| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Facebook-Link angeklickt "Just 14 years Old drunk girl .."Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
01.08.2013, 10:50
| #1 |
 |  Facebook-Link angeklickt "Just 14 years Old drunk girl .." Hallo, ich bin neu hier und habe nich viel Ahnung vom PC - ich hoffe ihr könnt mir helfen ... ich habe vor einigen Tagen einen Link von einer guten Bekannten bekommen (Just 14 years Old drunk girl did this infront of all Public) den ich anklickt habe, seitdem wird über meinen Account Mails an meine Kontakte verschickt bzw. werden in meinen Gruppen merkwürdige Links gepostet, von denen ich nichts mitbekommen habe. Darauf hin hatte FB meinen Accout gesperrt und mich aufgefordert Microsoft Security Essentials runterzuladen und einen Scan durchzuführen, das habe ich auch gemacht, aber es wurde nichts gefunden, auch ein Scan mit Antivir bzw. Ad-Aware Antivirus haben nicht gebracht. Ich habe bei FB mein Passwort geändert und auch das Passwort meines Mail-Accounts geändert. Zonealarm und Malwarebytes haben auch keine Auffälligkeiten gefunden, dennoch kommen immer wieder Fehlermeldungen von Java - es werden nach wie vor über diesen Accout Mails und Gruppenpostings verschickt - wahrscheinlich ist da doch ein Virus oder irgendwas - was kann ich tun? Danke für Eure Hilfe! LG Mari |
|
01.08.2013, 11:15
| #2 |
| /// the machine /// TB-Ausbilder    | Facebook-Link angeklickt "Just 14 years Old drunk girl .." hi,
__________________Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ |
|
01.08.2013, 12:59
| #3 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Hallo, danke - für die schnelle Antwort - kann ich das auch von einem Rechner laden, der im gleichen Netzwerk ist .- wie gesagt, ich habe leider keine Ahnung bzw. wie sieht es mit dem Handy aus, das auch im Netzwerk via W-Lan angemeldet ist? LG Mari
__________________ |
|
01.08.2013, 13:47
| #4 |
| /// the machine /// TB-Ausbilder | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Du kanst FRST mit dem infizierten rechner laden, oder mit jedem anderen, dann per Stick rüber zum infizierten.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
01.08.2013, 14:02
| #5 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." also die first-datei: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-07-2013 03 Ran by User (administrator) on 01-08-2013 14:59:14 Running from C:\Users\User\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe () C:\Program Files (x86)\PHotkey\ASLDRSrv.exe (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe () C:\Program Files (x86)\PHotkey\GFNEXSrv.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe () C:\Program Files (x86)\PHotkey\PHotkey.exe () C:\Program Files (x86)\PHotkey\MsgTranAgt.exe () C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe (Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe (CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe (Nero AG) C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe (Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe () C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe () C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe () C:\Program Files\CyberLink\Shared files\RichVideo64.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe () C:\Program Files (x86)\watchmi\TvdService.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (LaCrosse Technology) C:\Program Files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe () C:\Program Files (x86)\watchmi\TvdTray.exe (Deutsche Telekom AG) C:\Program Files\Netzmanager\netzmanager.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe (CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe (Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe () C:\Program Files (x86)\PHotkey\PVDesktop.exe () C:\Program Files (x86)\PHotkey\PVDAgent.exe () C:\Program Files (x86)\PHotkey\POSD.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Lavasoft Limited) C:\PROGRA~2\AD-AWA~1\AdAware.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE (Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe (GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated) HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-16] (Intel(R) Corporation) HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [x] HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-22] (Alcor Micro Corp.) HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-07-18] (Microsoft Corporation) HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM\...\InprocServer32: [Default-cscui] <==== ATTENTION! MountPoints2: {62e04d65-bc53-11e1-a400-4c8093188d31} - F:\CD_Start.exe MountPoints2: {d1862488-d4f9-11e1-be14-4c8093188d31} - F:\setup.exe -a HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2011-04-14] (Renesas Electronics Corporation) HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.) HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD) HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1648264 2013-04-25] (Ask) HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [111080 2012-04-13] (CyberLink) HKLM-x32\...\Run: [Ad-Aware Browsing Protection] - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [554408 2013-05-15] (Lavasoft) HKLM-x32\...\Run: [Search Protection] - C:\ProgramData\Search Protection\SearchProtection.exe [x] HKLM-x32\...\Run: [Ad-Aware Antivirus] - "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run [x] HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] () AppInit_DLLs: C:\Windows\system32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation) AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe (McAfee, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk ShortcutTarget: watchmi tray.lnk -> C:\Windows\Installer\{409DC300-28AF-468F-9624-1F3309701881}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe (Acresso Software Inc.) Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk ShortcutTarget: Netzmanager.lnk -> C:\Program Files\Netzmanager\netzmanager.exe (Deutsche Telekom AG) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Lavasoft HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Welcome to ALDI URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - DefaultScope {EEE6C360-6118-11DC-9C72-001320C79847} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {3BD44F0E-0596-4008-AEE0-45D47E3A8F0E} URL = hxxp://securedsearch2.lavasoft.com/results.php?pr=vmn&id=adawaretb&v=3_1&hsimp=yhs-lavasoft&ent=ch&q={searchTerms} SearchScopes: HKCU - {B8A39C7F-0B98-4835-8743-D0056C3B6A15} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=SLS&o=APN10610&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ADI&apn_dtid=^YYYYYY^YY^DE&apn_uid=f9ef5b24-e944-42a0-aa25-9cc0df0cc410&apn_sauid=FFB05AF3-F12B-4AAB-A6A8-231AA69906BC BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\user.js FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml FF Homepage: hxxp://www.google.de FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll () FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll () FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\11-suche.xml FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\englische-ergebnisse.xml FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\gmx-suche.xml FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\lastminute.xml FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\webde-suche.xml FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\zonealarm.xml FF Extension: zonealarm.com - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\ffxtlbr@zonealarm.com FF Extension: Ask Toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\toolbar@ask.com FF Extension: toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\toolbar@gmx.net.xpi FF Extension: No Name - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker Chrome: ======= CHR HomePage: "homepage": "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=1F4BEC9BFCC762A037091E51F5249DD0", CHR RestoreOnStartup: "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=1F4BEC9BFCC762A037091E51F5249DD0" CHR Extension: (Kaspersky URL Advisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0 CHR Extension: (Virtual Keyboard) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0 CHR Extension: (Anti-Banner) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0 CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\adawaretb\chrome-newtab-search.crx ==================== Services (Whitelisted) ================= R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236336 2013-06-13] (Lavasoft Limited) R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG) R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] () R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.) R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink) R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink) R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-14] () R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies) S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [214896 2011-12-06] () R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2013-07-18] (Microsoft Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-16] () R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG) S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-07-18] (Microsoft Corporation) R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] () R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software) R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD) R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2011-10-07] () R2 WV5Communication; C:\Program Files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe [1843712 2011-01-18] (LaCrosse Technology) S3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe" [x] ==================== Drivers (Whitelisted) ==================== R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-10] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-10] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-10] (Avira Operations GmbH & Co. KG) R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-07-28] (GFI Software) R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies) S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation) S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation) R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-12] (PEGATRON) R3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD) S3 uxddrv; \??\F:\DIAGNOSE\WSTGER64\2PART\uxddrv64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-01 14:56 - 2013-08-01 14:56 - 00000000 ____D C:\FRST 2013-08-01 14:55 - 2013-08-01 14:55 - 01781589 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe 2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes 2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-08-01 11:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-07-31 16:17 - 2013-07-31 16:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-07-31 16:17 - 2013-07-31 16:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-07-31 16:15 - 2013-07-31 16:16 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586(1).exe 2013-07-31 10:36 - 2013-07-29 08:35 - 00001872 _____ C:\Users\User\Desktop\Ad-Aware Antivirus.lnk 2013-07-30 18:32 - 2013-07-30 18:32 - 00000000 ____D C:\Users\User\AppData\Local\{B0DD8DAC-0FDE-487C-BC85-3A1EB96ED03A} 2013-07-29 21:30 - 2013-07-29 21:30 - 00003184 _____ C:\Windows\System32\Tasks\{EB41B063-30F3-47D5-99AC-502F191AB7E8} 2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\X-Setup Pro 2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\ProgramData\X-Setup Pro 2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Program Files (x86)\X-Setup Pro 2013-07-29 21:17 - 2013-07-29 21:17 - 01110476 _____ C:\Users\User\Downloads\7z920.exe 2013-07-29 21:17 - 2013-07-29 21:17 - 00000000 ____D C:\Program Files (x86)\7-Zip 2013-07-29 21:14 - 2013-07-29 21:14 - 06662897 _____ C:\Users\User\Downloads\xsetup92.zip 2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\Users\User\AppData\Local\mquadr.at 2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\ProgramData\mquadr.at 2013-07-29 20:44 - 2013-05-21 17:20 - 00249824 ____N (mquadr.at software engineering & consulting GmbH, web: mquadr.at :: Self-Service Connectivity Software for Internet Access Providers, mail: office@mquadr.at) C:\Windows\SysWOW64\SSDPDiscovery.dll 2013-07-29 20:44 - 2013-05-02 15:36 - 03490112 ____N (mquadr.at software engineering & consulting GmbH) C:\Windows\SysWOW64\m2network64helper.exe 2013-07-29 20:44 - 2013-05-02 09:09 - 03748672 ____N (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll 2013-07-29 20:44 - 2013-05-02 09:08 - 00962368 ____N (mquadr.at software engineering) C:\Windows\SysWOW64\M2ElevatedNetworkAdapters.dll 2013-07-29 20:44 - 2012-12-03 15:58 - 00279040 ____N (Nicomsoft Ltd.) C:\Windows\system32\WiFiMan.dll 2013-07-29 20:44 - 2012-12-03 15:57 - 00238592 ____N (Nicomsoft Ltd.) C:\Windows\SysWOW64\WiFiMan.dll 2013-07-29 20:43 - 2013-07-29 21:10 - 00000000 ____D C:\Users\User\AppData\Local\DTAG 2013-07-29 12:03 - 2013-07-29 12:08 - 00000000 ____D C:\Windows\system32\MRT 2013-07-29 08:47 - 2013-07-29 08:47 - 00001912 _____ C:\Windows\epplauncher.mif 2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-07-29 08:45 - 2013-07-29 08:46 - 13813944 _____ (Microsoft Corporation) C:\Users\User\Downloads\mseinstall.exe 2013-07-28 16:13 - 2013-07-30 17:59 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics 2013-07-28 16:13 - 2013-07-28 16:18 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus 2013-07-28 16:13 - 2013-07-28 16:13 - 00004454 _____ C:\Windows\System32\Tasks\Ad-Aware Antivirus Scheduled Scan 2013-07-28 16:04 - 2013-08-01 11:14 - 00001872 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2013-07-28 16:04 - 2013-07-31 09:36 - 00000000 ____D C:\Program Files (x86)\Ad-Aware Antivirus 2013-07-28 16:04 - 2013-07-28 16:04 - 00000000 ____D C:\ProgramData\Lavasoft 2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\Users\User\AppData\Local\adawarebp 2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Downloaded Installations 2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection 2013-07-28 16:00 - 2013-07-28 21:46 - 00000000 ____D C:\Users\User\AppData\Roaming\Ad-Aware Antivirus 2013-07-28 16:00 - 2013-07-28 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-1.75.0.1300.exe 2013-07-28 16:00 - 2013-07-28 16:00 - 00047496 _____ (GFI Software) C:\Windows\system32\sbbd.exe 2013-07-28 16:00 - 2013-07-28 16:00 - 00014456 _____ (GFI Software) C:\Windows\system32\Drivers\gfibto.sys 2013-07-28 15:59 - 2013-07-28 15:59 - 05616264 _____ (Lavasoft Limited) C:\Users\User\Downloads\Adaware53_Installer.exe 2013-07-28 15:37 - 2013-07-31 16:17 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll 2013-07-28 15:32 - 2013-07-28 15:35 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586.exe 2013-07-28 12:35 - 2013-07-28 12:35 - 00000000 ____D C:\NVIDIA 2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Users\User\AppData\Roaming\Check Point Software Technologies LTD 2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Program Files (x86)\Check Point Software Technologies LTD 2013-07-28 11:54 - 2013-07-28 11:54 - 02402224 _____ (Check Point Software Technologies LTD) C:\Users\User\Downloads\zafwSetupWeb_110_000_504.exe 2013-07-28 11:11 - 2013-07-28 11:11 - 00000000 ____D C:\Users\User\AppData\Local\{5433EC7B-B809-4591-A684-EDA60B38E28E} 2013-07-25 21:31 - 2013-07-25 21:31 - 00027230 _____ C:\Users\User\Desktop\Speedport_W_504V1.17.000_05.11.12_1225_25-07-2013.bin 2013-07-25 11:54 - 2013-07-25 11:54 - 00000000 ____D C:\Users\User\AppData\Local\{F3BBF71B-31A8-4152-B989-19A8891C4EF0} 2013-07-24 12:58 - 2013-07-24 12:58 - 00000000 ____D C:\Users\User\AppData\Local\{46B3821B-8767-4AC5-AFED-2655F06230FB} 2013-07-23 06:37 - 2013-07-23 06:37 - 00000000 ____D C:\Users\User\AppData\Local\{BFCE7EFE-0011-4377-A756-2EADBE8B844D} 2013-07-22 17:00 - 2013-07-22 17:00 - 00000000 ____D C:\Users\User\AppData\Local\{99F423E8-8B87-4B7F-9DBA-6D614EBC50CE} 2013-07-21 15:55 - 2013-07-21 15:55 - 00000000 ____D C:\Users\User\AppData\Local\{476C41D7-B8F8-48EB-91E4-553A78FFD0B4} 2013-07-20 13:59 - 2013-07-20 13:59 - 00000000 ____D C:\Users\User\AppData\Local\{89064572-2890-4C04-9E35-B7BDBEABCC33} 2013-07-19 09:24 - 2013-07-19 09:24 - 00000000 ____D C:\Users\User\AppData\Local\{8EFB7135-45AB-47D9-A6EF-4EBDA95459B1} 2013-07-18 09:29 - 2013-07-18 09:29 - 00000000 ____D