| |
| |||||||
Log-Analyse und Auswertung: Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständigWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.08.2013, 22:49
| #1 |
 |  Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Sehr geehrtes Team, ein Freund von mir hatte vor 1 Monat ungefähr den Bundestrojaner und hat ihn dann selbst entfernt, indem er ihn aus den Diensten? gelöscht hat. Ich weiß nicht genau wie er dies angestellt hat, jedoch bin ich mir ziemlich sicher dass er nur den lestigen Desktop-Screen entfernen konnte und im Hintergrund noch Trojaner werkeln. Er hat sich an mich gewandt, da beim Anmelden auf einmal die Meldung: "Der RPC-Server konnte nicht gestartet werden" auftauchte. Weiteres erzählte er mir dies mit dem Bundestrojaner und somit wende ich mich an euch, da ich selbst nicht in der Lage bin die Logfiles auszulesen. Hier mal die üblichen Logfiles: defogger_disable: Code:
ATTFilter defogger_disable by jpshortstuff (23.02.10.1)
Log created at 23:29 on 02/08/2013 (Administrator)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
Checking for services/drivers...
-=E.O.F=-
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013
Ran by Administrator (administrator) on 02-08-2013 23:30:18
Running from C:\Users\Administrator\Desktop
Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)
==================== Processes (Whitelisted) =================
(DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-04] (Synaptics Incorporated)
HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-07] (Atheros Communications)
HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2011-01-07] (Atheros Commnucations)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [835072 2011-01-27] (IDT, Inc.)
HKLM\...\Run: [MfeEpePcMonitor] - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] ()
HKLM\...\Run: [XeroxScanUtility] - C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2371072 2010-02-10] (Xerox Corporation)
HKLM\...\Run: [XeroxEndeavorBackgroundTask] - C:\windows\system32\xgchabgnd.exe [102912 2009-11-02] ()
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe,
HKCU\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [97280 2009-07-14] (Microsoft Corporation)
HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc)
HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [299576 2011-01-29] (Hewlett-Packard Company)
HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard)
HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation)
HKLM-x32\...\Run: [HP HD Webcam [Fixed]_Monitor] - C:\Program Files (x86)\HP HD Webcam [Fixed]\monitor.exe [267128 2010-11-26] ()
HKLM-x32\...\Run: [DTRun] - c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [517456 2010-11-24] (ArcSoft Inc.)
HKLM-x32\...\Run: [HPConnectionManager] - c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [HPQuickWebProxy] - c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1564872 2012-06-06] (Ask)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PROFIS AutoUpdate] - C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe [474112 2011-11-02] (Agito d.o.o.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-15] (Apple Inc.)
HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software)
Lsa: [Notification Packages] EpePcNp64 DPPassFilter scecli
Startup: C:\Users\Katharina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Administrator\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (No File)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/4
HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/4
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPCOM/4
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=CMNTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=CMNTDF
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_IKEA_Win32.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-01-07] (Atheros)
S2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] ()
S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software)
S2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.)
S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-04] (Hewlett-Packard Company)
S2 hasplms; C:\windows\system32\hasplms.exe [4889032 2011-12-30] (SafeNet Inc.)
S2 Hilti PROFIS AutoUpdate Service; C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [206336 2011-11-02] (Agito d.o.o.)
S3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P)
S2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company)
S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [281656 2011-01-29] (Hewlett-Packard Company)
S2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] ()
S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc)
S2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.)
S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-03-07] (Xobni Corporation)
==================== Drivers (Whitelisted) ====================
S3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.)
S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)
S2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)
S1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)
S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()
S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-12] (AVAST Software)
S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-12] (AVAST Software)
S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)
S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-12] ()
S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company)
S2 hardlock; C:\windows\system32\drivers\hardlock.sys [321536 2011-09-28] (SafeNet Inc.)
R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.)
S3 mod7700; C:\Windows\System32\DRIVERS\dvb7700all.sys [865344 2009-11-02] (DiBcom)
S3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology)
S3 HMXProjExt64; system32\DRIVERS\HMXExGrp64.sys [x]
S3 HMXProjMir64; system32\DRIVERS\HMXMrGrp64.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-02 23:29 - 2013-08-02 23:29 - 00000488 _____ C:\Users\Administrator\Desktop\defogger_disable.log
2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-08-02 23:29 - 2013-08-02 23:26 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2013-08-02 23:29 - 2013-08-02 23:26 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe
2013-08-02 23:29 - 2013-08-02 23:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-02 23:29 - 2013-08-02 23:24 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe
2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-02 22:39 - 2010-11-20 15:24 - 00345088 _____ (Microsoft Corporation) C:\windows\system32\Utilman.exe
2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html
2013-08-02 22:30 - 2013-08-02 22:30 - 00045285 _____ C:\acadminidump.dmp
2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH
2013-08-02 22:16 - 2013-08-02 23:29 - 00000000 ____D C:\Users\Administrator
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten
2013-08-02 22:16 - 2011-10-17 22:49 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Microsoft Help
2013-08-02 22:16 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Administrator\ntuser.ini
2013-08-02 22:16 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2013-08-02 22:16 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2013-07-16 18:40 - 2013-08-03 08:04 - 00000000 ___RD C:\Sandbox
2013-07-16 18:39 - 2013-08-03 08:04 - 00000000 ____D C:\Program Files\Sandboxie
2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer
2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum
2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum
2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum
2013-07-12 23:18 - 2013-05-02 02:06 - 00278800 _____ (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2013-07-12 23:16 - 2013-08-02 22:08 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update
2013-07-12 23:16 - 2013-08-02 22:08 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-07-12 23:16 - 2013-08-02 22:08 - 00000000 _____ C:\windows\SysWOW64\config.nt
2013-07-12 23:16 - 2013-07-12 23:26 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2013-07-12 23:16 - 2013-07-12 23:26 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2013-07-12 23:16 - 2013-07-12 23:26 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys
2013-07-12 23:16 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys
2013-07-12 23:16 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys
2013-07-12 23:16 - 2013-05-09 10:59 - 00065336 _____ C:\windows\system32\Drivers\aswRvrt.sys
2013-07-12 23:16 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\windows\system32\Drivers\aswTdi.sys
