31 10:17 - 2013-07-31 10:21 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 15:56 - 2013-07-30 16:35 - 00000000 ____D C:\Stinger_Quarantine
2013-07-29 08:47 - 2013-07-30 18:17 - 00000000 ____D C:\Program Files\stinger
2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup
2013-07-28 12:30 - 2013-04-29 07:42 - 00446463 _____ C:\Windows\system32\Drivers\etc\hosts.20130728-123008.backup
2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
2013-07-12 11:45 - 2013-06-12 00:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-12 11:45 - 2013-06-12 00:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-12 11:45 - 2013-06-12 00:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-12 11:45 - 2013-06-12 00:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-12 11:45 - 2013-06-12 00:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-12 11:45 - 2013-06-12 00:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-12 11:45 - 2013-06-11 23:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-12 11:45 - 2013-06-11 23:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-12 11:45 - 2013-06-07 04:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-12 11:45 - 2013-06-07 03:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 18:52 - 2013-07-11 18:53 - 00000000 ____D C:\Users\...\Downloads\Akouda
2013-07-11 16:07 - 2013-05-13 06:51 - 01464320 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-07-11 16:07 - 2013-05-13 06:51 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-07-11 16:07 - 2013-05-13 06:51 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-07-11 16:07 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-07-11 16:07 - 2013-05-13 05:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-07-11 16:07 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2013-07-11 16:07 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe
2013-07-11 16:07 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll
2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23
2013-07-10 17:31 - 2013-06-05 04:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-10 17:31 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-10 17:31 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-10 17:31 - 2013-05-06 07:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-10 17:31 - 2013-05-06 05:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-10 17:31 - 2013-04-10 00:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-10 17:31 - 2013-04-02 23:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
109