C:\Users\User\AppData\Local\{CA92EE73-3901-47E3-9A09-CE80425E155C} 2013-07-16 21:58 - 2013-07-16 21:59 - 00000000 ____D C:\Users\User\AppData\Local\{D8ADA368-3894-49F3-93BC-4547C2C1AF2B} 2013-07-15 12:24 - 2013-07-15 12:24 - 00000000 ____D C:\Users\User\AppData\Local\{1A590330-1673-4B67-BAEB-9B106265FE6D} 2013-07-14 13:24 - 2013-07-14 13:25 - 00000000 ____D C:\Users\User\AppData\Local\{1FDBC2E6-58CF-4DD9-91BD-934540A6551D} 2013-07-12 20:42 - 2013-07-12 20:42 - 00007579 _____ C:\Windows\SysWOW64\SystemData.xml 2013-07-12 08:48 - 2013-07-12 08:48 - 00000000 ____D C:\Users\User\AppData\Local\{7408DA49-7916-4234-9C3B-E505C1BB3977} 2013-07-11 16:09 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-07-11 16:09 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-07-11 16:09 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-07-11 16:09 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-07-11 16:09 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-07-11 16:09 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-07-11 16:09 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-07-11 16:09 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-07-11 16:09 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-07-11 16:09 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-07-11 16:09 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-07-11 16:09 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-07-11 16:09 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-07-11 16:09 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-07-11 16:09 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-07-11 16:09 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-07-11 16:09 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-07-11 16:09 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-07-11 16:09 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-11 16:09 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-07-11 16:09 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-07-11 16:09 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-07-11 09:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2013-07-11 09:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2013-07-11 09:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-07-11 09:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-07-11 09:24 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-07-11 09:24 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2013-07-11 09:24 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2013-07-11 09:02 - 2013-07-11 09:02 - 00000000 ____D C:\Users\User\AppData\Local\{48C426DD-98B6-46DF-8FFE-D2697AAA8427} 2013-07-10 16:35 - 2013-07-10 16:35 - 00000000 ____D C:\Users\User\AppData\Local\{B2C53CFA-EE22-49CC-84CC-253994D29C34} 2013-07-09 15:50 - 2013-07-09 15:50 - 00000000 ____D C:\Users\User\AppData\Local\{73ECE2EF-C73B-4DB4-80EE-3BD6AB66B63C} 2013-07-08 13:01 - 2013-07-08 13:01 - 00000000 ____D C:\Users\User\AppData\Local\{E8854379-5E30-48B6-AE7F-BF2E214D07DE} 2013-07-05 09:34 - 2013-07-05 09:34 - 00000000 ____D C:\Users\User\AppData\Local\{4259B2F4-C3D2-4B02-958E-76D8D7106D22} 2013-07-03 10:23 - 2013-07-03 10:23 - 00000000 ____D C:\Users\User\AppData\Local\{BBE027B0-49CC-404A-82C9-2538786FA42C} 2013-07-03 09:53 - 2013-07-28 16:03 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-02 15:53 - 2013-07-02 15:53 - 00000000 ____D C:\Users\User\AppData\Local\{2DE86AFD-0730-4E0F-A60B-CAAB10660C7A} 119 ==================== One Month Modified Files and Folders ======= 2013-08-01 14:58 - 2013-08-01 14:58 - 00037752 _____ C:\Users\User\Desktop\Addition.txt 2013-08-01 14:56 - 2013-08-01 14:56 - 00000000 ____D C:\FRST 2013-08-01 14:56 - 2012-06-21 12:51 - 02087952 _____ C:\Windows\WindowsUpdate.log 2013-08-01 14:55 - 2013-08-01 14:55 - 01781589 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe 2013-08-01 14:50 - 2011-11-04 03:51 - 00654844 _____ C:\Windows\system32\perfh007.dat 2013-08-01 14:50 - 2011-11-04 03:51 - 00130426 _____ C:\Windows\system32\perfc007.dat 2013-08-01 14:50 - 2009-07-14 07:13 - 01500254 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-01 14:49 - 2009-07-14 06:51 - 00130069 _____ C:\Windows\setupact.log 2013-08-01 14:23 - 2013-05-29 19:40 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-08-01 14:13 - 2012-11-06 12:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-01 11:22 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-01 11:22 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes 2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-08-01 11:15 - 2012-06-21 13:01 - 00000000 ____D C:\Users\User\Documents\Youcam 2013-08-01 11:14 - 2013-07-28 16:04 - 00001872 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk 2013-08-01 11:12 - 2013-05-29 19:40 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-08-01 11:12 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-31 16:17 - 2013-07-31 16:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-07-31 16:17 - 2013-07-31 16:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-07-31 16:17 - 2013-07-28 15:37 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll 2013-07-31 16:17 - 2011-11-07 18:45 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll 2013-07-31 16:17 - 2011-11-07 18:45 - 00000000 ____D C:\Program Files (x86)\Java 2013-07-31 16:16 - 2013-07-31 16:15 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586(1).exe 2013-07-31 16:08 - 2012-10-12 14:17 - 00000000 ____D C:\Program Files\Java 2013-07-31 09:40 - 2010-11-21 05:47 - 00094920 _____ C:\Windows\PFRO.log 2013-07-31 09:36 - 2013-07-28 16:04 - 00000000 ____D C:\Program Files (x86)\Ad-Aware Antivirus 2013-07-30 18:32 - 2013-07-30 18:32 - 00000000 ____D C:\Users\User\AppData\Local\{B0DD8DAC-0FDE-487C-BC85-3A1EB96ED03A} 2013-07-30 17:59 - 2013-07-28 16:13 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics 2013-07-29 21:30 - 2013-07-29 21:30 - 00003184 _____ C:\Windows\System32\Tasks\{EB41B063-30F3-47D5-99AC-502F191AB7E8} 2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\X-Setup Pro 2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\ProgramData\X-Setup Pro 2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Program Files (x86)\X-Setup Pro 2013-07-29 21:17 - 2013-07-29 21:17 - 01110476 _____ C:\Users\User\Downloads\7z920.exe 2013-07-29 21:17 - 2013-07-29 21:17 - 00000000 ____D C:\Program Files (x86)\7-Zip 2013-07-29 21:15 - 2013-05-22 15:01 - 00000000 ____D C:\Users\User\AppData\Local\WinZip 2013-07-29 21:14 - 2013-07-29 21:14 - 06662897 _____ C:\Users\User\Downloads\xsetup92.zip 2013-07-29 21:10 - 2013-07-29 20:43 - 00000000 ____D C:\Users\User\AppData\Local\DTAG 2013-07-29 21:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF 2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\Users\User\AppData\Local\mquadr.at 2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\ProgramData\mquadr.at 2013-07-29 12:08 - 2013-07-29 12:03 - 00000000 ____D C:\Windows\system32\MRT 2013-07-29 08:47 - 2013-07-29 08:47 - 00001912 _____ C:\Windows\epplauncher.mif 2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-07-29 08:46 - 2013-07-29 08:45 - 13813944 _____ (Microsoft Corporation) C:\Users\User\Downloads\mseinstall.exe 2013-07-29 08:35 - 2013-07-31 10:36 - 00001872 _____ C:\Users\User\Desktop\Ad-Aware Antivirus.lnk 2013-07-29 08:34 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-07-28 21:46 - 2013-07-28 16:00 - 00000000 ____D C:\Users\User\AppData\Roaming\Ad-Aware Antivirus 2013-07-28 21:24 - 2012-12-04 15:19 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan 2013-07-28 16:18 - 2013-07-28 16:13 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus 2013-07-28 16:13 - 2013-07-28 16:13 - 00004454 _____ C:\Windows\System32\Tasks\Ad-Aware Antivirus Scheduled Scan 2013-07-28 16:04 - 2013-07-28 16:04 - 00000000 ____D C:\ProgramData\Lavasoft 2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\Users\User\AppData\Local\adawarebp 2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Downloaded Installations 2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection 2013-07-28 16:03 - 2013-07-03 09:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-28 16:01 - 2013-07-28 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-1.75.0.1300.exe 2013-07-28 16:00 - 2013-07-28 16:00 - 00047496 _____ (GFI Software) C:\Windows\system32\sbbd.exe 2013-07-28 16:00 - 2013-07-28 16:00 - 00014456 _____ (GFI Software) C:\Windows\system32\Drivers\gfibto.sys 2013-07-28 15:59 - 2013-07-28 15:59 - 05616264 _____ (Lavasoft Limited) C:\Users\User\Downloads\Adaware53_Installer.exe 2013-07-28 15:35 - 2013-07-28 15:32 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586.exe 2013-07-28 12:35 - 2013-07-28 12:35 - 00000000 ____D C:\NVIDIA 2013-07-28 12:03 - 2012-11-17 22:03 - 00417563 _____ C:\Windows\system32\Drivers\vsconfig.xml 2013-07-28 11:59 - 2012-11-17 22:03 - 00000762 _____ C:\Users\Public\Desktop\ZoneAlarm Security.lnk 2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Users\User\AppData\Roaming\Check Point Software Technologies LTD 2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Program Files (x86)\Check Point Software Technologies LTD 2013-07-28 11:54 - 2013-07-28 11:54 - 02402224 _____ (Check Point Software Technologies LTD) C:\Users\User\Downloads\zafwSetupWeb_110_000_504.exe 2013-07-28 11:11 - 2013-07-28 11:11 - 00000000 ____D C:\Users\User\AppData\Local\{5433EC7B-B809-4591-A684-EDA60B38E28E} 2013-07-26 12:34 - 2012-07-18 07:34 - 00000000 ____D C:\Users\User\Citrix 2013-07-25 21:31 - 2013-07-25 21:31 - 00027230 _____ C:\Users\User\Desktop\Speedport_W_504V1.17.000_05.11.12_1225_25-07-2013.bin 2013-07-25 11:54 - 2013-07-25 11:54 - 00000000 ____D C:\Users\User\AppData\Local\{F3BBF71B-31A8-4152-B989-19A8891C4EF0} 2013-07-24 12:58 - 2013-07-24 12:58 - 00000000 ____D C:\Users\User\AppData\Local\{46B3821B-8767-4AC5-AFED-2655F06230FB} 2013-07-23 06:37 - 2013-07-23 06:37 - 00000000 ____D C:\Users\User\AppData\Local\{BFCE7EFE-0011-4377-A756-2EADBE8B844D} 2013-07-22 17:00 - 2013-07-22 17:00 - 00000000 ____D C:\Users\User\AppData\Local\{99F423E8-8B87-4B7F-9DBA-6D614EBC50CE} 2013-07-21 15:55 - 2013-07-21 15:55 - 00000000 ____D C:\Users\User\AppData\Local\{476C41D7-B8F8-48EB-91E4-553A78FFD0B4} 2013-07-20 13:59 - 2013-07-20 13:59 - 00000000 ____D C:\Users\User\AppData\Local\{89064572-2890-4C04-9E35-B7BDBEABCC33} 2013-07-19 21:03 - 2013-06-15 15:28 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype 2013-07-19 09:24 - 2013-07-19 09:24 - 00000000 ____D C:\Users\User\AppData\Local\{8EFB7135-45AB-47D9-A6EF-4EBDA95459B1} 2013-07-18 09:29 - 2013-07-18 09:29 - 00000000 ____D C:\Users\User\AppData\Local\{CA92EE73-3901-47E3-9A09-CE80425E155C} 2013-07-16 21:59 - 2013-07-16 21:58 - 00000000 ____D C:\Users\User\AppData\Local\{D8ADA368-3894-49F3-93BC-4547C2C1AF2B} 2013-07-16 21:18 - 2013-05-29 19:40 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-07-16 21:18 - 2013-05-29 19:40 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-07-15 12:24 - 2013-07-15 12:24 - 00000000 ____D C:\Users\User\AppData\Local\{1A590330-1673-4B67-BAEB-9B106265FE6D} 2013-07-14 13:25 - 2013-07-14 13:24 - 00000000 ____D C:\Users\User\AppData\Local\{1FDBC2E6-58CF-4DD9-91BD-934540A6551D} 2013-07-12 20:42 - 2013-07-12 20:42 - 00007579 _____ C:\Windows\SysWOW64\SystemData.xml 2013-07-12 08:48 - 2013-07-12 08:48 - 00000000 ____D C:\Users\User\AppData\Local\{7408DA49-7916-4234-9C3B-E505C1BB3977} 2013-07-12 08:23 - 2009-07-14 06:45 - 00368344 _____ C:\Windows\system32\FNTCACHE.DAT 2013-07-12 08:22 - 2013-03-14 14:53 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-12 08:22 - 2013-03-14 14:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-12 08:22 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-12 08:22 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-12 08:22 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-11 09:02 - 2013-07-11 09:02 - 00000000 ____D C:\Users\User\AppData\Local\{48C426DD-98B6-46DF-8FFE-D2697AAA8427} 2013-07-10 16:35 - 2013-07-10 16:35 - 00000000 ____D C:\Users\User\AppData\Local\{B2C53CFA-EE22-49CC-84CC-253994D29C34} 2013-07-09 15:50 - 2013-07-09 15:50 - 00000000 ____D C:\Users\User\AppData\Local\{73ECE2EF-C73B-4DB4-80EE-3BD6AB66B63C} 2013-07-08 13:01 - 2013-07-08 13:01 - 00000000 ____D C:\Users\User\AppData\Local\{E8854379-5E30-48B6-AE7F-BF2E214D07DE} 2013-07-05 11:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache 2013-07-05 09:34 - 2013-07-05 09:34 - 00000000 ____D C:\Users\User\AppData\Local\{4259B2F4-C3D2-4B02-958E-76D8D7106D22} 2013-07-03 16:31 - 2012-08-19 15:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-07-03 12:04 - 2013-05-19 20:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox.bak 2013-07-03 10:23 - 2013-07-03 10:23 - 00000000 ____D C:\Users\User\AppData\Local\{BBE027B0-49CC-404A-82C9-2538786FA42C} 2013-07-02 15:53 - 2013-07-02 15:53 - 00000000 ____D C:\Users\User\AppData\Local\{2DE86AFD-0730-4E0F-A60B-CAAB10660C7A} ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-21 14:08 ==================== End Of Log ============================ ... und hier die AdditionFRST Additions Logfile: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-07-2013 03 Ran by User at 2013-08-01 15:01:28 Running from C:\Users\User\Desktop Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= 7-Zip 9.20 (x32) Ad-Aware Antivirus (x32 Version: 10.5.3.4405) Ad-Aware Browsing Protection (x32 Version: 1.0.1.106) Adobe AIR (x32 Version: 3.1.0.4880) Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224) Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224) Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7) Alcor Micro USB Card Reader (x32 Version: 1.8.1217.36096) ALDI SÜD Mah Jong (x32) AMI VR-pulse OS Switcher (Version: 1.1) Ashampoo Burning Studio (x32 Version: 10.0.10) Ashampoo Photo Commander (x32 Version: 9.2.0) Ashampoo Photo Optimizer (x32 Version: 4.0.0) Ashampoo Snap (x32 Version: 4.3.0) Ask Toolbar (x32 Version: 1.15.25.0) Ask Toolbar Updater (HKCU Version: 1.2.6.44892) Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.35) Avira Free Antivirus (x32 Version: 13.0.0.3884) Control ActiveX de Windows Live Mesh para conexiones remotas (x32 Version: 15.4.5722.2) Contrôle ActiveX Windows Live Mesh pour connexions à distance (x32 Version: 15.4.5722.2) Corel Graphics - Windows Shell Extension (x32 Version: 15.2.0.686) Corel Graphics - Windows Shell Extension (x32 Version: 15.2.686) Corel Graphics - Windows Shell Extension 64 Bit (Version: 15.2.686) CorelDRAW Essentials X5 - Common (x32 Version: 15.3) CorelDRAW Essentials X5 - Connect (x32 Version: 15.3) CorelDRAW Essentials X5 - Custom Data (x32 Version: 15.3) CorelDRAW Essentials X5 - DE (x32 Version: 15.3) CorelDRAW Essentials X5 - Draw (x32 Version: 15.3) CorelDRAW Essentials X5 - EN (x32 Version: 15.3) CorelDRAW Essentials X5 - ES (x32 Version: 15.3) CorelDRAW Essentials X5 - Extra Content (x32 Version: 15.0) CorelDRAW Essentials X5 - Extra Content (x32) CorelDRAW Essentials X5 - Filters (x32 Version: 15.3) CorelDRAW Essentials X5 - FR (x32 Version: 15.3) CorelDRAW Essentials X5 - IPM (x32 Version: 15.3) CorelDRAW Essentials X5 - IT (x32 Version: 15.3) CorelDRAW Essentials X5 - PHOTO-PAINT (x32 Version: 15.3) CorelDRAW Essentials X5 - Redist (x32 Version: 15.0) CorelDRAW Essentials X5 - Setup Files (x32 Version: 15.3) CorelDRAW Essentials X5 - WT (x32 Version: 15.3) CorelDRAW Essentials X5 (x32 Version: 15.2.0.686) CorelDRAW Essentials X5 (x32 Version: 15.3) CyberLink LabelPrint (x32 Version: 2.5.3624) CyberLink MediaEspresso (x32 Version: 6.5.1508_36229) CyberLink MediaShow (x32 Version: 5.1.2414) CyberLink PhotoNow (x32 Version: 1.1.7717) CyberLink Power2Go (x32 Version: 7.0.0.2813) CyberLink PowerDirector (Version: 9.0.0.3419a) CyberLink PowerDirector (x32 Version: 9.0.0.3419a) CyberLink PowerDVD 10 (x32 Version: 10.0.3510.02) CyberLink PowerDVD Copy (x32 Version: 1.5.1306) CyberLink PowerProducer (x32 Version: 5.0.2.3503) CyberLink WaveEditor (x32 Version: 1.0.1.3320) CyberLink YouCam 5 (x32 Version: 5.0.1108) D3DX10 (x32 Version: 15.4.2368.0902) Dolby Advanced Audio v2 (x32 Version: 7.2.7000.4) exant HD Audio (Version: 8.54.14.50) FileViewPro (Version: 1.5) Fotogalerija Windows Live (x32 Version: 15.4.3502.0922) Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) GM PROTOKOLLmanager Professional 8 8F04 (x32 Version: 8F04) GMC-I Driver Control 1.13.00 (x32 Version: 1.13.00) Google Earth Plug-in (x32 Version: 7.1.1.1580) Google Update Helper (x32 Version: 1.3.21.153) Heavy Weather Pro WS 2800 EU (x32) Intel PROSet Wireless Intel PROSet Wireless (x32) Intel(R) Management Engine Components (x32 Version: 7.0.0.1118) Intel(R) Processor Graphics (x32 Version: 8.15.10.2538) Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology (Version: 1.2.0.0587) Intel(R) PROSet/Wireless WiFi Software (Version: 14.2.1000) Intel(R) Rapid Storage Technology (x32 Version: 10.6.0.1002) Intel(R) WiDi (x32 Version: 2.2.14.0) Intel(R) Wireless Display Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Java(TM) 6 Update 29 (x32 Version: 6.0.290) Java(TM) 6 Update 31 (64-bit) (Version: 6.0.310) Junk Mail filter update (x32 Version: 15.4.3502.0922) Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (x32 Version: 15.4.5722.2) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Max Local Application (x32 Version: 1.3.7) Medion Home Cinema (x32 Version: 8.0.3216) Memeo Instant Backup (x32 Version: 4.60.0.7943) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Mathematics (64-Bit) (Version: 4.0) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000) Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000) Microsoft Security Client (Version: 4.3.0216.0) Microsoft Security Essentials (Version: 4.3.216.