2013-07-12 23:16 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys
2013-07-12 23:16 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\windows\system32\aswBoot.exe
2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-07-12 23:15 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\windows\avastSS.scr
2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-07-12 18:52 - 2013-07-12 23:15 - 00000000 ____D C:\ProgramData\AVAST Software
2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log
2013-07-11 16:34 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-07-11 16:34 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-07-11 16:34 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-07-11 16:34 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-07-11 16:34 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-07-11 16:34 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-07-11 16:34 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll
2013-07-11 16:34 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2013-07-11 16:34 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2013-07-11 16:34 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-07-11 16:34 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2013-07-11 16:34 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2013-07-11 16:34 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2013-07-11 16:34 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-11 16:34 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe
2013-07-11 16:34 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-07-11 16:34 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-07-11 16:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-07-11 16:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-07-11 16:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-07-11 16:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-07-11 16:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-07-11 16:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-07-11 16:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-07-11 16:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika
2013-07-11 14:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2013-07-11 14:17 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll
2013-07-11 14:17 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll
2013-07-11 14:17 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-07-11 14:17 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-07-11 14:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll
2013-07-11 14:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll
2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer
2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines
2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics
2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-11 13:54 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona
2013-07-11 13:54 - 2011-10-17 22:49 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help
2013-07-11 13:54 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Gast\ntuser.ini
188
==================== One Month Modified Files and Folders =======
2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iTunes
2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iPod
2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-03 08:05 - 2012-04-29 21:00 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\vlc
2013-08-03 08:05 - 2011-11-28 21:36 - 00000000 ____D C:\ProgramData\Apple Computer
2013-08-03 08:05 - 2011-10-14 19:15 - 00000000 ____D C:\Users\Katharina
2013-08-03 08:05 - 2011-06-21 02:44 - 00000000 ____D C:\ProgramData\FLEXnet
2013-08-03 08:05 - 2009-07-14 05:20 - 00000000 ____D C:\windows\AppCompat
2013-08-03 08:04 - 2013-07-16 18:40 - 00000000 ___RD C:\Sandbox
2013-08-03 08:04 - 2013-07-16 18:39 - 00000000 ____D C:\Program Files\Sandboxie
2013-08-03 08:04 - 2009-07-14 05:20 - 00000000 ____D C:\windows\registration
2013-08-02 23:30 - 2013-08-02 23:30 - 00000000 ____D C:\FRST
2013-08-02 23:29 - 2013-08-02 23:29 - 00000488 _____ C:\Users\Administrator\Desktop\defogger_disable.log
2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable
2013-08-02 23:29 - 2013-08-02 22:16 - 00000000 ____D C:\Users\Administrator
2013-08-02 23:29 - 2011-06-21 02:34 - 00700168 _____ C:\windows\system32\perfh007.dat
2013-08-02 23:29 - 2011-06-21 02:34 - 00148964 _____ C:\windows\system32\perfc007.dat
2013-08-02 23:29 - 2009-07-14 07:13 - 01621244 _____ C:\windows\system32\PerfStringBackup.INI
2013-08-02 23:26 - 2013-08-02 23:29 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe
2013-08-02 23:26 - 2013-08-02 23:29 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe
2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-02 23:24 - 2013-08-02 23:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe
2013-08-02 23:24 - 2013-08-02 23:29 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe
2013-08-02 23:20 - 2012-10-15 11:51 - 00000000 ____D C:\Program Files (x86)\Pythagoras
2013-08-02 22:52 - 2011-06-21 02:48 - 00000000 ____D C:\ProgramData\PDFC
2013-08-02 22:52 - 2011-06-21 02:45 - 00000000 ____D C:\ProgramData\HPQLOG
2013-08-02 22:50 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-08-02 22:50 - 2009-07-14 06:51 - 00116098 _____ C:\windows\setupact.log
2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html
2013-08-02 22:35 - 2013-03-15 22:13 - 00000000 ____D C:\Users\Potti
2013-08-02 22:33 - 2013-03-15 22:44 - 00141312 _____ C:\Users\Potti\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-02 22:30 - 2013-08-02 22:30 - 00045285 _____ C:\acadminidump.dmp
2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf
2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten
2013-08-02 22:11 - 2011-08-30 19:01 - 01778510 _____ C:\windows\WindowsUpdate.log
2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-02 22:08 - 2013-07-12 23:16 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update
2013-08-02 22:08 - 2013-07-12 23:16 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-08-02 22:08 - 2013-07-12 23:16 - 00000000 _____ C:\windows\SysWOW64\config.nt
2013-08-02 22:06 - 2013-01-01 12:26 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-07-28 23:46 - 2012-11-18 18:59 - 01070416 _____ C:\xxbgtask.log
2013-07-25 21:17 - 2011-10-15 09:43 - 00000000 ____D C:\Users\Katharina\AppData\Local\cache
2013-07-21 23:00 - 2011-11-10 19:34 - 00000000 ____D C:\Users\Katharina\Documents\Veldidena
2013-07-21 20:25 - 2011-11-10 16:55 - 00005934 _____ C:\Users\Katharina\Documents\plot.log
2013-07-15 19:59 - 2012-07-17 18:24 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-07-15 19:39 - 2013-01-01 12:26 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-07-15 19:39 - 2012-11-12 21:09 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-07-15 19:39 - 2012-11-12 21:09 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer
2013-07-15 19:27 - 2012-07-17 18:24 - 00001112 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-07-15 19:27 - 2011-10-20 10:56 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini
2013-07-14 23:48 - 2012-04-17 17:38 - 00001154 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job
2013-07-14 17:48 - 2012-04-17 17:38 - 00001132 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job
2013-07-13 14:00 - 2012-09-20 20:22 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-07-13 13:54 - 2012-07-17 18:24 - 00004112 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2013-07-13 13:54 - 2012-07-17 18:24 - 00003860 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum
2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum
2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum
2013-07-12 23:26 - 2013-07-12 23:16 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys
2013-07-12 23:26 - 2013-07-12 23:16 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys
2013-07-12 23:26 - 2013-07-12 23:16 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys
2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software
2013-07-12 23:15 - 2013-07-12 18:52 - 00000000 ____D C:\ProgramData\AVAST Software
2013-07-12 23:02 - 2012-02-28 15:32 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-07-12 22:58 - 2011-08-30 19:27 - 00487972 _____ C:\windows\PFRO.log
2013-07-12 22:58 - 2011-08-30 19:22 - 00000000 ____D C:\ProgramData\Norton
2013-07-12 22:54 - 2011-10-14 19:24 - 00141312 _____ C:\Users\Katharina\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-12 22:53 - 2009-07-14 06:45 - 00492616 _____ C:\windows\system32\FNTCACHE.DAT