==================== One Month Modified Files and Folders =======

2013-08-07 18:03 - 2013-08-07 18:03 - 00001031 _____ C:\Users\...\Desktop\checkup.txt
2013-08-07 17:56 - 2012-06-08 17:21 - 01131749 _____ C:\Windows\WindowsUpdate.log
2013-08-07 17:54 - 2013-08-07 17:54 - 00891098 _____ C:\Users\...\Downloads\SecurityCheck.exe
2013-08-07 17:47 - 2012-06-10 07:53 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2013-08-07 16:46 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-07 16:46 - 2009-07-14 05:45 - 00014784 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-07 12:53 - 2013-08-07 12:53 - 02347384 _____ (ESET) C:\Users\...\Downloads\esetsmartinstaller_enu.exe
2013-08-06 12:32 - 2012-07-26 12:18 - 00000000 ____D C:\Users\...\AppData\Roaming\Dropbox
2013-08-06 12:30 - 2013-08-05 08:42 - 00000392 _____ C:\Windows\setupact.log
2013-08-06 12:24 - 2012-06-09 21:10 - 00000000 ___RD C:\Users\...\Desktop\Media
2013-08-06 12:23 - 2013-08-06 12:23 - 00027317 _____ C:\Users\...\Desktop\FRSTneu.txt
2013-08-06 11:18 - 2013-08-06 10:45 - 00001117 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-06 11:18 - 2012-06-09 16:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Downloads\AdwCleaner[S2].txt
2013-08-06 10:38 - 2013-08-06 10:38 - 00001055 _____ C:\Users\...\Desktop\AdwCleaner[S2].txt
2013-08-06 10:37 - 2012-06-09 09:22 - 00000000 ____D C:\Users\...\AppData\Roaming\CheckPoint
2013-08-06 10:34 - 2013-08-06 10:34 - 00001055 _____ C:\AdwCleaner[S2].txt
2013-08-06 10:27 - 2013-08-06 10:27 - 00004546 _____ C:\AdwCleaner[S1].txt
2013-08-06 10:11 - 2013-08-06 10:12 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-06 10:11 - 2013-08-06 10:10 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\...\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-05 17:55 - 2012-06-09 10:49 - 00000000 ____D C:\Users\...\Desktop\Sicherheit
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Downloads\adwcleaner.exe
2013-08-05 17:52 - 2013-08-05 17:52 - 00666633 _____ C:\Users\...\Desktop\adwcleaner.exe
2013-08-05 08:42 - 2013-08-05 08:42 - 00000000 _____ C:\Windows\setuperr.log
2013-08-04 17:25 - 2012-06-09 09:37 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-04 17:25 - 2012-06-08 18:18 - 00000000 ____D C:\Windows\Panther
2013-08-04 15:33 - 2013-08-04 15:33 - 00017760 _____ C:\ComboFix.txt
2013-08-04 15:33 - 2013-08-04 15:23 - 00000000 ____D C:\Qoobox
2013-08-04 15:31 - 2013-08-04 15:23 - 00000000 ____D C:\Windows\erdnt
2013-08-04 15:30 - 2009-07-14 03:34 - 00000215 _____ C:\Windows\system.ini
2013-08-04 14:31 - 2013-08-04 15:22 - 05099708 ____R (Swearware) C:\Users\...\Desktop\ComboFix.exe
2013-08-04 14:31 - 2013-08-04 14:31 - 05099708 _____ (Swearware) C:\Users\...\Downloads\ComboFix.exe
2013-08-01 22:39 - 2013-04-03 13:12 - 00000000 ____D C:\Users\...\Downloads\Software
2013-08-01 22:35 - 2009-07-14 18:58 - 00657910 _____ C:\Windows\system32\perfh007.dat
2013-08-01 22:35 - 2009-07-14 18:58 - 00131250 _____ C:\Windows\system32\perfc007.dat
2013-08-01 22:35 - 2009-07-14 06:13 - 01529334 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-01 17:46 - 2013-08-01 17:46 - 00000000 ____D C:\FRST
2013-08-01 17:45 - 2013-08-01 17:46 - 01781589 _____ (Farbar) C:\Users\...\Desktop\FRST64.exe
2013-07-31 19:31 - 2013-07-31 19:31 - 00000352 _____ C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
2013-07-31 19:31 - 2012-06-09 16:16 - 00000000 ____D C:\Users\...\AppData\Roaming\Skype
2013-07-31 10:21 - 2013-07-31 10:17 - 00000000 ____D C:\Windows\system32\MRT
2013-07-30 18:17 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\stinger
2013-07-30 16:35 - 2013-07-29 15:56 - 00000000 ____D C:\Stinger_Quarantine
2013-07-28 14:24 - 2012-12-24 19:19 - 00000000 ____D C:\Program Files (x86)\stinger
2013-07-28 12:30 - 2013-07-28 12:30 - 00449062 ____R C:\Windows\system32\Drivers\etc\hosts.20130728-123030.backup
2013-07-28 08:57 - 2012-07-16 07:53 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-07-28 08:57 - 2012-06-09 20:52 - 00000000 ____D C:\Users\...\AppData\Local\Adobe
2013-07-28 08:57 - 2012-06-09 15:53 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-28 08:57 - 2012-06-09 15:53 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-18 10:49 - 2013-06-11 19:25 - 00000000 ____D C:\Users\...\Downloads\Forum Citoyen pour l'Environnement_FORCE 2013
2013-07-12 21:15 - 2013-07-12 21:15 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore1ce7f3c9633a105.job
2013-07-12 18:27 - 2012-06-09 16:49 - 00000000 ____D C:\Users\...\AppData\Roaming\vlc
2013-07-12 18:23 - 2012-06-09 13:26 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 18:53 - 2013-07-11 18:52 - 00000000 ____D C:\Users\...\Downloads\Akouda
2013-07-11 14:50 - 2012-06-09 21:02 - 00000000 ____D C:\Program Files (x86)\Opera
2013-07-10 18:22 - 2013-07-10 18:22 - 00095853 _____ C:\Users\...\Downloads\Musterbusinessplan_Doenertempel-data.pdf;jsessionid=19E86AB2431B59D42E8BD6207DA1D238.repl23
2013-07-10 17:41 - 2009-07-14 05:45 - 00413624 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-10 17:37 - 2009-07-14 19:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-10 17:37 - 2009-07-14 06:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-08 15:23 - 2013-07-02 17:11 - 00000000 ____D C:\Users\...\Downloads\PREDD