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0) MotoHelper 2.1.32 Driver 5.4.0 (x32 Version: 2.1.32) MotoHelper MergeModules (x32 Version: 1.2.0) MOTOROLA MEDIA LINK (x32 Version: 1.5.4090.2) Motorola Mobile Drivers Installation 5.4.0 (Version: 5.4.0) Mozilla Firefox 22.0 (x86 de) (x32 Version: 22.0) Mozilla Maintenance Service (x32 Version: 22.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) Netzmanager (Version: 1.071) Netzmanager (x32 Version: 1.071) NVIDIA Control Panel 285.64 (Version: 285.64) NVIDIA Graphics Driver 285.64 (Version: 285.64) NVIDIA Install Application (Version: 2.1002.46.235) NVIDIA Optimus 1.5.20 (Version: 1.5.20) NVIDIA PhysX (x32 Version: 9.10.0513) NVIDIA Update Components (Version: 1.5.20) PCSUITE SHREDDER (x32) PHotkey (x32 Version: 1.00.0045) PlayReady PC Runtime amd64 (Version: 1.3.0) Pošta Windows Live (x32 Version: 15.4.3502.0922) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.16.0) Skype™ 6.5 (x32 Version: 6.5.158) Spelling Dictionaries Support For Adobe Reader X (x32 Version: 10.0.0) Synaptics Pointing Device Driver (Version: 15.3.27.1) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) watchmi (x32 Version: 2.7.0) Windows Live (x32 Version: 15.4.3502.0922) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3555.0308) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live Fotótár (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (x32 Version: 15.4.5722.2) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-objekt til fjernforbindelser (x32 Version: 15.4.5722.2) Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) WinZip 17.5 (x32 Version: 17.5.10480) XQDC X-Setup Pro 9.2.100 (x32 Version: 9.2.100) ZoneAlarm Firewall (x32 Version: 11.0.000.018) ZoneAlarm Firewall (x32 Version: 11.0.000.504) ZoneAlarm Free Firewall (x32 Version: 11.0.000.504) ZoneAlarm LTD Toolbar ZoneAlarm Security (x32 Version: 11.0.000.018) ZoneAlarm Security (x32 Version: 11.0.000.504) ZoneAlarm Security Toolbar (x32 Version: 1.8.11.11) ==================== Restore Points ========================= 11-07-2013 07:15:41 Windows Update 11-07-2013 14:00:18 Windows Update 16-07-2013 16:17:08 Windows Update 23-07-2013 12:16:21 Windows Update 28-07-2013 13:36:15 Installed Java 7 Update 25 29-07-2013 06:53:52 Windows Update 29-07-2013 09:55:38 Windows Update 31-07-2013 13:59:01 Removed Java 7 Update 13 (64-bit) 31-07-2013 14:10:47 Removed Java 7 Update 25 31-07-2013 14:11:37 Removed Java 7 Update 25 31-07-2013 14:17:07 Installed Java 7 Update 25 ==================== Hosts content: ========================== 2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {055071DB-EDC1-4C12-A05E-81DEEE2B0752} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-21] (Microsoft Corporation) Task: {1AEB2BA1-1F47-4222-BD36-94515072DC66} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-29] (Google Inc.) Task: {25D12C2E-232F-4501-BEDC-06BD0D46313A} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2013-04-25] () Task: {3A5D056D-CF04-43A3-A083-0EBF4BF48F15} - System32\Tasks\MotoHelper MUM => C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06] () Task: {574A2071-6DCE-43C8-9693-430110F10F9B} - System32\Tasks\YCMServiceAgent => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [2011-11-08] (CyberLink Corp.) Task: {7C73344B-B5C6-48A9-B646-CBEF6694B9C4} - System32\Tasks\MotoHelper Initial Update => C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06] () Task: {9300EC70-0E44-476F-A0F8-B795B9B7A1AF} - System32\Tasks\MotoHelper Routing => C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06] () Task: {99F815AF-B0FA-477C-A333-E3E62FB5DCC4} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {B249AF23-6019-494E-ADDE-524950FCC564} - System32\Tasks\Ad-Aware Antivirus Scheduled Scan => C:\PROGRA~2\AD-AWA~1\AdAwareLauncher.exe [2013-06-13] (Lavasoft Limited) Task: {B948ED42-22AE-4CCD-9F21-BD43E7EC1F4F} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe [2013-07-18] (Microsoft Corporation) Task: {C014C528-A70D-429C-A061-91E346A3C248} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated) Task: {C834698C-4D1F-4CAB-9759-A47360247FB3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-29] (Google Inc.) Task: {F938EE89-E79F-454F-8D44-912115BEEF2B} - System32\Tasks\MotoHelper Update => C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperUpdate.exe [2011-12-06] () Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/01/2013 02:50:31 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Error: (08/01/2013 02:50:28 PM) (Source: SideBySide) (User: ) Description: Fehler beim Generieren des Aktivierungskontexts für "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest1". Fehler in Manifest- oder Richtliniendatei "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest2" in Zeile C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest3. Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:. Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Komponente 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Error: (08/01/2013 11:24:07 AM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (08/01/2013 11:13:08 AM) (Source: MemeoBackgroundService) (User: ) Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen Error: (07/31/2013 04:09:43 PM) (Source: MsiInstaller) (User: User-PC) Description: Produkt: Ask Toolbar -- Fehler 1730. Sie müssen über Administratorrechte verfügen, um diese Anwendung entfernen zu können. Melden Sie sich als Administrator an oder wenden Sie sich an den technischen Support, um Unterstützung zu erhalten. Error: (07/31/2013 03:42:07 PM) (Source: MemeoBackgroundService) (User: ) Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden. bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data) bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor) bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider) --- Ende der internen Ausnahmestapelüberwachung --- bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType) bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity) bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args) Error: (07/31/2013 10:41:30 AM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (07/31/2013 10:30:48 AM) (Source: MemeoBackgroundService) (User: ) Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden. bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data) bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor) bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider) --- Ende der internen Ausnahmestapelüberwachung --- bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType) bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity) bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args) Error: (07/31/2013 09:53:10 AM) (Source: CVHSVC) (User: ) Description: Nur zur Information. (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (07/31/2013 09:42:27 AM) (Source: MemeoBackgroundService) (User: ) Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden. bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data) bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor) bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider) --- Ende der internen Ausnahmestapelüberwachung --- bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType) bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity) bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args) System errors: ============= Error: (07/31/2013 03:47:19 PM) (Source: Microsoft Antimalware) (User: ) Description: %NT-AUTORITÄT60 has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.155.1104.0 Update Source: %NT-AUTORITÄT59 Update Stage: 4.3.0216.00 Source Path: 4.3.0216.01 Signature Type: %NT-AUTORITÄT602 Update Type: %NT-AUTORITÄT604 User: NT-AUTORITÄT\SYSTEM Current Engine Version: %NT-AUTORITÄT605 Previous Engine Version: %NT-AUTORITÄT606 Error code: %NT-AUTORITÄT607 Error description: %NT-AUTORITÄT608 Error: (07/31/2013 09:40:01 AM) (Source: DCOM) (User: ) Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5} Error: (07/29/2013 09:04:28 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/29/2013 09:04:28 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/29/2013 09:04:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/29/2013 09:04:27 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/29/2013 09:04:27 PM) (Source: DCOM) (User: ) Description: 2McComponentHostService{CC6F4D12-8575-4CFF-9455-CF5774AEB13B} Error: (07/29/2013 09:33:36 AM) (Source: BROWSER) (User: ) Description: Das Einlesen der Sicherungsliste durch den Suchdienst schlug auf Transport "\Device\NetBT_Tcpip_{D4ECBD93-2721-4AC3-95B0-64293A4227C1}" zu oft fehl. Der Sicherungssuchdienst wird beendet. Error: (07/28/2013 05:42:55 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Error: (07/28/2013 05:42:55 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "McAfee Security Scan Component Host Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%2 Microsoft Office Sessions: ========================= Error: (08/01/2013 02:50:31 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Users\User\Downloads\computerbild_downloader_fuer_winzip(1).exe Error: (08/01/2013 02:50:28 PM) (Source: SideBySide)(User: ) Description: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Users\User\Downloads\computerbild_downloader_fuer_winzip.exe Error: (08/01/2013 11:24:07 AM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (08/01/2013 11:13:08 AM) (Source: MemeoBackgroundService)(User: ) Description: Der Dienst kann nicht gestartet werden. Der Dienstprozess konnte keine Verbindung mit dem Dienstcontroller herstellen Error: (07/31/2013 04:09:43 PM) (Source: MsiInstaller)(User: User-PC) Description: Produkt: Ask Toolbar -- Fehler 1730. Sie müssen über Administratorrechte verfügen, um diese Anwendung entfernen zu können. Melden Sie sich als Administrator an oder wenden Sie sich an den technischen Support, um Unterstützung zu erhalten.(NULL)(NULL)(NULL)(NULL)(NULL) Error: (07/31/2013 03:42:07 PM) (Source: MemeoBackgroundService)(User: ) Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden. bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data) bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor) bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider) --- Ende der internen Ausnahmestapelüberwachung --- bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType) bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity) bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args) Error: (07/31/2013 10:41:30 AM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (07/31/2013 10:30:48 AM) (Source: MemeoBackgroundService)(User: ) Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden. bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data) bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor) bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider) --- Ende der internen Ausnahmestapelüberwachung --- bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType) bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity) bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args) Error: (07/31/2013 09:53:10 AM) (Source: CVHSVC)(User: ) Description: (Patch task for {90140011-0066-0407-0000-0000000FF1CE}): DownloadLatest Failed: Zurzeit sind keine aktiven Netzwerkverbindungen verfügbar. Der Vorgang wird von BITS wiederholt, sobald der Adapter über eine Verbindung verfügt. Error: (07/31/2013 09:42:27 AM) (Source: MemeoBackgroundService)(User: ) Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden. bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data) bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor) bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider) --- Ende der internen Ausnahmestapelüberwachung --- bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType) bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture) bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes) bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration. bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity) bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity) bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args) CodeIntegrity Errors: =================================== Date: 2013-08-01 14:48:51.486 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 14:18:53.311 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 13:57:51.352 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 13:42:43.704 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 13:17:55.468 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 12:15:54.511 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 12:07:33.806 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-08-01 11:34:01.350 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-31 16:09:18.440 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. Date: 2013-07-31 15:54:37.723 Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde. ==================== Memory info =========================== Percentage of memory in use: 60% Total physical RAM: 4007.05 MB Available physical RAM: 1598.36 MB Total Pagefile: 8012.29 MB Available Pagefile: 4912.21 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (Boot) (Fixed) (Total:404.66 GB) (Free:351.85 GB) NTFS (Disk=0 Partition=2) Drive d: (Recover) (Fixed) (Total:60 GB) (Free:29.03 GB) NTFS (Disk=0 Partition=3) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 2BD2C32A) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=405 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=60 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=1 GB) - (Type=12) ==================== End Of Log ============================ |
|
01.08.2013, 21:14
| #6 | |
| /// the machine /// TB-Ausbilder | Facebook-Link angeklickt "Just 14 years Old drunk girl .."Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ --> Facebook-Link angeklickt "Just 14 years Old drunk girl .." |
|
02.08.2013, 07:17
| #7 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Combofix Logfile: Code:
ATTFilter ComboFix 13-08-01.01 - User 02.08.2013 7:41.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4007.1857 [GMT 2:00]
ausgeführt von:: c:\users\User\Desktop\ComboFix.exe
AV: Avira Desktop *Enabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: Lavasoft Ad-Aware *Disabled/Updated* {E0D97DD4-42BA-B3F2-A5A7-22E9ACE81FC7}
AV: Microsoft Security Essentials *Enabled/Updated* {641105E6-77ED-3F35-A304-765193BCB75F}
FW: Lavasoft Ad-Aware *Disabled* {D8E2FCF1-08D5-B2AA-8EF8-8BDC523B58BC}
FW: ZoneAlarm Free Firewall Firewall *Disabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: Avira Desktop *Enabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Lavasoft Ad-Aware *Disabled/Updated* {5BB89C30-6480-BC7C-9F17-199BD76F557A}
SP: Microsoft Security Essentials *Enabled/Updated* {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\currdat.lst.tmp
c:\programdata\Roaming
c:\programdata\sys
c:\programdata\sys\zyyusb.ini
c:\users\User\AppData\Roaming\.#
c:\users\User\AppData\Roaming\.#\MBX@10B8@2312740.###
c:\users\User\AppData\Roaming\.#\MBX@10B8@2312770.###
c:\users\User\AppData\Roaming\.#\MBX@129C@2072740.###
c:\users\User\AppData\Roaming\.#\MBX@129C@2072770.###
c:\windows\Installer\{409DC300-28AF-468F-9624-1F3309701881}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe
.