2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer
2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log
2013-07-11 22:13 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT
2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2013-07-11 22:11 - 2009-07-27 16:36 - 00000000 ____D C:\Program Files\Windows Journal
2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-07-11 16:35 - 2011-10-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika
2013-07-11 14:05 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder
2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC
2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer
2013-07-11 13:56 - 2011-08-30 19:13 - 00000000 ____D C:\Users\Public\Documents\Atheros
2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines
2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics
2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe
2013-07-11 13:55 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore
2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona
2013-07-08 21:15 - 2011-10-17 22:03 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log
2013-07-07 09:59 - 2011-11-01 11:45 - 00000348 _____ C:\windows\Tasks\HPCeeScheduleForKatharina.job
2013-07-06 02:59 - 2011-11-01 11:45 - 00003210 _____ C:\windows\System32\Tasks\HPCeeScheduleForKatharina
Files to move or delete:
====================
C:\ProgramData\0466116.bat
C:\ProgramData\0466116.pad
C:\ProgramData\0466116.reg
C:\ProgramData\1280261.bat
C:\ProgramData\1280261.pad
C:\ProgramData\1280261.reg
C:\Users\Katharina\6116640.dll
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-07-25 19:21
==================== End Of Log ============================
Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013
Ran by Administrator at 2013-08-02 23:31:38
Running from C:\Users\Administrator\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================
==================== Installed Programs =======================
Update for Microsoft Office 2007 (KB2508958) (x32)
2007 Microsoft Office system (x32 Version: 12.0.6612.1000)
64 Bit HP CIO Components Installer (Version: 6.2.2)
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7)
Agatha Christie - Peril at End House (x32 Version: 2.2.0.95)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (x32 Version: 2.1.3.127)
ArcSoft TotalMedia (x32 Version: 1.0.48.25)
ArcSoft TotalMedia (x32 Version: 2.0.39.12)
ArcSoft Webcam Sharing Manager (x32 Version: 2.0.0.30)
Ask Toolbar (x32 Version: 1.15.4.0)
Atheros Driver Installation Program (x32 Version: 9.2)
AUER Success.6 Lernversion (x32 Version: 06.00.0228)
AutoCAD 2012 Language Pack - Deutsch (Version: 18.2.51.0)
AutoCAD LT 2012 - Deutsch (Version: 18.2.51.0)
AutoCAD LT 2012 Language Pack - Deutsch (Version: 18.2.51.0)
Autodesk Content Service (x32 Version: 2.0.90)
Autodesk Inventor Fusion 2012 (Version: 1.0.0.79)
Autodesk Inventor Fusion 2012 Language Pack (Version: 1.0.0.79)
Autodesk Inventor Fusion Plugin for AutoCAD 2012 (Version: 0.0.1.138)
Autodesk Inventor Fusion plug-in for AutoCAD 2012 (Version: 0.0.1.138)
Autodesk Inventor Fusion Plugin Language Pack for AutoCAD 2012 (Version: 0.0.1.138)
Autodesk Material Library 2012 (x32 Version: 2.5.0.8)
Autodesk Material Library Base Resolution Image Library 2012 (x32 Version: 2.5.0.8)
avast! Free Antivirus (x32 Version: 8.0.1489.0)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95)
Bing Bar (x32 Version: 7.1.361.0)
Bing Rewards Client Installer (x32 Version: 16.0.345.0)
Blasterball 3 (x32 Version: 2.2.0.95)
Bluetooth Win7 Suite (64) (Version: 7.02.000.55)
Bonjour (Version: 3.0.0.10)
Bounce Symphony (x32 Version: 2.2.0.95)
Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95)
Cake Mania (x32 Version: 2.2.0.95)
Chuzzle Deluxe (x32 Version: 2.2.0.95)
Cinergy T USB XXS V2.03.03.29 (x32 Version: 2.03.03.29)
Cisco EAP-FAST Module (x32 Version: 2.2.14)
Cisco LEAP Module (x32 Version: 1.0.19)
Cisco PEAP Module (x32 Version: 1.1.6)
D3DX10 (x32 Version: 15.4.2368.0902)
Device Access Manager for HP ProtectTools (Version: 6.0.0.9)
Die Sims™ 3 (x32 Version: 1.19.44)
Die Sims™ 3 Design-Garten-Accessoires (x32 Version: 7.0.55)
Die Sims™ 3 Gib Gas-Accessoires (x32 Version: 5.0.44)
Die Sims™ 3 Reiseabenteuer (x32 Version: 2.0.86)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95)
Drive Encryption For HP ProtectTools (Version: 6.0.33.24411)
Energy Star Digital Logo (x32 Version: 1.0.1)
Evernote v. 4.2.2 (x32 Version: 4.2.2.3979)
Face Recognition for HP ProtectTools (Version: 6.00.4303)
Facebook Messenger 2.1.4814.0 (x32 Version: 2.1.4814.0)
Farm Frenzy (x32 Version: 2.2.0.95)
FARO LS 1.1.406.58 (x32 Version: 4.6.58.2)
FATE (x32 Version: 2.2.0.95)
File Sanitizer For HP ProtectTools (x32 Version: 6.0.0.8)
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922)
GeoGebra (x32 Version: 4.0.21.0)
Google Chrome (x32 Version: 28.0.1500.72)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358)
Google Update Helper (x32 Version: 1.3.21.153)
Hilti PROFIS Anchor (x32 Version: 2.3.0000)
Hilti PROFIS AutoUpdate (x32 Version: 1.6.0)
HP 3D DriveGuard (Version: 4.1.4.1)
HP Auto (Version: 1.0.12494.3472)
HP Connection Manager (x32 Version: 4.1.10.1)
HP Customer Experience Enhancements (x32 Version: 6.0.1.7)
HP DayStarter (Version: 2.0.0.12)
HP Documentation (x32 Version: 1.2.0.0)
HP ESU for Microsoft Windows 7 (x32 Version: 1.1.11.1)
HP Game Console (x32)
HP Games (x32 Version: 1.0.1.5)
HP HD Webcam [Fixed] (x32 Version: 3.3.4.07)
HP HotKey Support (Version: 4.0.10.1)
HP Power Assistant (Version: 2.0.2.0)
HP ProtectTools Security Manager (Version: 6.00.888)
HP QuickWeb (x32 Version: 3.0.0.9057)
HP Setup (x32 Version: 8.5.4526.3645)
HP SoftPaq Download Manager (x32 Version: 3.2.0.0)
HP Software Framework (x32 Version: 4.0.112.1)
HP Software Setup (x32 Version: 8.2.1.1)
HP Support Assistant (x32 Version: 5.2.3.4)
HP System Default Settings (x32 Version: 2.1.2)
HP Wallpaper (x32 Version: 2.00)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2)
IDT Audio (x32 Version: 1.0.6325.0)
Insaniquarium Deluxe (x32 Version: 2.2.0.95)
Intel(R) Identity Protection Technology 1.0.71.0 (x32 Version: 1.0.71.0)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1144)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2342)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004)
iTunes (Version: 11.0.3.42)
Java Auto Updater (x32 Version: 2.0.7.1)
Java(TM) 6 Update 31 (x32 Version: 6.0.310)
Jewel Quest II (x32 Version: 2.2.0.95)
Jewel Quest Solitaire (x32 Version: 2.2.0.95)
JMicron Flash Media Controller Driver (x32 Version: 1.0.57.2)
John Deere Drive Green (x32 Version: 2.2.0.95)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server 2008 Management Objects (Version: 10.1.2531.0)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0)
Microsoft_VC90_CRT_x86 (x32 Version: 1.0.0)
MSVCRT (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
oCAD 2012 - Deutsch (Version: 18.2.51.0)
PDF Complete Special Edition (x32 Version: 4.0.33)
Penguins! (x32 Version: 2.2.0.95)
Plants vs. Zombies (x32 Version: 2.2.0.95)
PlayReady PC Runtime amd64 (Version: 1.3.0)
Polar Bowler (x32 Version: 2.2.0.95)
Privacy Manager for HP ProtectTools (Version: 6.00.831)
ProVI2010_x64 5.1 (x32 Version: 5.1)
Pythagoras (x32 Version: 12.26)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922)
Realtek Ethernet Controller All-In-One Windows Driver (x32 Version: 1.12.0016)
RuckZuck (x32 Version: 6.0.10)
SDK (x32 Version: 2.24.025)
Skype™ 5.10 (x32 Version: 5.10.116)
Slingo Deluxe (x32 Version: 2.2.0.95)
SQL Server System CLR Types (Version: 10.1.2531.0)
Synaptics Pointing Device Driver (Version: 15.2.11.1)
TeamViewer 8 (x32 Version: 8.0.19617)
Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.30)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
Validity Fingerprint Sensor Driver (Version: 4.3.117.0)
VIP Access SDK x64(1.0.0.50) (x32 Version: 1.0.0.50)
Virtual Villagers - The Secret City (x32 Version: 2.2.0.95)
VLC media player 2.0.1 (x32 Version: 2.0.1)
Wedding Dash (x32 Version: 2.2.0.95)
Windows Live (x32 Version: 15.4.3502.0922)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)
WinZip 14.5 (x32 Version: 14.5.9095)
Xobni (x32 Version: 1.9.5.13282)
Xobni Core (x32 Version: 1.0.0)
Zuma Deluxe (x32 Version: 2.2.0.95)
==================== Restore Points =========================
23-07-2013 16:30:55 Windows Update
26-07-2013 18:49:15 Windows Update
==================== Hosts content: ==========================
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
Task: {24D104BA-E059-4042-BBCD-091B8B1DDBEA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.)