Files to move or delete:
====================
C:\Windows\Tasks\{020F7741-8C06-41AE-A2C6-3464E3DB4769}.job
C:\Windows\Tasks\{3F02381E-7340-4323-8428-84FCDE0B6051}.job
C:\Windows\Tasks\{98188F27-98C8-4287-84B3-46DCCEC3B929}.job
C:\Windows\Tasks\{9B8AEFA2-134D-4E43-88E6-552AEBB6355A}.job
C:\Windows\Tasks\{EC7C70CF-E283-4A3D-8B00-DCE5C6C75C32}.job
C:\Windows\Tasks\{F3FF7234-8D03-47B2-96AE-410EF37C0422}.job

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-06-08 18:10

==================== End Of Log ============================

--- --- ---

Zu dem OnlineCheck - den trauen wir uns nicht durchzuführen. Ist das denn sicher, wenn wir die Anti-Virus-Programme und die Firewall dabei deaktivieren?

Ich habe noch eine Frage. Mir ist nicht ganz klar, ob Du noch Probleme siehst, da meine Schwester keine Meldungen mehr auf dem Laptop hat. Er funktioniert ohne Probleme. (Ich hatte mich ja aus Unsicherheit, ob wirklich wieder alles in Ordnung ist, an das Board gewandt). Hast Du in unseren Logs noch Hinweise auf irgendwelche Schadsoftware gefunden?

Viele Grüße
Claudia

schrauber · 08.08.2013, 06:58

Nein, nur en paar Reste noch, aber der Onlineacan muss sein zur Absicherung. Lass die Firewall an, nur AV abschalten, mach in der Zeit des Scans nix an dem Rechner, dann passt das schon

Claudia24 · 08.08.2013, 18:47

Hallo Schrauber,

ok, Danke! Dann bin ich ja beruhigt. Meine Schwester wird es am Sonntag oder Montag erledigen. Sie ist momentan unterwegs.

Bis dann am Sonntag oder Montag mit den (hoffentlich) letzten Ergebnissen ;-)

Viele Grüße
Claudia

schrauber · 09.08.2013, 10:11

ok

Claudia24 · 10.08.2013, 21:52

Hallo Schrauber,

meine Schwester wollte mit großen Widerwillen, da wir dem Frieden (ohne Virenscanner) nicht trauen, den OnlineScan durchführen. Aber es gibt Probleme beim Update - das Tool will einen Proxy haben. Nur, daß meine Schwester gar keinen Proxy nutzt! Es funktioniert also nicht.
Woran kann das hängen? Ich habe das Problem nicht.

Wäre es schlimm, wenn der OnlineScan nicht durchgeführt wird?

Viele Grüße
Claudia

P.S. Meine Schwester und ich verstehen Deine Worte

Zitat:

Nein, nur en paar Reste noch, aber der Onlineacan muss sein zur Absicherung

unterschiedlich. Sie meint, daß Du mit Rest, weitere Scans meinst, ich dagegen Reste vom Trojanerbefall. Was ist nun richtig?

02.08.2013, 10:49	#4
schrauber /// the machine /// TB-Ausbilder	Trojan.VBS.Autorun beim Einstecken eines USB-Sticks Logs bitte wie oben beschrieben in Codetags in den Thread posten. __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

09.08.2013, 10:11	#14
schrauber /// the machine /// TB-Ausbilder	Trojan.VBS.Autorun beim Einstecken eines USB-Sticks ok __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

Trojan.VBS.Autorun beim Einstecken eines USB-Sticks

Log-Analyse und Auswertung: Trojan.VBS.Autorun beim Einstecken eines USB-Sticks