Infizierte Kopie von c:\windows\SysWow64\wshtcpip.dll wurde gefunden und desinfiziert
Kopie von - c:\windows\winsxs\x86_microsoft-windows-winsock-helper-tcpip_31bf3856ad364e35_6.1.7600.16385_none_cb895be592db1acb\WSHTCPIP.DLL wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-02 bis 2013-08-02 ))))))))))))))))))))))))))))))
.
.
2013-08-01 14:50 . 2013-07-01 23:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{6E3D0023-25DE-4CDE-A10A-B0450F5C12C8}\mpengine.dll
2013-08-01 12:56 . 2013-08-01 12:56 -------- d-----w- C:\FRST
2013-08-01 09:20 . 2013-08-01 09:20 -------- d-----w- c:\users\User\AppData\Roaming\Malwarebytes
2013-08-01 09:20 . 2013-08-01 09:20 -------- d-----w- c:\programdata\Malwarebytes
2013-08-01 09:20 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-01 09:20 . 2013-08-01 09:20 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-07-31 14:17 . 2013-07-31 14:17 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-07-31 13:49 . 2013-07-01 23:34 9460976 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-07-29 19:25 . 2013-07-29 19:25 -------- d-----w- c:\program files (x86)\X-Setup Pro
2013-07-29 19:25 . 2013-07-29 19:25 -------- d-----w- c:\users\User\AppData\Roaming\X-Setup Pro
2013-07-29 19:25 . 2013-07-29 19:25 -------- d-----w- c:\programdata\X-Setup Pro
2013-07-29 19:17 . 2013-07-29 19:17 -------- d-----w- c:\program files (x86)\7-Zip
2013-07-29 18:44 . 2013-07-29 18:44 -------- d-----w- c:\users\User\AppData\Local\mquadr.at
2013-07-29 18:44 . 2013-07-29 18:44 -------- d-----w- c:\programdata\mquadr.at
2013-07-29 18:44 . 2013-05-21 15:20 249824 ------w- c:\windows\SysWow64\SSDPDiscovery.dll
2013-07-29 18:44 . 2013-05-02 13:36 3490112 ------w- c:\windows\SysWow64\m2network64helper.exe
2013-07-29 18:44 . 2013-05-02 07:09 3748672 ------w- c:\windows\SysWow64\M2ElevatedCalls.dll
2013-07-29 18:44 . 2013-05-02 07:08 962368 ------w- c:\windows\SysWow64\M2ElevatedNetworkAdapters.dll
2013-07-29 18:44 . 2012-12-03 13:58 279040 ------w- c:\windows\system32\WiFiMan.dll
2013-07-29 18:44 . 2012-12-03 13:57 238592 ------w- c:\windows\SysWow64\WiFiMan.dll
2013-07-29 18:43 . 2013-07-29 19:10 -------- d-----w- c:\users\User\AppData\Local\DTAG
2013-07-29 10:03 . 2013-07-29 10:08 -------- d-----w- c:\windows\system32\MRT
2013-07-29 06:54 . 2013-07-29 06:54 941720 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{19BD3FEF-0E7E-4E83-8BAE-08C9841F71EC}\gapaengine.dll
2013-07-29 06:47 . 2013-07-29 06:47 -------- d-----w- c:\program files (x86)\Microsoft Security Client
2013-07-29 06:47 . 2013-07-29 06:47 -------- d-----w- c:\program files\Microsoft Security Client
2013-07-28 14:13 . 2013-07-30 15:59 -------- d-----w- c:\users\User\AppData\Roaming\LavasoftStatistics
2013-07-28 14:13 . 2013-07-28 14:18 -------- d-----w- c:\programdata\Ad-Aware Antivirus
2013-07-28 14:04 . 2013-07-28 14:04 -------- d-----w- c:\programdata\Lavasoft
2013-07-28 14:04 . 2013-07-31 07:36 -------- d-----w- c:\program files (x86)\Ad-Aware Antivirus
2013-07-28 14:03 . 2013-07-28 14:03 -------- d-----w- c:\programdata\Downloaded Installations
2013-07-28 14:03 . 2013-07-28 14:03 -------- d-----w- c:\users\User\AppData\Local\adawarebp
2013-07-28 14:03 . 2013-07-28 14:03 -------- d-----w- c:\programdata\Ad-Aware Browsing Protection
2013-07-28 14:00 . 2013-07-28 14:00 47496 ----a-w- c:\windows\system32\sbbd.exe
2013-07-28 14:00 . 2013-07-28 14:00 14456 ----a-w- c:\windows\system32\drivers\gfibto.sys
2013-07-28 14:00 . 2013-07-28 19:46 -------- d-----w- c:\users\User\AppData\Roaming\Ad-Aware Antivirus
2013-07-28 13:37 . 2013-07-28 13:37 -------- d-----w- c:\program files (x86)\Common Files\Java
2013-07-28 13:37 . 2013-07-31 14:17 867240 ----a-w- c:\windows\SysWow64\npDeployJava1.dll
2013-07-28 10:35 . 2013-07-28 10:35 -------- d-----w- C:\NVIDIA
2013-07-28 09:56 . 2013-07-28 09:56 -------- d-----w- c:\program files (x86)\Check Point Software Technologies LTD
2013-07-28 09:56 . 2013-07-28 09:56 -------- d-----w- c:\users\User\AppData\Roaming\Check Point Software Technologies LTD
2013-07-26 10:35 . 2013-07-02 08:34 9460976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BF41629E-1C73-45AF-8ECD-CDBB017B044A}\mpengine.dll
2013-07-11 07:26 . 2013-05-27 05:50 1011712 ----a-w- c:\program files\Windows Defender\MpSvc.dll
2013-07-11 07:26 . 2013-05-27 05:50 571904 ----a-w- c:\program files\Windows Defender\MpClient.dll
2013-07-11 07:26 . 2013-05-27 05:50 314880 ----a-w- c:\program files\Windows Defender\MpCommu.dll
2013-07-11 07:26 . 2013-05-27 04:57 4608 ----a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-11 07:26 . 2013-05-27 04:57 54784 ----a-w- c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-11 07:26 . 2013-05-27 04:57 392704 ----a-w- c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-11 07:26 . 2013-05-27 03:15 9216 ----a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-11 07:26 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll
2013-07-11 07:26 . 2013-06-04 04:53 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-07-11 07:26 . 2013-05-06 06:03 1887744 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-11 07:26 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-11 07:24 . 2013-06-05 03:34 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-07-11 07:24 . 2013-04-10 05:48 1732608 ----a-w- c:\program files\Windows Journal\NBDoc.DLL
2013-07-11 07:24 . 2013-04-10 05:46 1393152 ----a-w- c:\program files\Windows Journal\JNTFiltr.dll
2013-07-11 07:24 . 2013-04-10 05:46 1367040 ----a-w- c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 07:24 . 2013-04-10 05:46 1402880 ----a-w- c:\program files\Windows Journal\JNWDRV.dll
2013-07-11 07:24 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 07:24 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-07-11 07:24 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-31 14:17 . 2011-11-07 16:45 789416 ----a-w- c:\windows\SysWow64\deployJava1.dll
2013-06-26 09:41 . 2013-05-02 08:28 83672 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-06-23 22:57 . 2011-11-03 20:34 78277128 ----a-w- c:\windows\system32\MRT.exe
2013-06-18 19:50 . 2013-06-18 19:50 247216 ----a-w- c:\windows\system32\drivers\MpFilter.sys
2013-06-18 19:50 . 2013-06-18 19:50 139616 ----a-w- c:\windows\system32\drivers\NisDrvWFP.sys
2013-06-12 14:14 . 2012-08-01 05:16 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-12 14:14 . 2011-11-07 16:44 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-12 14:13 . 2013-06-12 14:13 9089416 ----a-w- c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-05-13 05:51 . 2013-06-12 14:21 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 14:21 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 14:21 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 14:21 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 14:21 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 14:21 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 14:21 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 14:21 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 14:21 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 14:21 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-05-10 08:52 . 2011-03-29 02:36 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-10 05:49 . 2013-06-12 14:22 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 14:22 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-12 14:22 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-25 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2013-04-25 14:22 1520776 ----a-w- c:\program files (x86)\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files (x86)\Ask.com\GenericAskToolbar.dll" [2013-04-25 1520776]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Ad-Aware Antivirus"="c:\program files (x86)\Ad-Aware Antivirus\AdAwareLauncher --windows-run" [X]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-04-14 113288]
"Dolby Advanced Audio v2"="c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2011-02-03 506712]
"RemoteControl10"="c:\program files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [2011-03-30 87336]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2013-03-27 73832]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-06-26 345144]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2013-04-25 1648264]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2012-04-13 111080]
"Ad-Aware Browsing Protection"="c:\programdata\Ad-Aware Browsing Protection\adawarebp.exe" [2013-05-15 554408]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
.
c:\users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Netzmanager.lnk - c:\program files\Netzmanager\netzmanager.exe /Autostart [2012-7-20 14134784]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
McAfee Security Scan Plus.lnk - c:\program files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe [2012-10-26 271808]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Ad-Aware Service]
@="Ad-Aware Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
R1 gtunngph;gtunngph;c:\windows\system32\drivers\gtunngph.sys;c:\windows\SYSNATIVE\drivers\gtunngph.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\DRIVERS\motfilt.sys;c:\windows\SYSNATIVE\DRIVERS\motfilt.sys [x]
R3 btmaudio;Intel Bluetooth Audio Service;c:\windows\system32\drivers\btmaud.sys;c:\windows\SYSNATIVE\drivers\btmaud.sys [x]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys;c:\windows\SYSNATIVE\DRIVERS\iBtFltCoex.sys [x]
R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
R3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe;c:\program files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe [x]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys;c:\windows\SYSNATIVE\Drivers\motoandroid.sys [x]
R3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\DRIVERS\motccgp.sys;c:\windows\SYSNATIVE\DRIVERS\motccgp.sys [x]
R3 motccgpfl;MotCcgpFlService;c:\windows\system32\DRIVERS\motccgpfl.sys;c:\windows\SYSNATIVE\DRIVERS\motccgpfl.sys [x]
R3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\DRIVERS\Motousbnet.sys;c:\windows\SYSNATIVE\DRIVERS\Motousbnet.sys [x]
R3 motusbdevice;Motorola USB Dev Driver;c:\windows\system32\DRIVERS\motusbdevice.sys;c:\windows\SYSNATIVE\DRIVERS\motusbdevice.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 nmwcdnsucx64;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsucx64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsucx64.sys [x]
R3 nmwcdnsux64;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsux64.sys;c:\windows\SYSNATIVE\drivers\nmwcdnsux64.sys [x]
R3 TelekomNM6;Telekom Netzmanager Packet Filter Driver;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys;c:\program files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 uxddrv;Dynamically loaded UxdDrv;f:\diagnose\WSTGER64\2PART\uxddrv64.sys;f:\diagnose\WSTGER64\2PART\uxddrv64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 gfibto;gfibto;c:\windows\system32\drivers\gfibto.sys;c:\windows\SYSNATIVE\drivers\gfibto.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S2 Ad-Aware Service;Ad-Aware Service;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe;c:\program files (x86)\Ad-Aware Antivirus\AdAwareService.exe [x]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 CyberLink PowerDVD 10 MS Monitor Service;CyberLink PowerDVD 10 MS Monitor Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [x]
S2 CyberLink PowerDVD 10 MS Service;CyberLink PowerDVD 10 MS Service;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe;c:\program files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [x]
S2 DeviceMonitorService;DeviceMonitorService;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe;c:\program files (x86)\Motorola Media Link\Lite\NServiceEntry.exe [x]
S2 GFNEXSrv;GFNEX Service;c:\program files (x86)\PHotkey\GFNEXSrv.exe;c:\program files (x86)\PHotkey\GFNEXSrv.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [x]
S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 MemeoBackgroundService;MemeoBackgroundService;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe;c:\program files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [x]
S2 MotoHelper;MotoHelper Service;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe;c:\program files (x86)\Motorola\MotoHelper\MotoHelperService.exe [x]
S2 Netzmanager Service;Netzmanager Infrastruktur Informationssystem Dienst;c:\program files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe ;c:\program files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [x]
S2 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
S2 PEGAGFN;PEGAGFN;c:\program files (x86)\PHotkey\PEGAGFN.sys;c:\program files (x86)\PHotkey\PEGAGFN.sys [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 SBAMSvc;Ad-Aware;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe;c:\program files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe;c:\program files (x86)\watchmi\TvdService.exe [x]
S2 WV5Communication;WV5Communication;c:\program files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe;c:\program files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe [x]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\drivers\iwdbus.sys;c:\windows\SYSNATIVE\drivers\iwdbus.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\drivers\nusb3hub.sys;c:\windows\SYSNATIVE\drivers\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\drivers\nusb3xhc.sys;c:\windows\SYSNATIVE\drivers\nusb3xhc.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-01 14:14]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-29 17:40]
.