Task: {4FFE6CAC-D9A9-4ABF-BDE0-CC9362A7660E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {5BED5862-9232-44B6-9FD4-595A7C0857DC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {61D00D3F-C3F8-4657-8CB9-EFA933017D98} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company)
Task: {640BFA6E-B405-4D1A-9882-4D45F0CDFFEF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {7FBE12B0-5D8D-48C8-B4E3-A3BF3012EDC5} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-06-06] ()
Task: {9DCC5731-D6F9-4BA2-A49D-BEC942790A41} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation)
Task: {ADDEEFDD-8CE2-4028-9E08-406DB63E1831} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {BB2A30B6-AA5E-410A-85F6-BBA46DDC42D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company)
Task: {BD9ECD7B-DEA9-4699-8EDD-43363518684D} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation)
Task: {C19F0537-A9A4-4264-8F9D-5FA7EDEE3481} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.)
Task: {C2A47E9E-FDAD-4936-80CA-1320BE893337} - System32\Tasks\NetworkWizardVCW => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-25] ()
Task: {C918E184-1B71-442E-9F72-9D5511750F1C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-06-04] (Microsoft)
Task: {C98F4C41-99A8-46C4-B6D5-28D024BAE592} - System32\Tasks\HPCeeScheduleForKATHARINA-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {D11A732F-6A33-4773-835C-1195C30E12A4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {D1702CDF-A97F-461E-AFE5-8EBE38DF1B6C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-15] (Adobe Systems Incorporated)
Task: {DBC78FF0-E72F-4638-AD0C-86C5910CE5A2} - System32\Tasks\HPCeeScheduleForKatharina => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard)
Task: {DECBB6D4-CE38-4365-A131-CB1C3312F1F6} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {EFE5C061-8B09-49D3-BDF3-D5A4E63EA749} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForKATHARINA-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\windows\Tasks\HPCeeScheduleForKatharina.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
==================== Faulty Device Manager Devices =============
Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: aswRvrt
Description: aswRvrt
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswRvrt
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
Name: aswVmm
Description: aswVmm
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: aswVmm
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/02/2013 10:52:10 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
Error: (08/02/2013 10:52:10 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc
Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef8d4a0ea
ID des fehlerhaften Prozesses: 0x290
Startzeit der fehlerhaften Anwendung: 0xlsass.exe0
Pfad der fehlerhaften Anwendung: lsass.exe1
Pfad des fehlerhaften Moduls: lsass.exe2
Berichtskennung: lsass.exe3
Error: (08/02/2013 10:48:53 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
Error: (08/02/2013 10:48:53 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc
Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef9c2a0ea
ID des fehlerhaften Prozesses: 0x2a8
Startzeit der fehlerhaften Anwendung: 0xlsass.exe0
Pfad der fehlerhaften Anwendung: lsass.exe1
Pfad des fehlerhaften Moduls: lsass.exe2
Berichtskennung: lsass.exe3
Error: (08/02/2013 10:45:30 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
Error: (08/02/2013 10:45:30 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc
Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef908a0ea
ID des fehlerhaften Prozesses: 0x290
Startzeit der fehlerhaften Anwendung: 0xlsass.exe0
Pfad der fehlerhaften Anwendung: lsass.exe1
Pfad des fehlerhaften Moduls: lsass.exe2
Berichtskennung: lsass.exe3
Error: (08/02/2013 10:42:12 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
Error: (08/02/2013 10:42:12 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc
Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef92fa0ea
ID des fehlerhaften Prozesses: 0x294
Startzeit der fehlerhaften Anwendung: 0xlsass.exe0
Pfad der fehlerhaften Anwendung: lsass.exe1
Pfad des fehlerhaften Moduls: lsass.exe2
Berichtskennung: lsass.exe3
Error: (08/02/2013 10:19:43 PM) (Source: Wininit) (User: )
Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden.
Error: (08/02/2013 10:19:43 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc
Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000007fef9bfa0ea
ID des fehlerhaften Prozesses: 0x2bc
Startzeit der fehlerhaften Anwendung: 0xlsass.exe0
Pfad der fehlerhaften Anwendung: lsass.exe1
Pfad des fehlerhaften Moduls: lsass.exe2
Berichtskennung: lsass.exe3
System errors:
=============
Error: (08/02/2013 11:30:07 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:18:30 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:03 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:
%%1068
Error: (08/02/2013 11:17:03 PM) (Source: DCOM) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}
Error: (08/02/2013 11:16:59 PM) (Source: DCOM) (User: )
Description: 1084WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
Microsoft Office Sessions:
=========================
==================== Memory info ===========================
Percentage of memory in use: 16%
Total physical RAM: 4030.37 MB
Available physical RAM: 3378.78 MB
Total Pagefile: 8058.92 MB
Available Pagefile: 7456.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB
==================== Drives ================================
Drive c: () (Fixed) (Total:442.57 GB) (Free:53.1 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive d: (GONNA_WORK) (Removable) (Total:0.24 GB) (Free:0.23 GB) FAT (Disk=1 Partition=1)
Drive e: (HP_RECOVERY) (Fixed) (Total:17.89 GB) (Free:2.72 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)]
Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.13 GB) FAT32 (Disk=0 Partition=4)
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 13B7DE8A)
Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=443 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=5 GB) - (Type=0C)
========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 250 MB) (Disk ID: 00000000)
Partition 1: (Active) - (Size=250 MB) - (Type=06)
==================== End Of Log ============================
Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-02 23:46:02
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042 rev.0006 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\ADMINI~1\AppData\Local\Temp\uflcquoc.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\d0df9aa889dc (not active ControlSet)
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\d0df9aa889dc
Reg HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\d0df9aa889dc (not active ControlSet)
---- EOF - GMER 2.1 ----
Liebe Grüße, pflanz! |
|
02.08.2013, 22:59
| #2 | |
| /// the machine /// TB-Ausbilder    | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig hi,
__________________Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
03.08.2013, 11:33
| #3 |
| | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Hallo,
__________________hier der Combofix-Log: Code:
ATTFilter ComboFix 13-08-02.01 - Administrator 03.08.2013 11:30:16.1.4 - x64 MINIMAL
Microsoft Windows 7 Professional 6.1.7601.1.1252.43.1031.18.4030.3301 [GMT 2:00]
ausgeführt von:: c:\users\Administrator\Desktop\ComboFix.exe
AV: avast! Antivirus *Enabled/Outdated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Outdated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\0466116.bat
c:\programdata\0466116.pad
c:\programdata\0466116.reg
c:\programdata\1280261.bat
c:\programdata\1280261.pad
c:\programdata\1280261.reg
c:\users\Katharina\6116640.dll
c:\windows\SysWow64\DEBUG.log
.