2013-08-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2013-05-29 17:40]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-10-03 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-10-03 416024]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-09-16 1935120]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-05-19 10365952]
"AmIcoSinglun64"="c:\program files (x86)\AmIcoSingLun\AmIcoSinglun64.exe" [2009-09-22 323584]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-07-18 1356240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_D183CA64F05FDD98.dll/cmsidewiki.html
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - ExtSQL: 2013-07-27 17:26; {B40794A0-7477-4335-95C5-8CB9BBC5C4A5}; c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
FF - ExtSQL: 2013-07-28 12:00; ffxtlbr@zonealarm.com; c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\extensions\ffxtlbr@zonealarm.com
FF - ExtSQL: 2013-07-28 12:00; {FFB96CC1-7EB3-449D-B827-DB661701C6BB}; c:\program files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=base2013&Lan={dfltLng}&gu=28ef9549d0ec4abb92e1787fd68e90ec&tu=10GX0009G1B0008&sku=&tstsId=&ver=&&q=
FF - user.js: extensions.zonealarm.id - 948776190000000000004c8093188d2e
FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84}
FF - user.js: extensions.zonealarm.instlDay - 15914
FF - user.js: extensions.zonealarm.vrsn - 1.8.11.11
FF - user.js: extensions.zonealarm.vrsni - 1.8.11.11
FF - user.js: extensions.zonealarm.vrsnTs - 1.8.11.1111:56
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1025
FF - user.js: extensions.zonealarm.smplGrp - none
FF - user.js: extensions.zonealarm.tlbrId - base2013
FF - user.js: extensions.zonealarm.instlRef - ZLN29694585908454-1001
FF - user.js: extensions.zonealarm.dfltLng - de
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.ffxUnstlRst - false
FF - user.js: extensions.zonealarm.admin - false
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm.rvrt - true
FF - user.js: extensions.zonealarm.dfltSrch - true
FF - user.js: extensions.zonealarm.srchPrvdr - Search By ZoneAlarm
FF - user.js: extensions.zonealarm.kw_url - hxxp://search.zonealarm.com/search?src=sp&tbid=base2013&Lan=de&gu=28ef9549d0ec4abb92e1787fd68e90ec&tu=10GX0009G1B0008&sku=&tstsId=&ver=&&q=
FF - user.js: extensions.zonealarm.dnsErr - true
FF - user.js: extensions.zonealarm.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-Search Protection - c:\programdata\Search Protection\SearchProtection.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\watchmi tray.lnk - c:\windows\Installer\{409DC300-28AF-468F-9624-1F3309701881}\SHCT_TRAY_PROGRAMG_A10D8603999C4E9488776EF2533C58C9.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-ISW - (no file)
AddRemove-ALDI SÜD Mah Jong - c:\windows\system32\Uninstall ALDI SÜD Mah Jong.exe
.
.
"ImagePath"="\"c:\program files\CyberLink\Shared files\RichVideo64.exe\"\00Z
[\]^_¯\00\00¯\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~¯\00\00¯\00\00\00\00x\00\00\00\00\00\00\00\00‘’“"
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\PHotkey\ASLDRSrv.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\program files (x86)\PHotkey\PHotkey.exe
c:\program files (x86)\PHotkey\MsgTranAgt.exe
c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
c:\program files (x86)\CyberLink\YouCam\YouCamService.exe
c:\program files (x86)\PHotkey\POSD.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
c:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-08-02 08:09:27 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-08-02 06:09
.
Vor Suchlauf: 11 Verzeichnis(se), 378.681.946.112 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 379.414.667.264 Bytes frei
.
- - End Of File - - DEE58035C38C2AC59CAEB0CFBEFF3D10
D41D8CD98F00B204E9800998ECF8427E LG Mari |
|
02.08.2013, 11:24
| #8 |
| /// the machine /// TB-Ausbilder | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Downloade Dir bitte  Malwarebytes Anti-Malware
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.08.2013, 10:15
| #9 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 03/08/2013 um 10:52:34 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : User - USER-PC
# Bootmodus : Normal
# Ausgeführt unter : C:\Users\User\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\ProgramData\Partner
Ordner Gelöscht : C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKCU\Software\APN
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\AskToolbar
Schlüssel Gelöscht : HKCU\Software\Ask.com
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{3BD44F0E-0596-4008-AEE0-45D47E3A8F0E}
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BundleSweetIMSetup_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetIM_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\SweetPacksUpdateManager_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar
Wert Gelöscht : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
-\\ Mozilla Firefox v22.0 (de)
-\\ Google Chrome v [Version kann nicht ermittelt werden]
*************************
AdwCleaner[S1].txt - [5854 octets] - [03/08/2013 10:52:34]
########## EOF - C:\AdwCleaner[S1].txt - [5914 octets] ##########
Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.03.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16635 User :: USER-PC [Administrator] Schutz: Aktiviert 03.08.2013 11:01:16 mbam-log-2013-08-03 (11-01-16).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 249858 Laufzeit: 10 Minute(n), 47 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by User (administrator) on 03-08-2013 11:12:38
Running from C:\Users\User\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Nero AG) C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\netzmanager.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Lavasoft Limited) C:\PROGRA~2\AD-AWA~1\AdAware.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(LaCrosse Technology) C:\Program Files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
() C:\Program Files (x86)\PHotkey\POSD.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-16] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [x]
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-22] (Alcor Micro Corp.)
HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-07-18] (Microsoft Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2011-04-14] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [111080 2012-04-13] (CyberLink)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [554408 2013-05-15] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] - "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk
ShortcutTarget: Netzmanager.lnk -> C:\Program Files\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {B8A39C7F-0B98-4835-8743-D0056C3B6A15} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=SLS&o=APN10610&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ADI&apn_dtid=^YYYYYY^YY^DE&apn_uid=f9ef5b24-e944-42a0-aa25-9cc0df0cc410&apn_sauid=FFB05AF3-F12B-4AAB-A6A8-231AA69906BC
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Homepage: hxxp://www.google.de
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\zonealarm.xml
FF Extension: zonealarm.com - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\ffxtlbr@zonealarm.com
FF Extension: Ask Toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\toolbar@ask.com
FF Extension: toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\toolbar@gmx.net.xpi
FF Extension: No Name - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
Chrome:
=======
CHR HomePage: "homepage": "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=1F4BEC9BFCC762A037091E51F5249DD0",
CHR RestoreOnStartup: "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=1F4BEC9BFCC762A037091E51F5249DD0"
CHR Extension: (Kaspersky URL Advisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0
CHR Extension: (Virtual Keyboard) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0
CHR Extension: (Anti-Banner) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\adawaretb\chrome-newtab-search.crx
==================== Services (Whitelisted) =================
R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236336 2013-06-13] (Lavasoft Limited)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-14] ()
R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [214896 2011-12-06] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2013-07-18] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-16] ()
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-07-18] (Microsoft Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2011-10-07] ()
R2 WV5Communication; C:\Program Files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe [1843712 2011-01-18] (LaCrosse Technology)
S3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe" [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-10] (Avira Operations GmbH & Co. KG)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-07-28] (GFI Software)
R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
R3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 gtunngph; \??\C:\Windows\system32\drivers\gtunngph.sys [x]
S3 uxddrv; \??\F:\DIAGNOSE\WSTGER64\2PART\uxddrv64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-03 10:52 - 2013-08-03 10:53 - 00005969 _____ C:\AdwCleaner[S1].txt
2013-08-03 10:49 - 2013-08-03 10:50 - 00717160 _____ C:\Users\User\Downloads\ZipOpenerSetup.exe
2013-08-02 08:09 - 2013-08-02 08:09 - 00037465 _____ C:\ComboFix.txt
2013-08-02 07:37 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-02 07:37 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-02 07:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-02 07:35 - 2013-08-02 08:09 - 00000000 ____D C:\Qoobox
2013-08-02 07:35 - 2013-08-02 08:06 - 00000000 ____D C:\Windows\erdnt
2013-08-01 14:56 - 2013-08-01 14:56 - 00000000 ____D C:\FRST
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 11:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-31 16:17 - 2013-07-31 16:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-31 16:15 - 2013-07-31 16:16 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586(1).exe
2013-07-31 10:36 - 2013-07-29 08:35 - 00001872 _____ C:\Users\User\Desktop\Ad-Aware Antivirus.lnk
2013-07-30 18:32 - 2013-07-30 18:32 - 00000000 ____D C:\Users\User\AppData\Local\{B0DD8DAC-0FDE-487C-BC85-3A1EB96ED03A}
2013-07-29 21:30 - 2013-07-29 21:30 - 00003184 _____ C:\Windows\System32\Tasks\{EB41B063-30F3-47D5-99AC-502F191AB7E8}
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\ProgramData\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Program Files (x86)\X-Setup Pro
2013-07-29 21:17 - 2013-07-29 21:17 - 01110476 _____ C:\Users\User\Downloads\7z920.exe
2013-07-29 21:17 - 2013-07-29 21:17 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-07-29 21:14 - 2013-07-29 21:14 - 06662897 _____ C:\Users\User\Downloads\xsetup92.zip
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\Users\User\AppData\Local\mquadr.at
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\ProgramData\mquadr.at
2013-07-29 20:44 - 2013-05-21 17:20 - 00249824 ____N (mquadr.at software engineering & consulting GmbH, web: www.mquadr.at, mail: office@mquadr.at) C:\Windows\SysWOW64\SSDPDiscovery.dll
2013-07-29 20:44 - 2013-05-02 15:36 - 03490112 ____N (mquadr.at software engineering & consulting GmbH) C:\Windows\SysWOW64\m2network64helper.exe
2013-07-29 20:44 - 2013-05-02 09:09 - 03748672 ____N (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll
2013-07-29 20:44 - 2013-05-02 09:08 - 00962368 ____N (mquadr.at software engineering) C:\Windows\SysWOW64\M2ElevatedNetworkAdapters.dll
2013-07-29 20:44 - 2012-12-03 15:58 - 00279040 ____N (Nicomsoft Ltd.) C:\Windows\system32\WiFiMan.dll
2013-07-29 20:44 - 2012-12-03 15:57 - 00238592 ____N (Nicomsoft Ltd.) C:\Windows\SysWOW64\WiFiMan.dll
2013-07-29 20:43 - 2013-07-29 21:10 - 00000000 ____D C:\Users\User\AppData\Local\DTAG
2013-07-29 12:03 - 2013-07-29 12:08 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 08:47 - 2013-07-29 08:47 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-29 08:45 - 2013-07-29 08:46 - 13813944 _____ (Microsoft Corporation) C:\Users\User\Downloads\mseinstall.exe
2013-07-28 16:13 - 2013-07-30 17:59 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics
2013-07-28 16:13 - 2013-07-28 16:18 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus
2013-07-28 16:13 - 2013-07-28 16:13 - 00004454 _____ C:\Windows\System32\Tasks\Ad-Aware Antivirus Scheduled Scan
2013-07-28 16:04 - 2013-08-03 10:55 - 00001872 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-07-28 16:04 - 2013-07-31 09:36 - 00000000 ____D C:\Program Files (x86)\Ad-Aware Antivirus
2013-07-28 16:04 - 2013-07-28 16:04 - 00000000 ____D C:\ProgramData\Lavasoft
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\Users\User\AppData\Local\adawarebp
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-07-28 16:00 - 2013-07-28 21:46 - 00000000 ____D C:\Users\User\AppData\Roaming\Ad-Aware Antivirus
2013-07-28 16:00 - 2013-07-28 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00047496 _____ (GFI Software) C:\Windows\system32\sbbd.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00014456 _____ (GFI Software) C:\Windows\system32\Drivers\gfibto.sys
2013-07-28 15:59 - 2013-07-28 15:59 - 05616264 _____ (Lavasoft Limited) C:\Users\User\Downloads\Adaware53_Installer.exe
2013-07-28 15:37 - 2013-07-31 16:17 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-28 15:32 - 2013-07-28 15:35 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586.exe
2013-07-28 12:35 - 2013-07-28 12:35 - 00000000 ____D C:\NVIDIA
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Users\User\AppData\Roaming\Check Point Software Technologies LTD
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Program Files (x86)\Check Point Software Technologies LTD
2013-07-28 11:54 - 2013-07-28 11:54 - 02402224 _____ (Check Point Software Technologies LTD) C:\Users\User\Downloads\zafwSetupWeb_110_000_504.exe
2013-07-28 11:11 - 2013-07-28 11:11 - 00000000 ____D C:\Users\User\AppData\Local\{5433EC7B-B809-4591-A684-EDA60B38E28E}
2013-07-25 21:31 - 2013-07-25 21:31 - 00027230 _____ C:\Users\User\Desktop\Speedport_W_504V1.17.000_05.11.12_1225_25-07-2013.bin
2013-07-25 11:54 - 2013-07-25 11:54 - 00000000 ____D C:\Users\User\AppData\Local\{F3BBF71B-31A8-4152-B989-19A8891C4EF0}
2013-07-24 12:58 - 2013-07-24 12:58 - 00000000 ____D C:\Users\User\AppData\Local\{46B3821B-8767-4AC5-AFED-2655F06230FB}
2013-07-23 06:37 - 2013-07-23 06:37 - 00000000 ____D C:\Users\User\AppData\Local\{BFCE7EFE-0011-4377-A756-2EADBE8B844D}
2013-07-22 17:00 - 2013-07-22 17:00 - 00000000 ____D C:\Users\User\AppData\Local\{99F423E8-8B87-4B7F-9DBA-6D614EBC50CE}
2013-07-21 15:55 - 2013-07-21 15:55 - 00000000 ____D C:\Users\User\AppData\Local\{476C41D7-B8F8-48EB-91E4-553A78FFD0B4}
2013-07-20 13:59 - 2013-07-20 13:59 - 00000000 ____D C:\Users\User\AppData\Local\{89064572-2890-4C04-9E35-B7BDBEABCC33}
2013-07-19 09:24 - 2013-07-19 09:24 - 00000000 ____D C:\Users\User\AppData\Local\{8EFB7135-45AB-47D9-A6EF-4EBDA95459B1}
2013-07-18 09:29 - 2013-07-18 09:29 - 00000000 ____D C:\Users\User\AppData\Local\{CA92EE73-3901-47E3-9A09-CE80425E155C}
2013-07-16 21:58 - 2013-07-16 21:59 - 00000000 ____D C:\Users\User\AppData\Local\{D8ADA368-3894-49F3-93BC-4547C2C1AF2B}
2013-07-15 12:24 - 2013-07-15 12:24 - 00000000 ____D C:\Users\User\AppData\Local\{1A590330-1673-4B67-BAEB-9B106265FE6D}
2013-07-14 13:24 - 2013-07-14 13:25 - 00000000 ____D C:\Users\User\AppData\Local\{1FDBC2E6-58CF-4DD9-91BD-934540A6551D}
2013-07-12 20:42 - 2013-07-12 20:42 - 00007579 _____ C:\Windows\SysWOW64\SystemData.xml
2013-07-12 08:48 - 2013-07-12 08:48 - 00000000 ____D C:\Users\User\AppData\Local\{7408DA49-7916-4234-9C3B-E505C1BB3977}
2013-07-11 16:09 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 16:09 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 16:09 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 16:09 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 16:09 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 16:09 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 16:09 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 16:09 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 16:09 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 09:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 09:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 09:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 09:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 09:24 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 09:24 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 09:24 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-11 09:02 - 2013-07-11 09:02 - 00000000 ____D C:\Users\User\AppData\Local\{48C426DD-98B6-46DF-8FFE-D2697AAA8427}
2013-07-10 16:35 - 2013-07-10 16:35 - 00000000 ____D C:\Users\User\AppData\Local\{B2C53CFA-EE22-49CC-84CC-253994D29C34}
2013-07-09 15:50 - 2013-07-09 15:50 - 00000000 ____D C:\Users\User\AppData\Local\{73ECE2EF-C73B-4DB4-80EE-3BD6AB66B63C}
2013-07-08 13:01 - 2013-07-08 13:01 - 00000000 ____D C:\Users\User\AppData\Local\{E8854379-5E30-48B6-AE7F-BF2E214D07DE}
2013-07-05 09:34 - 2013-07-05 09:34 - 00000000 ____D C:\Users\User\AppData\Local\{4259B2F4-C3D2-4B02-958E-76D8D7106D22}
135
==================== One Month Modified Files and Folders =======
2013-08-03 11:03 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-03 11:03 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-03 11:02 - 2013-08-03 11:02 - 01781485 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2013-08-03 10:59 - 2012-06-21 12:51 - 01159519 _____ C:\Windows\WindowsUpdate.log
2013-08-03 10:57 - 2012-06-21 13:01 - 00000000 ____D C:\Users\User\Documents\Youcam
2013-08-03 10:55 - 2013-07-28 16:04 - 00001872 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-08-03 10:55 - 2013-05-29 19:40 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-03 10:55 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-03 10:54 - 2009-07-14 06:51 - 00130685 _____ C:\Windows\setupact.log
2013-08-03 10:53 - 2013-08-03 10:52 - 00005969 _____ C:\AdwCleaner[S1].txt
2013-08-03 10:50 - 2013-08-03 10:49 - 00717160 _____ C:\Users\User\Downloads\ZipOpenerSetup.exe
2013-08-03 10:40 - 2013-05-29 19:40 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-02 08:09 - 2013-08-02 08:09 - 00037465 _____ C:\ComboFix.txt
2013-08-02 08:09 - 2013-08-02 07:35 - 00000000 ____D C:\Qoobox
2013-08-02 08:09 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-02 08:06 - 2013-08-02 07:35 - 00000000 ____D C:\Windows\erdnt
2013-08-02 08:01 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-02 07:58 - 2010-11-21 05:47 - 00095628 _____ C:\Windows\PFRO.log
2013-08-02 07:29 - 2011-11-04 03:51 - 00654844 _____ C:\Windows\system32\perfh007.dat
2013-08-02 07:29 - 2011-11-04 03:51 - 00130426 _____ C:\Windows\system32\perfc007.dat
2013-08-02 07:29 - 2009-07-14 07:13 - 01500254 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-01 14:56 - 2013-08-01 14:56 - 00000000 ____D C:\FRST
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-31 16:17 - 2013-07-31 16:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-31 16:17 - 2013-07-28 15:37 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-31 16:17 - 2011-11-07 18:45 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-31 16:17 - 2011-11-07 18:45 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-31 16:16 - 2013-07-31 16:15 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586(1).exe
2013-07-31 16:08 - 2012-10-12 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-31 09:36 - 2013-07-28 16:04 - 00000000 ____D C:\Program Files (x86)\Ad-Aware Antivirus
2013-07-30 18:32 - 2013-07-30 18:32 - 00000000 ____D C:\Users\User\AppData\Local\{B0DD8DAC-0FDE-487C-BC85-3A1EB96ED03A}
2013-07-30 17:59 - 2013-07-28 16:13 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics
2013-07-29 21:30 - 2013-07-29 21:30 - 00003184 _____ C:\Windows\System32\Tasks\{EB41B063-30F3-47D5-99AC-502F191AB7E8}
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\ProgramData\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Program Files (x86)\X-Setup Pro
2013-07-29 21:17 - 2013-07-29 21:17 - 01110476 _____ C:\Users\User\Downloads\7z920.exe
2013-07-29 21:17 - 2013-07-29 21:17 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-07-29 21:15 - 2013-05-22 15:01 - 00000000 ____D C:\Users\User\AppData\Local\WinZip
2013-07-29 21:14 - 2013-07-29 21:14 - 06662897 _____ C:\Users\User\Downloads\xsetup92.zip
2013-07-29 21:10 - 2013-07-29 20:43 - 00000000 ____D C:\Users\User\AppData\Local\DTAG
2013-07-29 21:00 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\Users\User\AppData\Local\mquadr.at
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\ProgramData\mquadr.at
2013-07-29 12:08 - 2013-07-29 12:03 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 08:47 - 2013-07-29 08:47 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-29 08:46 - 2013-07-29 08:45 - 13813944 _____ (Microsoft Corporation) C:\Users\User\Downloads\mseinstall.exe
2013-07-29 08:35 - 2013-07-31 10:36 - 00001872 _____ C:\Users\User\Desktop\Ad-Aware Antivirus.lnk
2013-07-29 08:34 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-28 21:46 - 2013-07-28 16:00 - 00000000 ____D C:\Users\User\AppData\Roaming\Ad-Aware Antivirus
2013-07-28 21:24 - 2012-12-04 15:19 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-07-28 16:18 - 2013-07-28 16:13 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus
2013-07-28 16:13 - 2013-07-28 16:13 - 00004454 _____ C:\Windows\System32\Tasks\Ad-Aware Antivirus Scheduled Scan
2013-07-28 16:04 - 2013-07-28 16:04 - 00000000 ____D C:\ProgramData\Lavasoft
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\Users\User\AppData\Local\adawarebp
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-07-28 16:03 - 2013-07-03 09:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-28 16:01 - 2013-07-28 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00047496 _____ (GFI Software) C:\Windows\system32\sbbd.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00014456 _____ (GFI Software) C:\Windows\system32\Drivers\gfibto.sys
2013-07-28 15:59 - 2013-07-28 15:59 - 05616264 _____ (Lavasoft Limited) C:\Users\User\Downloads\Adaware53_Installer.exe
2013-07-28 15:35 - 2013-07-28 15:32 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586.exe
2013-07-28 12:35 - 2013-07-28 12:35 - 00000000 ____D C:\NVIDIA
2013-07-28 12:03 - 2012-11-17 22:03 - 00417563 _____ C:\Windows\system32\Drivers\vsconfig.xml
2013-07-28 11:59 - 2012-11-17 22:03 - 00000762 _____ C:\Users\Public\Desktop\ZoneAlarm Security.lnk
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Users\User\AppData\Roaming\Check Point Software Technologies LTD
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Program Files (x86)\Check Point Software Technologies LTD
2013-07-28 11:54 - 2013-07-28 11:54 - 02402224 _____ (Check Point Software Technologies LTD) C:\Users\User\Downloads\zafwSetupWeb_110_000_504.exe
2013-07-28 11:11 - 2013-07-28 11:11 - 00000000 ____D C:\Users\User\AppData\Local\{5433EC7B-B809-4591-A684-EDA60B38E28E}
2013-07-26 12:34 - 2012-07-18 07:34 - 00000000 ____D C:\Users\User\Citrix
2013-07-25 21:31 - 2013-07-25 21:31 - 00027230 _____ C:\Users\User\Desktop\Speedport_W_504V1.17.000_05.11.12_1225_25-07-2013.bin
2013-07-25 11:54 - 2013-07-25 11:54 - 00000000 ____D C:\Users\User\AppData\Local\{F3BBF71B-31A8-4152-B989-19A8891C4EF0}
2013-07-24 12:58 - 2013-07-24 12:58 - 00000000 ____D C:\Users\User\AppData\Local\{46B3821B-8767-4AC5-AFED-2655F06230FB}
2013-07-23 06:37 - 2013-07-23 06:37 - 00000000 ____D C:\Users\User\AppData\Local\{BFCE7EFE-0011-4377-A756-2EADBE8B844D}
2013-07-22 17:00 - 2013-07-22 17:00 - 00000000 ____D C:\Users\User\AppData\Local\{99F423E8-8B87-4B7F-9DBA-6D614EBC50CE}
2013-07-21 15:55 - 2013-07-21 15:55 - 00000000 ____D C:\Users\User\AppData\Local\{476C41D7-B8F8-48EB-91E4-553A78FFD0B4}
2013-07-20 13:59 - 2013-07-20 13:59 - 00000000 ____D C:\Users\User\AppData\Local\{89064572-2890-4C04-9E35-B7BDBEABCC33}
2013-07-19 21:03 - 2013-06-15 15:28 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2013-07-19 09:24 - 2013-07-19 09:24 - 00000000 ____D C:\Users\User\AppData\Local\{8EFB7135-45AB-47D9-A6EF-4EBDA95459B1}
2013-07-18 09:29 - 2013-07-18 09:29 - 00000000 ____D C:\Users\User\AppData\Local\{CA92EE73-3901-47E3-9A09-CE80425E155C}
2013-07-16 21:59 - 2013-07-16 21:58 - 00000000 ____D C:\Users\User\AppData\Local\{D8ADA368-3894-49F3-93BC-4547C2C1AF2B}
2013-07-16 21:18 - 2013-05-29 19:40 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 21:18 - 2013-05-29 19:40 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-15 12:24 - 2013-07-15 12:24 - 00000000 ____D C:\Users\User\AppData\Local\{1A590330-1673-4B67-BAEB-9B106265FE6D}
2013-07-14 13:25 - 2013-07-14 13:24 - 00000000 ____D C:\Users\User\AppData\Local\{1FDBC2E6-58CF-4DD9-91BD-934540A6551D}
2013-07-12 20:42 - 2013-07-12 20:42 - 00007579 _____ C:\Windows\SysWOW64\SystemData.xml
2013-07-12 08:48 - 2013-07-12 08:48 - 00000000 ____D C:\Users\User\AppData\Local\{7408DA49-7916-4234-9C3B-E505C1BB3977}
2013-07-12 08:23 - 2009-07-14 06:45 - 00368344 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 08:22 - 2013-03-14 14:53 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 08:22 - 2013-03-14 14:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 08:22 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 08:22 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 08:22 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 09:02 - 2013-07-11 09:02 - 00000000 ____D C:\Users\User\AppData\Local\{48C426DD-98B6-46DF-8FFE-D2697AAA8427}
2013-07-10 16:35 - 2013-07-10 16:35 - 00000000 ____D C:\Users\User\AppData\Local\{B2C53CFA-EE22-49CC-84CC-253994D29C34}
2013-07-09 15:50 - 2013-07-09 15:50 - 00000000 ____D C:\Users\User\AppData\Local\{73ECE2EF-C73B-4DB4-80EE-3BD6AB66B63C}
2013-07-08 13:01 - 2013-07-08 13:01 - 00000000 ____D C:\Users\User\AppData\Local\{E8854379-5E30-48B6-AE7F-BF2E214D07DE}
2013-07-05 11:41 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-07-05 09:34 - 2013-07-05 09:34 - 00000000 ____D C:\Users\User\AppData\Local\{4259B2F4-C3D2-4B02-958E-76D8D7106D22}
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-21 14:08
==================== End Of Log ============================
LG Mari |
|
04.08.2013, 09:13
| #10 |
| /// the machine /// TB-Ausbilder | Facebook-Link angeklickt "Just 14 years Old drunk girl .."ESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
05.08.2013, 07:03
| #11 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Hi Schrauber, müßte ich das smartphone, was via wlan ins netzwerk geht auch scannen? LG Mari |
|
05.08.2013, 08:21
| #12 |
| /// the machine /// TB-Ausbilder | Facebook-Link angeklickt "Just 14 years Old drunk girl .." nee
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.08.2013, 07:03
| #13 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=2e8cf44e0a28bf48a876809b014882b3 # engine=14653 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-08-05 04:25:27 # local_time=2013-08-05 06:25:27 (+0100, Mitteleuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=6.1.7601 NT Service Pack 1 # compatibility_mode=1799 16775165 100 96 37237 146391232 30001 0 # compatibility_mode=5893 16776574 100 94 699123 127349777 0 0 # compatibility_mode=9217 16777214 75 4 714325 714325 0 0 # scanned=176083 # found=0 # cleaned=0 # scan_time=36627 Results of screen317's Security Check version 0.99.71 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Security Center service is not running! This report may not be accurate! Microsoft Security Essentials Lavasoft Ad-Aware Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Ad-Aware Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 6 Update 29 Java 7 Update 25 Adobe Flash Player 11.7.700.224 Adobe Reader 10.1.7 Adobe Reader out of Date! Mozilla Firefox (22.0) ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Ad-Aware AAWService.exe is disabled! Ad-Aware AAWTray.exe is disabled! Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Ad-Aware Antivirus AdAwareService.exe Ad-Aware Antivirus SBAMSvc.exe Malwarebytes' Anti-Malware mbamscheduler.exe CheckPoint ZoneAlarm vsmon.exe CheckPoint ZoneAlarm zatray.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-08-2013
Ran by User (administrator) on 06-08-2013 07:59:10
Running from C:\Users\User\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
() C:\Program Files (x86)\PHotkey\ASLDRSrv.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
() C:\Program Files (x86)\PHotkey\GFNEXSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Check Point Software Technologies) C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
(Lavasoft Limited) C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
() C:\Program Files (x86)\PHotkey\PHotkey.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
() C:\Program Files (x86)\PHotkey\MsgTranAgt64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Alcor Micro Corp.) C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe
(Intel(R) Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Conexant Systems Inc.) C:\Windows\system32\CxAudMsg64.exe
(Check Point Software Technologies LTD) C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\netzmanager.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe
(Lavasoft Limited) C:\PROGRA~2\AD-AWA~1\AdAware.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe
(Nero AG) C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe
(Deutsche Telekom AG) C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
(Protexis Inc.) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
() C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
() C:\Program Files (x86)\watchmi\TvdService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(LaCrosse Technology) C:\Program Files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(TODO: <Company name>) C:\Program Files (x86)\PHotkey\HCSynApi.exe
() C:\Program Files (x86)\PHotkey\PVDesktop.exe
() C:\Program Files (x86)\PHotkey\PVDAgent.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
() C:\Program Files (x86)\PHotkey\POSD.exe
(GFI Software) C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [SmartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2832168 2011-09-30] (Synaptics Incorporated)
HKLM\...\Run: [IntelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-16] (Intel(R) Corporation)
HKLM\...\Run: [BTMTrayAgent] - C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll [10365952 2011-05-19] (Intel Corporation)
HKLM\...\Run: [AmIcoSinglun64] - C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-22] (Alcor Micro Corp.)