c:\windows\system32\drivers\null.sys fehlte
Kopie von - c:\combofix\HarddiskVolumeShadowCopy2_!Windows!System32!drivers!null.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\afd.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21887_none_364f3a028e605345\afd.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\ndis.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-ndis_31bf3856ad364e35_6.1.7601.17939_none_05dc9a6832ba428a\ndis.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\ndisuio.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-ndisuio_31bf3856ad364e35_6.1.7601.17514_none_ca170d32fd7da822\ndisuio.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\netbios.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-netbios_31bf3856ad364e35_6.1.7600.16385_none_b5d6a9d184d05567\netbios.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\usbehci.sys fehlte
Kopie von - c:\windows\winsxs\amd64_usbport.inf_31bf3856ad364e35_6.1.7600.20934_none_1a7606b53634947e\usbehci.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\intelppm.sys fehlte
Kopie von - c:\windows\winsxs\amd64_cpu.inf_31bf3856ad364e35_6.1.7600.16385_none_b93f4c460912265a\intelppm.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\tcpip.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.1.7601.18148_none_11278ac57d1aa96b\tcpip.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\netbt.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-netbt_31bf3856ad364e35_6.1.7601.17514_none_be8acdd10de3b1a6\netbt.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\asyncmac.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-rasbase-asyncmac_31bf3856ad364e35_6.1.7600.16385_none_804cc08a4e8a4516\asyncmac.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\cdrom.sys fehlte
Kopie von - c:\windows\winsxs\amd64_cdrom.inf_31bf3856ad364e35_6.1.7601.17514_none_bdcf6151ba66f48b\cdrom.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\Serial.sys fehlte
Kopie von - c:\windows\winsxs\amd64_msports.inf_31bf3856ad364e35_6.1.7600.16385_none_548ca258d20f4ada\serial.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\ndproxy.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-rasbase_31bf3856ad364e35_6.1.7601.17514_none_6c066d50910ecf5a\ndproxy.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\ws2ifsl.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\i8042prt.sys fehlte
Kopie von - c:\windows\winsxs\amd64_keyboard.inf_31bf3856ad364e35_6.1.7600.16385_none_f3435f7ff2a9f325\i8042prt.sys wurde wiederhergestellt
.
c:\windows\system32\drivers\tdx.sys fehlte
Kopie von - c:\windows\winsxs\amd64_microsoft-windows-tdi-over-tcpip_31bf3856ad364e35_6.1.7601.17514_none_4863cdbaf2b532f8\tdx.sys wurde wiederhergestellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-07-03 bis 2013-08-03 ))))))))))))))))))))))))))))))
.
.
2013-08-03 09:40 . 2009-07-13 23:19 62464 ----a-w- c:\windows\SysWow64\drivers\intelppm.sys
2013-08-03 09:40 . 2011-03-29 03:32 52224 ----a-w- c:\windows\SysWow64\drivers\usbehci.sys
2013-08-03 09:40 . 2009-07-14 00:09 44544 ----a-w- c:\windows\SysWow64\drivers\netbios.sys
2013-08-03 09:40 . 2010-11-20 10:50 56832 ----a-w- c:\windows\SysWow64\drivers\ndisuio.sys
2013-08-03 09:40 . 2012-08-22 18:12 950128 ----a-w- c:\windows\SysWow64\drivers\ndis.sys
2013-08-03 09:39 . 2011-12-28 04:01 498176 ----a-w- c:\windows\SysWow64\drivers\afd.sys
2013-08-03 09:38 . 2009-07-13 23:19 6144 ----a-w- c:\windows\SysWow64\drivers\null.sys
2013-08-02 21:30 . 2013-08-02 21:30 -------- d-----w- C:\FRST
2013-08-02 20:39 . 2010-11-20 13:24 345088 ----a-w- c:\windows\system32\Utilman.exe
2013-08-02 20:16 . 2013-08-02 21:29 -------- d-----w- c:\users\Administrator
2013-07-16 16:40 . 2013-08-03 06:04 -------- d-----r- C:\Sandbox
2013-07-15 17:28 . 2013-07-15 17:28 -------- d-----w- c:\users\Katharina\AppData\Roaming\TeamViewer
2013-07-14 12:50 . 2013-07-14 12:50 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8838DC1-B6D5-422B-9D76-0C899E107C1F}\offreg.dll
2013-07-12 21:18 . 2013-06-17 00:10 9552976 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{F8838DC1-B6D5-422B-9D76-0C899E107C1F}\mpengine.dll
2013-07-12 21:18 . 2013-05-02 00:06 278800 ----a-w- c:\windows\system32\MpSigStub.exe
2013-07-12 21:16 . 2013-07-12 21:26 378944 ----a-w- c:\windows\system32\drivers\aswSP.sys
2013-07-12 21:16 . 2013-05-09 08:59 33400 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2013-07-12 21:16 . 2013-05-09 08:59 72016 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2013-07-12 21:16 . 2013-07-12 21:26 189936 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2013-07-12 21:16 . 2013-07-12 21:26 1030952 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2013-07-12 21:16 . 2013-05-09 08:59 65336 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2013-07-12 21:16 . 2013-05-09 08:59 64288 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2013-07-12 21:16 . 2013-05-09 08:59 80816 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2013-07-12 21:16 . 2013-05-09 08:58 287840 ----a-w- c:\windows\system32\aswBoot.exe
2013-07-12 21:15 . 2013-05-09 08:58 41664 ----a-w- c:\windows\avastSS.scr
2013-07-12 16:59 . 2013-07-12 16:59 -------- d-----w- c:\program files (x86)\TeamViewer
2013-07-12 16:52 . 2013-07-12 21:15 -------- d-----w- c:\programdata\AVAST Software
2013-07-11 14:33 . 2013-06-11 23:43 1767936 ----a-w- c:\windows\SysWow64\wininet.dll
2013-07-11 14:33 . 2013-06-11 23:26 2241024 ----a-w- c:\windows\system32\wininet.dll
2013-07-11 14:33 . 2013-06-11 23:25 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-07-11 14:33 . 2013-06-11 23:25 15404032 ----a-w- c:\windows\system32\ieframe.dll
2013-07-11 14:33 . 2013-06-11 23:25 19238912 ----a-w- c:\windows\system32\mshtml.dll
2013-07-11 12:17 . 2013-05-27 04:57 4608 ----a-w- c:\program files (x86)\Windows Defender\MsMpLics.dll
2013-07-11 12:17 . 2013-05-27 04:57 54784 ----a-w- c:\program files (x86)\Windows Defender\MpOAV.dll
2013-07-11 12:17 . 2013-05-27 04:57 392704 ----a-w- c:\program files (x86)\Windows Defender\MpClient.dll
2013-07-11 12:17 . 2013-05-27 03:15 9216 ----a-w- c:\program files (x86)\Windows Defender\MpAsDesc.dll
2013-07-11 12:17 . 2013-06-04 06:00 624128 ----a-w- c:\windows\system32\qedit.dll
2013-07-11 12:17 . 2013-06-04 04:53 509440 ----a-w- c:\windows\SysWow64\qedit.dll
2013-07-11 12:17 . 2013-05-06 06:03 1887744 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-07-11 12:17 . 2013-05-06 04:56 1620480 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-07-11 12:17 . 2013-06-05 03:34 3153920 ----a-w- c:\windows\system32\win32k.sys
2013-07-11 12:17 . 2013-04-10 05:03 936448 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2013-07-11 12:17 . 2013-04-09 23:34 1247744 ----a-w- c:\windows\SysWow64\DWrite.dll
2013-07-11 12:17 . 2013-04-02 22:51 1643520 ----a-w- c:\windows\system32\DWrite.dll
2013-07-11 11:54 . 2013-07-11 11:55 -------- d-----w- c:\users\Gast
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-07-15 17:39 . 2012-11-12 19:09 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-15 17:39 . 2012-11-12 19:09 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-05-18 21:39 . 2010-06-24 18:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-13 05:51 . 2013-06-12 13:33 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-05-13 05:51 . 2013-06-12 13:33 1464320 ----a-w- c:\windows\system32\crypt32.dll
2013-05-13 05:51 . 2013-06-12 13:33 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-05-13 05:50 . 2013-06-12 13:33 52224 ----a-w- c:\windows\system32\certenc.dll
2013-05-13 04:45 . 2013-06-12 13:33 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-05-13 04:45 . 2013-06-12 13:33 1160192 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-05-13 04:45 . 2013-06-12 13:33 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-05-13 03:43 . 2013-06-12 13:33 1192448 ----a-w- c:\windows\system32\certutil.exe
2013-05-13 03:08 . 2013-06-12 13:33 903168 ----a-w- c:\windows\SysWow64\certutil.exe
2013-05-13 03:08 . 2013-06-12 13:33 43008 ----a-w- c:\windows\SysWow64\certenc.dll
2013-05-10 05:49 . 2013-06-12 13:35 30720 ----a-w- c:\windows\system32\cryptdlg.dll
2013-05-10 03:20 . 2013-06-12 13:35 24576 ----a-w- c:\windows\SysWow64\cryptdlg.dll
2013-05-08 06:39 . 2013-06-12 13:35 1910632 ----a-w- c:\windows\system32\drivers\tcpip.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files (x86)\Windows Sidebar\Sidebar.exe" [2010-11-20 1174016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2011-01-28 299576]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"HP HD Webcam [Fixed]_Monitor"="c:\program files (x86)\HP HD Webcam [Fixed]\monitor.exe" [2010-11-26 11:31 267128]
"DTRun"="c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2010-11-24 517456]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-04-05 94264]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-02-11 76344]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-06 1564872]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"PROFIS AutoUpdate"="c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe" [2011-11-02 474112]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP]
2011-02-03 22:09 75360 ----a-w- c:\windows\System32\DeviceNP.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ DPPassFilter scecli
.