HKLM\...\Run: [ISW] - C:\Program Files\CheckPoint\ZAForceField\ForceField.exe [1127592 2012-11-22] (Check Point Software Technologies)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-07-18] (Microsoft Corporation)
HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2011-04-14] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [506712 2011-02-03] (Dolby Laboratories Inc.)
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-31] (CyberLink Corp.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ZoneAlarm] - C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe [73832 2013-03-27] (Check Point Software Technologies LTD)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-26] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [CLMLServer] - C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe [111080 2012-04-13] (CyberLink)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] - C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [554408 2013-05-15] (Lavasoft)
HKLM-x32\...\Run: [Ad-Aware Antivirus] - "C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher" --windows-run [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKU\Default\...\RunOnce: [Screensaver] - C:\Windows\Web\Wallpaper\MEDION\start.vbs [129 2009-10-23] ()
AppInit_DLLs: C:\Windows\System32\nvinitx.dll [241984 2011-10-16] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\Windows\SysWOW64\nvinit.dll [203072 2011-10-16] (NVIDIA Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.313\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk
ShortcutTarget: Netzmanager.lnk -> C:\Program Files\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {B8A39C7F-0B98-4835-8743-D0056C3B6A15} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=SLS&o=APN10610&src=kw&q={searchTerms}&locale=&apn_ptnrs=^ADI&apn_dtid=^YYYYYY^YY^DE&apn_uid=f9ef5b24-e944-42a0-aa25-9cc0df0cc410&apn_sauid=FFB05AF3-F12B-4AAB-A6A8-231AA69906BC
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKLM-x32 - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Toolbar: HKCU - ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll (Check Point Software Technologies)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1
FireFox:
========
FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default
FF user.js: detected! => C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\user.js
FF NewTab: chrome://unitedtb/content/newtab/newtab-page.xhtml
FF Homepage: hxxp://www.google.de
FF Keyword.URL: hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/DTPlugin,version=10.13.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.313\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\askcom.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\searchplugins\zonealarm.xml
FF Extension: zonealarm.com - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\ffxtlbr@zonealarm.com
FF Extension: Ask Toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\toolbar@ask.com
FF Extension: toolbar - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\toolbar@gmx.net.xpi
FF Extension: No Name - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\hes70y39.default\Extensions\{B40794A0-7477-4335-95C5-8CB9BBC5C4A5}.xpi
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF Extension: No Name - C:\Program Files\CheckPoint\ZAForceField\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF Extension: ZoneAlarm Security Engine - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
Chrome:
=======
CHR HomePage: "homepage": "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=1F4BEC9BFCC762A037091E51F5249DD0",
CHR RestoreOnStartup: "hxxp://securedsearch2.lavasoft.com/index.php?pr=vmn&id=adawaretb&v=3_1&ent=hp&u=1F4BEC9BFCC762A037091E51F5249DD0"
CHR Extension: (Kaspersky URL Advisor) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\12.0.0.397_0
CHR Extension: (Virtual Keyboard) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\12.0.0.374_0
CHR Extension: (Anti-Banner) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\12.0.0.374_0
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\adawaretb\chrome-newtab-search.crx
==================== Services (Whitelisted) =================
R2 Ad-Aware Service; C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe [1236336 2013-06-13] (Lavasoft Limited)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-26] (Avira Operations GmbH & Co. KG)
R2 ASLDRService; C:\Program Files (x86)\PHotkey\ASLDRSrv.exe [104968 2009-12-19] ()
R2 CxAudMsg; C:\Windows\system32\CxAudMsg64.exe [198784 2010-12-17] (Conexant Systems Inc.)
R2 CyberLink PowerDVD 10 MS Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSMonitorService.exe [70952 2011-04-14] (CyberLink)
R2 CyberLink PowerDVD 10 MS Service; C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe [312616 2011-04-14] (CyberLink)
R2 GFNEXSrv; C:\Program Files (x86)\PHotkey\GFNEXSrv.exe [156672 2011-10-14] ()
R2 IswSvc; C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe [828072 2012-11-22] (Check Point Software Technologies)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 MotoHelper; C:\Program Files (x86)\Motorola\MotoHelper\MotoHelperService.exe [214896 2011-12-06] ()
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23816 2013-07-18] (Microsoft Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-16] ()
R2 Netzmanager Service; C:\Program Files\Netzmanager\NMInfraIS2\Netzmanager_Service.exe [2635776 2012-07-20] (Deutsche Telekom AG)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-07-18] (Microsoft Corporation)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 SBAMSvc; C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe [3677000 2012-09-20] (GFI Software)
R2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe [2447888 2013-03-27] (Check Point Software Technologies LTD)
R2 watchmi; C:\Program Files (x86)\watchmi\TvdService.exe [70144 2011-10-07] ()
R2 WV5Communication; C:\Program Files (x86)\HeavyWeatherWV5\HeavyWeatherService.exe [1843712 2011-01-18] (LaCrosse Technology)
S3 McComponentHostService; "C:\Program Files (x86)\McAfee Security Scan\3.0.285\McCHSvc.exe" [x]
==================== Drivers (Whitelisted) ====================
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-04-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-04-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-04-10] (Avira Operations GmbH & Co. KG)
R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-07-28] (GFI Software)
R2 ISWKL; C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33712 2012-11-22] (Check Point Software Technologies)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation)
R2 PEGAGFN; C:\Program Files (x86)\PHotkey\PEGAGFN.sys [14344 2009-09-12] (PEGATRON)
R3 TelekomNM6; C:\Program Files\Netzmanager\NMInfraIS2\Driver\TelekomNM6.sys [45664 2010-09-16] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH)
R1 Vsdatant; C:\Windows\System32\DRIVERS\vsdatant.sys [450136 2012-12-13] (Check Point Software Technologies LTD)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S1 gtunngph; \??\C:\Windows\system32\drivers\gtunngph.sys [x]
S3 uxddrv; \??\F:\DIAGNOSE\WSTGER64\2PART\uxddrv64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-06 07:27 - 2013-08-06 07:27 - 01788685 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2013-08-06 07:17 - 2013-08-06 07:17 - 00891098 _____ C:\Users\User\Desktop\SecurityCheck.exe
2013-08-05 08:12 - 2013-08-05 08:12 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-03 10:52 - 2013-08-03 10:53 - 00005969 _____ C:\AdwCleaner[S1].txt
2013-08-03 10:49 - 2013-08-03 10:50 - 00717160 _____ C:\Users\User\Downloads\ZipOpenerSetup.exe
2013-08-02 08:09 - 2013-08-02 08:09 - 00037465 _____ C:\ComboFix.txt
2013-08-02 07:37 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-02 07:37 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-02 07:37 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-02 07:37 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-02 07:35 - 2013-08-02 08:09 - 00000000 ____D C:\Qoobox
2013-08-02 07:35 - 2013-08-02 08:06 - 00000000 ____D C:\Windows\erdnt
2013-08-01 14:56 - 2013-08-01 14:56 - 00000000 ____D C:\FRST
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-01 11:20 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-07-31 16:17 - 2013-07-31 16:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-31 16:15 - 2013-07-31 16:16 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586(1).exe
2013-07-31 10:36 - 2013-07-29 08:35 - 00001872 _____ C:\Users\User\Desktop\Ad-Aware Antivirus.lnk
2013-07-30 18:32 - 2013-07-30 18:32 - 00000000 ____D C:\Users\User\AppData\Local\{B0DD8DAC-0FDE-487C-BC85-3A1EB96ED03A}
2013-07-29 21:30 - 2013-07-29 21:30 - 00003184 _____ C:\Windows\System32\Tasks\{EB41B063-30F3-47D5-99AC-502F191AB7E8}
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\ProgramData\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Program Files (x86)\X-Setup Pro
2013-07-29 21:17 - 2013-07-29 21:17 - 01110476 _____ C:\Users\User\Downloads\7z920.exe
2013-07-29 21:17 - 2013-07-29 21:17 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-07-29 21:14 - 2013-07-29 21:14 - 06662897 _____ C:\Users\User\Downloads\xsetup92.zip
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\Users\User\AppData\Local\mquadr.at
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\ProgramData\mquadr.at
2013-07-29 20:44 - 2013-05-21 17:20 - 00249824 ____N (mquadr.at software engineering & consulting GmbH, web: www.mquadr.at, mail: office@mquadr.at) C:\Windows\SysWOW64\SSDPDiscovery.dll
2013-07-29 20:44 - 2013-05-02 15:36 - 03490112 ____N (mquadr.at software engineering & consulting GmbH) C:\Windows\SysWOW64\m2network64helper.exe
2013-07-29 20:44 - 2013-05-02 09:09 - 03748672 ____N (mquadr.at software engineering und consulting GmbH) C:\Windows\SysWOW64\M2ElevatedCalls.dll
2013-07-29 20:44 - 2013-05-02 09:08 - 00962368 ____N (mquadr.at software engineering) C:\Windows\SysWOW64\M2ElevatedNetworkAdapters.dll
2013-07-29 20:44 - 2012-12-03 15:58 - 00279040 ____N (Nicomsoft Ltd.) C:\Windows\system32\WiFiMan.dll
2013-07-29 20:44 - 2012-12-03 15:57 - 00238592 ____N (Nicomsoft Ltd.) C:\Windows\SysWOW64\WiFiMan.dll
2013-07-29 20:43 - 2013-07-29 21:10 - 00000000 ____D C:\Users\User\AppData\Local\DTAG
2013-07-29 12:03 - 2013-07-29 12:08 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 08:47 - 2013-07-29 08:47 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-29 08:45 - 2013-07-29 08:46 - 13813944 _____ (Microsoft Corporation) C:\Users\User\Downloads\mseinstall.exe
2013-07-28 16:13 - 2013-07-30 17:59 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics
2013-07-28 16:13 - 2013-07-28 16:18 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus
2013-07-28 16:13 - 2013-07-28 16:13 - 00004454 _____ C:\Windows\System32\Tasks\Ad-Aware Antivirus Scheduled Scan
2013-07-28 16:04 - 2013-08-06 07:33 - 00001872 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-07-28 16:04 - 2013-07-31 09:36 - 00000000 ____D C:\Program Files (x86)\Ad-Aware Antivirus
2013-07-28 16:04 - 2013-07-28 16:04 - 00000000 ____D C:\ProgramData\Lavasoft
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\Users\User\AppData\Local\adawarebp
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-07-28 16:00 - 2013-07-28 21:46 - 00000000 ____D C:\Users\User\AppData\Roaming\Ad-Aware Antivirus
2013-07-28 16:00 - 2013-07-28 16:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00047496 _____ (GFI Software) C:\Windows\system32\sbbd.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00014456 _____ (GFI Software) C:\Windows\system32\Drivers\gfibto.sys
2013-07-28 15:59 - 2013-07-28 15:59 - 05616264 _____ (Lavasoft Limited) C:\Users\User\Downloads\Adaware53_Installer.exe
2013-07-28 15:37 - 2013-07-31 16:17 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-28 15:32 - 2013-07-28 15:35 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586.exe
2013-07-28 12:35 - 2013-07-28 12:35 - 00000000 ____D C:\NVIDIA
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Users\User\AppData\Roaming\Check Point Software Technologies LTD
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Program Files (x86)\Check Point Software Technologies LTD
2013-07-28 11:54 - 2013-07-28 11:54 - 02402224 _____ (Check Point Software Technologies LTD) C:\Users\User\Downloads\zafwSetupWeb_110_000_504.exe
2013-07-28 11:11 - 2013-07-28 11:11 - 00000000 ____D C:\Users\User\AppData\Local\{5433EC7B-B809-4591-A684-EDA60B38E28E}
2013-07-25 21:31 - 2013-07-25 21:31 - 00027230 _____ C:\Users\User\Desktop\Speedport_W_504V1.17.000_05.11.12_1225_25-07-2013.bin
2013-07-25 11:54 - 2013-07-25 11:54 - 00000000 ____D C:\Users\User\AppData\Local\{F3BBF71B-31A8-4152-B989-19A8891C4EF0}
2013-07-24 12:58 - 2013-07-24 12:58 - 00000000 ____D C:\Users\User\AppData\Local\{46B3821B-8767-4AC5-AFED-2655F06230FB}
2013-07-23 06:37 - 2013-07-23 06:37 - 00000000 ____D C:\Users\User\AppData\Local\{BFCE7EFE-0011-4377-A756-2EADBE8B844D}
2013-07-22 17:00 - 2013-07-22 17:00 - 00000000 ____D C:\Users\User\AppData\Local\{99F423E8-8B87-4B7F-9DBA-6D614EBC50CE}
2013-07-21 15:55 - 2013-07-21 15:55 - 00000000 ____D C:\Users\User\AppData\Local\{476C41D7-B8F8-48EB-91E4-553A78FFD0B4}
2013-07-20 13:59 - 2013-07-20 13:59 - 00000000 ____D C:\Users\User\AppData\Local\{89064572-2890-4C04-9E35-B7BDBEABCC33}
2013-07-19 09:24 - 2013-07-19 09:24 - 00000000 ____D C:\Users\User\AppData\Local\{8EFB7135-45AB-47D9-A6EF-4EBDA95459B1}
2013-07-18 09:29 - 2013-07-18 09:29 - 00000000 ____D C:\Users\User\AppData\Local\{CA92EE73-3901-47E3-9A09-CE80425E155C}
2013-07-16 21:58 - 2013-07-16 21:59 - 00000000 ____D C:\Users\User\AppData\Local\{D8ADA368-3894-49F3-93BC-4547C2C1AF2B}
2013-07-15 12:24 - 2013-07-15 12:24 - 00000000 ____D C:\Users\User\AppData\Local\{1A590330-1673-4B67-BAEB-9B106265FE6D}
2013-07-14 13:24 - 2013-07-14 13:25 - 00000000 ____D C:\Users\User\AppData\Local\{1FDBC2E6-58CF-4DD9-91BD-934540A6551D}
2013-07-12 20:42 - 2013-07-12 20:42 - 00007579 _____ C:\Windows\SysWOW64\SystemData.xml