R0 aswRvrt;aswRvrt; [x]
R0 aswVmm;aswVmm; [x]
R1 aswSnx;aswSnx; [x]
R1 aswSP;aswSP; [x]
R2 AESTFilters;Andrea ST Filters Service;c:\program files\IDT\WDM\AESTSr64.exe;c:\program files\IDT\WDM\AESTSr64.exe [x]
R2 aksdf;aksdf;c:\windows\system32\drivers\aksdf.sys;c:\windows\SYSNATIVE\drivers\aksdf.sys [x]
R2 aswFsBlk;aswFsBlk; [x]
R2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
R2 Atheros Bt&Wlan Coex Agent;Atheros Bt&Wlan Coex Agent;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe;c:\program files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [x]
R2 AtherosSvc;AtherosSvc;c:\program files (x86)\Bluetooth Suite\adminservice.exe;c:\program files (x86)\Bluetooth Suite\adminservice.exe [x]
R2 Autodesk Content Service;Autodesk Content Service;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe;c:\program files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [x]
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\BBSvc.exe [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 gupdate;Google Update-Dienst (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R2 hasplms;Sentinel Local License Manager;c:\windows\system32\hasplms.exe -run;c:\windows\SYSNATIVE\hasplms.exe -run [x]
R2 Hilti PROFIS AutoUpdate Service;Hilti PROFIS AutoUpdate Service;c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe;c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [x]
R2 HP Power Assistant Service;HP Power Assistant Service;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe;c:\program files\Hewlett-Packard\HP Power Assistant\HPPA_Service.exe [x]
R2 HPDayStarterService;HP DayStarter Service;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe;c:\program files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [x]
R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe;c:\program files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [x]
R2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe;c:\program files (x86)\Hewlett-Packard\File Sanitizer\HPFSService.exe [x]
R2 hpHotkeyMonitor;hpHotkeyMonitor;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe;c:\program files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [x]
R2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
R2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
R2 McAfee Endpoint Encryption Agent;McAfee Endpoint Encryption Agent;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe;c:\program files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [x]
R2 pdfcDispatcher;PDF Document Manager;c:\program files (x86)\PDF Complete\pdfsvc.exe;c:\program files (x86)\PDF Complete\pdfsvc.exe [x]
R2 PdiService;Portrait Displays SDK Service;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe;c:\program files (x86)\Common Files\Portrait Displays\Drivers\pdisrvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 TeamViewer8;TeamViewer 8;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe;c:\program files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [x]
R2 uArcCapture;ArcCapture;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe;c:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [x]
R2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
R2 vcsFPService;Validity VCS Fingerprint Service;c:\windows\system32\vcsFPService.exe;c:\windows\SYSNATIVE\vcsFPService.exe [x]
R2 XobniService;XobniService;c:\program files (x86)\Xobni\XobniService.exe;c:\program files (x86)\Xobni\XobniService.exe [x]
R3 ARCVCAM;ARCVCAM, ArcSoft Webcam Sharing Manager Driver;c:\windows\system32\DRIVERS\ArcSoftVCapture.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftVCapture.sys [x]
R3 AthBTPort;Atheros Virtual Bluetooth Class;c:\windows\system32\DRIVERS\btath_flt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_flt.sys [x]
R3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe;c:\program files (x86)\Microsoft\BingBar\7.1.361.0\SeaPort.exe [x]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;c:\windows\system32\drivers\btath_a2dp.sys;c:\windows\SYSNATIVE\drivers\btath_a2dp.sys [x]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;c:\windows\system32\DRIVERS\btath_hcrp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_hcrp.sys [x]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;c:\windows\system32\DRIVERS\btath_lwflt.sys;c:\windows\SYSNATIVE\DRIVERS\btath_lwflt.sys [x]
R3 BTATH_RCP;Bluetooth AVRCP Device;c:\windows\system32\DRIVERS\btath_rcp.sys;c:\windows\SYSNATIVE\DRIVERS\btath_rcp.sys [x]
R3 BtFilter;BtFilter;c:\windows\system32\DRIVERS\btfilter.sys;c:\windows\SYSNATIVE\DRIVERS\btfilter.sys [x]
R3 DAMDrv;DAMDrv;c:\windows\system32\DRIVERS\DAMDrv64.sys;c:\windows\SYSNATIVE\DRIVERS\DAMDrv64.sys [x]
R3 dc3d;MS Hardware Device Detection Driver (USB);c:\windows\system32\DRIVERS\dc3d.sys;c:\windows\SYSNATIVE\DRIVERS\dc3d.sys [x]
R3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;c:\windows\SysWOW64\flcdlock.exe;c:\windows\SysWOW64\flcdlock.exe [x]
R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe;c:\program files (x86)\Google\Update\GoogleUpdate.exe [x]
R3 HMXProjExt64;HMXProjExt64;c:\windows\system32\DRIVERS\HMXExGrp64.sys;c:\windows\SYSNATIVE\DRIVERS\HMXExGrp64.sys [x]
R3 HMXProjMir64;HMXProjMir64;c:\windows\system32\DRIVERS\HMXMrGrp64.sys;c:\windows\SYSNATIVE\DRIVERS\HMXMrGrp64.sys [x]
R3 HP ProtectTools Service;HP ProtectTools Service;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe;c:\program files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [x]
R3 hpCMSrv;HP Connection Manager 4 Service;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe;c:\program files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe [x]
R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
R3 JMCR;JMCR;c:\windows\system32\DRIVERS\jmcr.sys;c:\windows\SYSNATIVE\DRIVERS\jmcr.sys [x]
R3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\DRIVERS\netaapl64.sys;c:\windows\SYSNATIVE\DRIVERS\netaapl64.sys [x]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
R3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
S0 MfeEpePc;MfeEpePc; [x]
S3 BTATH_BUS;Atheros Bluetooth Bus;c:\windows\system32\DRIVERS\btath_bus.sys;c:\windows\SYSNATIVE\DRIVERS\btath_bus.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-07-13 11:59 1173456 ----a-w- c:\program files (x86)\Google\Chrome\Application\28.0.1500.72\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-08-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-12 17:39]
.