2013-07-12 08:48 - 2013-07-12 08:48 - 00000000 ____D C:\Users\User\AppData\Local\{7408DA49-7916-4234-9C3B-E505C1BB3977}
2013-07-11 16:09 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-11 16:09 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-11 16:09 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-11 16:09 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-11 16:09 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-11 16:09 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-11 16:09 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-11 16:09 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-11 16:09 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 16:09 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-11 16:09 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-11 16:09 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-11 09:26 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2013-07-11 09:26 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2013-07-11 09:26 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-11 09:26 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-11 09:24 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2013-07-11 09:24 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-07-11 09:24 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2013-07-11 09:02 - 2013-07-11 09:02 - 00000000 ____D C:\Users\User\AppData\Local\{48C426DD-98B6-46DF-8FFE-D2697AAA8427}
2013-07-10 16:35 - 2013-07-10 16:35 - 00000000 ____D C:\Users\User\AppData\Local\{B2C53CFA-EE22-49CC-84CC-253994D29C34}
2013-07-09 15:50 - 2013-07-09 15:50 - 00000000 ____D C:\Users\User\AppData\Local\{73ECE2EF-C73B-4DB4-80EE-3BD6AB66B63C}
2013-07-08 13:01 - 2013-07-08 13:01 - 00000000 ____D C:\Users\User\AppData\Local\{E8854379-5E30-48B6-AE7F-BF2E214D07DE}
137
==================== One Month Modified Files and Folders =======
2013-08-06 07:58 - 2013-08-06 07:58 - 00001604 _____ C:\Users\User\Desktop\checkup.txt
2013-08-06 07:47 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-06 07:47 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-06 07:45 - 2011-11-04 03:51 - 00654844 _____ C:\Windows\system32\perfh007.dat
2013-08-06 07:45 - 2011-11-04 03:51 - 00130426 _____ C:\Windows\system32\perfc007.dat
2013-08-06 07:45 - 2009-07-14 07:13 - 01500254 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-06 07:43 - 2012-06-21 12:51 - 01230561 _____ C:\Windows\WindowsUpdate.log
2013-08-06 07:34 - 2012-06-21 13:01 - 00000000 ____D C:\Users\User\Documents\Youcam
2013-08-06 07:33 - 2013-07-28 16:04 - 00001872 _____ C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
2013-08-06 07:32 - 2013-05-29 19:40 - 00001102 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-06 07:32 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-06 07:32 - 2009-07-14 06:51 - 00131189 _____ C:\Windows\setupact.log
2013-08-06 07:27 - 2013-08-06 07:27 - 01788685 _____ (Farbar) C:\Users\User\Desktop\FRST64.exe
2013-08-06 07:23 - 2013-05-29 19:40 - 00001106 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-06 07:17 - 2013-08-06 07:17 - 00891098 _____ C:\Users\User\Desktop\SecurityCheck.exe
2013-08-06 07:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-06 07:15 - 2012-11-06 12:13 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-05 13:24 - 2012-06-21 12:53 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-05 08:12 - 2013-08-05 08:12 - 00000000 ____D C:\Program Files (x86)\ESET
2013-08-03 10:53 - 2013-08-03 10:52 - 00005969 _____ C:\AdwCleaner[S1].txt
2013-08-03 10:50 - 2013-08-03 10:49 - 00717160 _____ C:\Users\User\Downloads\ZipOpenerSetup.exe
2013-08-02 08:09 - 2013-08-02 08:09 - 00037465 _____ C:\ComboFix.txt
2013-08-02 08:09 - 2013-08-02 07:35 - 00000000 ____D C:\Qoobox
2013-08-02 08:09 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-02 08:06 - 2013-08-02 07:35 - 00000000 ____D C:\Windows\erdnt
2013-08-02 08:01 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-02 07:58 - 2010-11-21 05:47 - 00095628 _____ C:\Windows\PFRO.log
2013-08-01 14:56 - 2013-08-01 14:56 - 00000000 ____D C:\FRST
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Users\User\AppData\Roaming\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-01 11:20 - 2013-08-01 11:20 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-07-31 16:17 - 2013-07-31 16:17 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2013-07-31 16:17 - 2013-07-31 16:17 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2013-07-31 16:17 - 2013-07-28 15:37 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
2013-07-31 16:17 - 2011-11-07 18:45 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2013-07-31 16:17 - 2011-11-07 18:45 - 00000000 ____D C:\Program Files (x86)\Java
2013-07-31 16:16 - 2013-07-31 16:15 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586(1).exe
2013-07-31 16:08 - 2012-10-12 14:17 - 00000000 ____D C:\Program Files\Java
2013-07-31 09:36 - 2013-07-28 16:04 - 00000000 ____D C:\Program Files (x86)\Ad-Aware Antivirus
2013-07-30 18:32 - 2013-07-30 18:32 - 00000000 ____D C:\Users\User\AppData\Local\{B0DD8DAC-0FDE-487C-BC85-3A1EB96ED03A}
2013-07-30 17:59 - 2013-07-28 16:13 - 00000000 ____D C:\Users\User\AppData\Roaming\LavasoftStatistics
2013-07-29 21:30 - 2013-07-29 21:30 - 00003184 _____ C:\Windows\System32\Tasks\{EB41B063-30F3-47D5-99AC-502F191AB7E8}
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Users\User\AppData\Roaming\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\ProgramData\X-Setup Pro
2013-07-29 21:25 - 2013-07-29 21:25 - 00000000 ____D C:\Program Files (x86)\X-Setup Pro
2013-07-29 21:17 - 2013-07-29 21:17 - 01110476 _____ C:\Users\User\Downloads\7z920.exe
2013-07-29 21:17 - 2013-07-29 21:17 - 00000000 ____D C:\Program Files (x86)\7-Zip
2013-07-29 21:15 - 2013-05-22 15:01 - 00000000 ____D C:\Users\User\AppData\Local\WinZip
2013-07-29 21:14 - 2013-07-29 21:14 - 06662897 _____ C:\Users\User\Downloads\xsetup92.zip
2013-07-29 21:10 - 2013-07-29 20:43 - 00000000 ____D C:\Users\User\AppData\Local\DTAG
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\Users\User\AppData\Local\mquadr.at
2013-07-29 20:44 - 2013-07-29 20:44 - 00000000 ____D C:\ProgramData\mquadr.at
2013-07-29 12:08 - 2013-07-29 12:03 - 00000000 ____D C:\Windows\system32\MRT
2013-07-29 08:47 - 2013-07-29 08:47 - 00001912 _____ C:\Windows\epplauncher.mif
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-07-29 08:47 - 2013-07-29 08:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-07-29 08:46 - 2013-07-29 08:45 - 13813944 _____ (Microsoft Corporation) C:\Users\User\Downloads\mseinstall.exe
2013-07-29 08:35 - 2013-07-31 10:36 - 00001872 _____ C:\Users\User\Desktop\Ad-Aware Antivirus.lnk
2013-07-29 08:34 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-07-28 21:46 - 2013-07-28 16:00 - 00000000 ____D C:\Users\User\AppData\Roaming\Ad-Aware Antivirus
2013-07-28 21:24 - 2012-12-04 15:19 - 00000000 ____D C:\Program Files (x86)\McAfee Security Scan
2013-07-28 16:18 - 2013-07-28 16:13 - 00000000 ____D C:\ProgramData\Ad-Aware Antivirus
2013-07-28 16:13 - 2013-07-28 16:13 - 00004454 _____ C:\Windows\System32\Tasks\Ad-Aware Antivirus Scheduled Scan
2013-07-28 16:04 - 2013-07-28 16:04 - 00000000 ____D C:\ProgramData\Lavasoft
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\Users\User\AppData\Local\adawarebp
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Downloaded Installations
2013-07-28 16:03 - 2013-07-28 16:03 - 00000000 ____D C:\ProgramData\Ad-Aware Browsing Protection
2013-07-28 16:03 - 2013-07-03 09:53 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-07-28 16:01 - 2013-07-28 16:00 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\User\Downloads\mbam-setup-1.75.0.1300.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00047496 _____ (GFI Software) C:\Windows\system32\sbbd.exe
2013-07-28 16:00 - 2013-07-28 16:00 - 00014456 _____ (GFI Software) C:\Windows\system32\Drivers\gfibto.sys
2013-07-28 15:59 - 2013-07-28 15:59 - 05616264 _____ (Lavasoft Limited) C:\Users\User\Downloads\Adaware53_Installer.exe
2013-07-28 15:35 - 2013-07-28 15:32 - 31714728 _____ (Oracle Corporation) C:\Users\User\Downloads\jre-7u25-windows-i586.exe
2013-07-28 12:35 - 2013-07-28 12:35 - 00000000 ____D C:\NVIDIA
2013-07-28 12:03 - 2012-11-17 22:03 - 00417563 _____ C:\Windows\system32\Drivers\vsconfig.xml
2013-07-28 11:59 - 2012-11-17 22:03 - 00000762 _____ C:\Users\Public\Desktop\ZoneAlarm Security.lnk
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Users\User\AppData\Roaming\Check Point Software Technologies LTD
2013-07-28 11:56 - 2013-07-28 11:56 - 00000000 ____D C:\Program Files (x86)\Check Point Software Technologies LTD
2013-07-28 11:54 - 2013-07-28 11:54 - 02402224 _____ (Check Point Software Technologies LTD) C:\Users\User\Downloads\zafwSetupWeb_110_000_504.exe
2013-07-28 11:11 - 2013-07-28 11:11 - 00000000 ____D C:\Users\User\AppData\Local\{5433EC7B-B809-4591-A684-EDA60B38E28E}
2013-07-26 12:34 - 2012-07-18 07:34 - 00000000 ____D C:\Users\User\Citrix
2013-07-25 21:31 - 2013-07-25 21:31 - 00027230 _____ C:\Users\User\Desktop\Speedport_W_504V1.17.000_05.11.12_1225_25-07-2013.bin
2013-07-25 11:54 - 2013-07-25 11:54 - 00000000 ____D C:\Users\User\AppData\Local\{F3BBF71B-31A8-4152-B989-19A8891C4EF0}
2013-07-24 12:58 - 2013-07-24 12:58 - 00000000 ____D C:\Users\User\AppData\Local\{46B3821B-8767-4AC5-AFED-2655F06230FB}
2013-07-23 06:37 - 2013-07-23 06:37 - 00000000 ____D C:\Users\User\AppData\Local\{BFCE7EFE-0011-4377-A756-2EADBE8B844D}
2013-07-22 17:00 - 2013-07-22 17:00 - 00000000 ____D C:\Users\User\AppData\Local\{99F423E8-8B87-4B7F-9DBA-6D614EBC50CE}
2013-07-21 15:55 - 2013-07-21 15:55 - 00000000 ____D C:\Users\User\AppData\Local\{476C41D7-B8F8-48EB-91E4-553A78FFD0B4}
2013-07-20 13:59 - 2013-07-20 13:59 - 00000000 ____D C:\Users\User\AppData\Local\{89064572-2890-4C04-9E35-B7BDBEABCC33}
2013-07-19 21:03 - 2013-06-15 15:28 - 00000000 ____D C:\Users\User\AppData\Roaming\Skype
2013-07-19 09:24 - 2013-07-19 09:24 - 00000000 ____D C:\Users\User\AppData\Local\{8EFB7135-45AB-47D9-A6EF-4EBDA95459B1}
2013-07-18 09:29 - 2013-07-18 09:29 - 00000000 ____D C:\Users\User\AppData\Local\{CA92EE73-3901-47E3-9A09-CE80425E155C}
2013-07-16 21:59 - 2013-07-16 21:58 - 00000000 ____D C:\Users\User\AppData\Local\{D8ADA368-3894-49F3-93BC-4547C2C1AF2B}
2013-07-16 21:18 - 2013-05-29 19:40 - 00004102 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-16 21:18 - 2013-05-29 19:40 - 00003850 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-15 12:24 - 2013-07-15 12:24 - 00000000 ____D C:\Users\User\AppData\Local\{1A590330-1673-4B67-BAEB-9B106265FE6D}
2013-07-14 13:25 - 2013-07-14 13:24 - 00000000 ____D C:\Users\User\AppData\Local\{1FDBC2E6-58CF-4DD9-91BD-934540A6551D}
2013-07-12 20:42 - 2013-07-12 20:42 - 00007579 _____ C:\Windows\SysWOW64\SystemData.xml
2013-07-12 08:48 - 2013-07-12 08:48 - 00000000 ____D C:\Users\User\AppData\Local\{7408DA49-7916-4234-9C3B-E505C1BB3977}
2013-07-12 08:23 - 2009-07-14 06:45 - 00368344 _____ C:\Windows\system32\FNTCACHE.DAT
2013-07-12 08:22 - 2013-03-14 14:53 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-12 08:22 - 2013-03-14 14:53 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-12 08:22 - 2011-04-12 10:28 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-12 08:22 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-12 08:22 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 09:02 - 2013-07-11 09:02 - 00000000 ____D C:\Users\User\AppData\Local\{48C426DD-98B6-46DF-8FFE-D2697AAA8427}
2013-07-10 16:35 - 2013-07-10 16:35 - 00000000 ____D C:\Users\User\AppData\Local\{B2C53CFA-EE22-49CC-84CC-253994D29C34}
2013-07-09 15:50 - 2013-07-09 15:50 - 00000000 ____D C:\Users\User\AppData\Local\{73ECE2EF-C73B-4DB4-80EE-3BD6AB66B63C}
2013-07-08 13:01 - 2013-07-08 13:01 - 00000000 ____D C:\Users\User\AppData\Local\{E8854379-5E30-48B6-AE7F-BF2E214D07DE}
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-21 14:08
==================== End Of Log ============================
LG Mari |
|
06.08.2013, 16:30
| #14 |
| /// the machine /// TB-Ausbilder | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Adobe updaten. Downloade dir bitte  Farbar Service Scanner
Poste bitte den Inhalt hier.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.08.2013, 05:57
| #15 |
| | Facebook-Link angeklickt "Just 14 years Old drunk girl .." Farbar Service Scanner Version: 04-08-2013 Ran by User (administrator) on 07-08-2013 at 06:56:04 Running from "C:\Users\User\Desktop" Microsoft Windows 7 Home Premium Service Pack 1 (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Attempt to access Local Host IP returned error: Localhost is blocked: Destination is offline LAN connected. Google IP is accessible. Google.com is accessible. Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall"=DWORD:0 System Restore: ============ System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== WinDefend Service is not running. Checking service configuration: The start type of WinDefend service is set to Demand. The default start type is Auto. The ImagePath of WinDefend service is OK. The ServiceDll of WinDefend service is OK. Windows Defender Disabled Policy: ========================== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender] "DisableAntiSpyware"=DWORD:1 Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\ipnathlp.dll => MD5 is legit C:\Windows\System32\iphlpsvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log **** Habe den Adobe Reader deinstalliert und dafür den Foxit Reader installiert - was ist mit Adobe Flashplayer 11 Active X und Flashplayer Plugin? LG Mari Geändert von mb55 (07.08.2013 um 06:02 Uhr) |
|
| Themen zu Facebook-Link angeklickt "Just 14 years Old drunk girl .." |
| ad-aware, ahnung, antivir, antivirus, fehlermeldungen, gesperrt, geändert, girl, gruppen, guten, java, klick, link, links, mails, malwarebytes, microsoft, neu, nichts, passwort, scan, security, this, verschickt, zonealarm |
Linear-Darstellung