2013-07-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job
- c:\users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-17 15:43]
.
2013-07-14 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job
- c:\users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-04-17 15:43]
.
2013-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17 16:24]
.
2013-07-15 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17 16:24]
.
2013-06-18 c:\windows\Tasks\HPCeeScheduleForKATHARINA-HP$.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
2013-07-07 c:\windows\Tasks\HPCeeScheduleForKatharina.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14 05:15]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PDF Complete"="c:\program files (x86)\PDF Complete\pdfsty.exe" [2011-02-01 656920]
"QLBController"="c:\program files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe" [2011-01-28 299576]
"File Sanitizer"="c:\program files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2011-02-07 12274688]
"IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-01-26 283160]
"HP HD Webcam [Fixed]_Monitor"="c:\program files (x86)\HP HD Webcam [Fixed]\monitor.exe" [2010-11-26 11:31 267128]
"DTRun"="c:\program files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe" [2010-11-24 517456]
"HPConnectionManager"="c:\program files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe" [2011-04-05 94264]
"HPQuickWebProxy"="c:\program files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe" [2011-02-11 76344]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-21 59720]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"ApnUpdater"="c:\program files (x86)\Ask.com\Updater\Updater.exe" [2012-06-06 1564872]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"PROFIS AutoUpdate"="c:\program files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe" [2011-11-02 474112]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-05-15 152392]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968]
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
NETSVCS BENÖTIGT REPARATUR - Derzeitig vorhandene Einträge:
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
AudioSrv
FastUserSwitchingCompatibility
Ias
Irmon
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
SENS
Sharedaccess
SRService
Tapisrv
Wmi
WmdmPmSp
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
msiscsi
schedule
SessionEnv
winmgmt
AppMgmt
.
Rebuilding ... You need to reboot your machine for this to take effect.
.
AppInfo
browser
EapHost
hkmsvc
IKEEXT
MMCSS
ProfSvc
seclogon
Themes
wercplsupport
BDESVC
.
------- Zusätzlicher Suchlauf -------
.
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.0.1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKU-Default-RunOnce-SPReview - c:\windows\System32\SPReview\SPReview.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-{E02FBF01-0DE3-4BCB-89E8-D300FEFC3289} - c:\program files (x86)\InstallShield Installation Information\{E02FBF01-0DE3-4BCB-89E8-D300FEFC3289}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\pdfcDispatcher]
"ImagePath"="c:\program files (x86)\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\system32\\Macromed\\Flash\\FlashUtil64_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_8_800_94_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_8_800_94.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2013-08-03 11:51:07 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2013-08-03 09:51
.
Vor Suchlauf: 14 Verzeichnis(se), 56.923.389.952 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 72.523.407.360 Bytes frei
.
- - End Of File - - EC160E0D1436A26C65AFE897193A9DC0
D41D8CD98F00B204E9800998ECF8427E
Windows war im abgesicherten Modus gestartet. Gruß, pflanz. |
|
04.08.2013, 09:23
| #4 |
| /// the machine /// TB-Ausbilder | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Downloade Dir bitte  AdwCleaner auf deinen Desktop.
Downloade Dir bitte  Malwarebytes Anti-Malware
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.08.2013, 10:28
| #5 |
| | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Hallo Schrauber, danke für die schnelle Unterstützung sogar am Wochenende!! Eine Frage: Glaubst du ist das Problem mit dem RPC-Server durch Entfernen der Viren gelöst oder hat das System sonst einen Schaden? Ich komme nämlich nicht in den normalen Modus. Habe auch diese Tests nun im Abgesicherten Modus ausgeführt (MBAM natürlich mit Netzwerktreibern). Frage mich nämlich auch ob man ihn nicht überhaupt komplett neu aufsetzen sollte? Oder kriegen wir das mit der Bereinigung hin? Danke schon im Voraus!! Hier die gewünschten LOGS: AdwCleaner: Code:
ATTFilter # AdwCleaner v2.306 - Datei am 04/08/2013 um 11:08:26 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzer : Administrator - KATHARINA-HP
# Bootmodus : Abgesicherter Modus
# Ausgeführt unter : C:\Users\Administrator\Desktop\adwcleaner.exe
# Option [Löschen]
**** [Dienste] ****
***** [Dateien / Ordner] *****
Ordner Gelöscht : C:\Program Files (x86)\Ask.com
Ordner Gelöscht : C:\ProgramData\Ask
Ordner Gelöscht : C:\Users\Gast\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Katharina\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\Users\Potti\AppData\LocalLow\AskToolbar
Ordner Gelöscht : C:\windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
***** [Registrierungsdatenbank] *****
Schlüssel Gelöscht : HKLM\Software\APN
Schlüssel Gelöscht : HKLM\Software\AskToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\Software\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
***** [Internet Browser] *****
-\\ Internet Explorer v10.0.9200.16635
[OK] Die Registrierungsdatenbank ist sauber.
*************************
AdwCleaner[S1].txt - [3083 octets] - [04/08/2013 11:08:26]
########## EOF - C:\AdwCleaner[S1].txt - [3143 octets] ##########
Code:
ATTFilter Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.04.01 Windows 7 Service Pack 1 x64 NTFS (Abgesichertenmodus/Netzwerkfähig) Internet Explorer 10.0.9200.16635 Administrator :: KATHARINA-HP [Administrator] 04.08.2013 11:15:31 mbam-log-2013-08-04 (11-15-31).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 294824 Laufzeit: 4 Minute(n), 1 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013 Ran by Administrator (administrator) on 04-08-2013 11:23:17 Running from C:\Users\Administrator\Desktop Windows 7 Professional Service Pack 1 (X64) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Safe Mode (with Networking) ==================== Processes (Whitelisted) ================= (DigitalPersona, Inc.) c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HPPowerAssistant] - C:\Program Files\Hewlett-Packard\HP Power Assistant\HPPA_Main.exe [2919992 2011-01-27] (Hewlett-Packard Company) HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-04] (Synaptics Incorporated) HKLM\...\Run: [AtherosBtStack] - C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [615584 2011-01-07] (Atheros Communications) HKLM\...\Run: [AthBtTray] - C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe [379040 2011-01-07] (Atheros Commnucations) HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [835072 2011-01-27] (IDT, Inc.) HKLM\...\Run: [MfeEpePcMonitor] - C:\Program Files\Hewlett-Packard\Drive Encryption\EpePcMonitor.exe [200704 2011-02-09] () HKLM\...\Run: [XeroxScanUtility] - C:\Program Files\Xerox\Scan_Utility\xrxzipui.exe [2371072 2010-02-10] (Xerox Corporation) HKLM\...\Run: [XeroxEndeavorBackgroundTask] - C:\windows\system32\xgchabgnd.exe [102912 2009-11-02] () HKLM\...\Run: [combofix] - C:\ComboFix\CF5585.3XE /c C:\ComboFix\Combobatch.bat [x] HKLM\...\Runonce: [combofix] - C:\ComboFix\CF5585.3XE /c C:\ComboFixCombobatch.bat [x] HKLM-x32\...\RunOnce: [ Malwarebytes Anti-Malware ] - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent [532040 2013-04-04] (Malwarebytes Corporation) HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,c:\Program Files (x86)\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DPAgent.exe, HKCU\...\RunOnce: [Report] - C:\AdwCleaner[S1].txt [3200 2013-08-04] () HKLM-x32\...\Run: [PDF Complete] - C:\Program Files (x86)\PDF Complete\pdfsty.exe [656920 2011-02-01] (PDF Complete Inc) HKLM-x32\...\Run: [QLBController] - C:\Program Files (x86)\Hewlett-Packard\HP HotKey Support\QLBController.exe [299576 2011-01-29] (Hewlett-Packard Company) HKLM-x32\...\Run: [File Sanitizer] - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\CoreShredder.exe [12274688 2011-02-07] (Hewlett-Packard) HKLM-x32\...\Run: [IAStorIcon] - C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [283160 2011-01-26] (Intel Corporation) HKLM-x32\...\Run: [HP HD Webcam [Fixed]_Monitor] - C:\Program Files (x86)\HP HD Webcam [Fixed]\monitor.exe [267128 2010-11-26] () HKLM-x32\...\Run: [DTRun] - c:\Program Files (x86)\ArcSoft\TotalMedia Suite\TotalMedia Theatre 3\uDTRun.exe [517456 2010-11-24] (ArcSoft Inc.) HKLM-x32\...\Run: [HPConnectionManager] - c:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-04-05] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [HPQuickWebProxy] - c:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe [76344 2011-02-11] (Hewlett-Packard Company) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [PROFIS AutoUpdate] - C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Tray.exe [474112 2011-11-02] (Agito d.o.o.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-15] (Apple Inc.) HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) Lsa: [Notification Packages] DPPassFilter scecli Startup: C:\Users\Katharina\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk ShortcutTarget: Facebook Messenger.lnk -> C:\Users\Administrator\AppData\Local\Facebook\Messenger\2.1.4814.0\FacebookMessenger.exe (No File) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/HPCOM/4 HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = hxxp://g.uk.msn.com/HPCOM/4 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: File Sanitizer for HP ProtectTools - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files (x86)\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard) BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/AT/Core/Player/2020PlayerAX_IKEA_Win32.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 10.0.0.138 ==================== Services (Whitelisted) ================= S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) S2 Atheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [138400 2011-01-07] (Atheros) S2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [18656 2011-02-02] () S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) S2 DpHost; c:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\Bin\DpHostW.exe [481104 2011-02-12] (DigitalPersona, Inc.) S3 FLCDLOCK; c:\Windows\SysWOW64\flcdlock.exe [464480 2011-02-04] (Hewlett-Packard Company) S2 hasplms; C:\windows\system32\hasplms.exe [4889032 2011-12-30] (SafeNet Inc.) S2 Hilti PROFIS AutoUpdate Service; C:\Program Files (x86)\Hilti\PROFIS AutoUpdate\Hilti.AutoUpdate.Service.exe [206336 2011-11-02] (Agito d.o.o.) S3 HP ProtectTools Service; c:\Program Files (x86)\Hewlett-Packard\2009 Password Filter for HP ProtectTools\PTChangeFilterService.exe [36864 2011-01-12] (Hewlett-Packard Development Company, L.P) S2 HPDayStarterService; c:\Program Files\Hewlett-Packard\HP DayStarter\32-bit\HPDayStarterService.exe [133688 2011-01-28] (Hewlett-Packard Company) S2 hpHotkeyMonitor; C:\Program Files (x86)\Hewlett-Packard\HP Hotkey Support\HpHotkeyMonitor.exe [281656 2011-01-29] (Hewlett-Packard Company) S2 McAfee Endpoint Encryption Agent; C:\Program Files\Hewlett-Packard\Drive Encryption\EEAgent\MfeEpeHost.exe [1318912 2011-02-09] () S2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1127448 2011-02-01] (PDF Complete Inc) S2 uArcCapture; C:\windows\SysWow64\ArcVCapRender\uArcCapture.exe [502464 2010-11-11] (ArcSoft, Inc.) S2 XobniService; C:\Program Files (x86)\Xobni\XobniService.exe [62184 2011-03-07] (Xobni Corporation) S2 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [x] ==================== Drivers (Whitelisted) ==================== S3 ARCVCAM; C:\Windows\System32\DRIVERS\ArcSoftVCapture.sys [32192 2010-11-11] (ArcSoft, Inc.) S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) S2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-07-12] (AVAST Software) S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-07-12] (AVAST Software) S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-07-12] () S3 DAMDrv; C:\Windows\System32\DRIVERS\DAMDrv64.sys [63336 2011-02-07] (Hewlett-Packard Company) S2 hardlock; C:\windows\system32\drivers\hardlock.sys [321536 2011-09-28] (SafeNet Inc.) R0 MfeEpePc; C:\Windows\System32\Drivers\MfeEpePc.sys [168008 2011-02-09] (McAfee, Inc.) S3 mod7700; C:\Windows\System32\DRIVERS\dvb7700all.sys [865344 2009-11-02] (DiBcom) S3 SPUVCbv; C:\Windows\System32\Drivers\SPUVCbv_x64.sys [2611704 2011-01-12] (Sunplus Technology) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 HMXProjExt64; system32\DRIVERS\HMXExGrp64.sys [x] S3 HMXProjMir64; system32\DRIVERS\HMXMrGrp64.sys [x] ==================== NetSvcs (Whitelisted) =================== NETSVCx32: AppInfo -> C:\Windows\SysWOW64\appinfo.dll ==> No File. NETSVCx32: browser -> C:\Windows\SysWOW64\browser.dll ==> No File. NETSVCx32: EapHost -> C:\Windows\SysWOW64\eapsvc.dll ==> No File. NETSVCx32: hkmsvc -> C:\Windows\SysWOW64\kmsvc.dll ==> No File. NETSVCx32: IKEEXT -> C:\Windows\SysWOW64\ikeext.dll ==> No File. NETSVCx32: MMCSS -> C:\Windows\SysWOW64\mmcss.dll ==> No File. NETSVCx32: ProfSvc -> C:\Windows\SysWOW64\profsvc.dll ==> No File. NETSVCx32: seclogon -> %windir%\SysWOW64\seclogon.dll ==> No File. NETSVCx32: wercplsupport -> C:\Windows\SysWOW64\wercplsupport.dll ==> No File. NETSVCx32: BDESVC -> C:\Windows\SysWOW64\bdesvc.dll ==> No File. ==================== One Month Created Files and Folders ======== 2013-08-04 11:14 - 2013-08-04 11:14 - 00001105 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes 2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-08-04 11:14 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-08-04 11:08 - 2013-08-04 11:08 - 00003200 _____ C:\AdwCleaner[S1].txt 2013-08-04 11:07 - 2013-08-04 11:03 - 00666633 _____ C:\Users\Administrator\Desktop\adwcleaner.exe 2013-08-03 22:41 - 2013-08-04 00:31 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0 2013-08-03 11:51 - 2013-08-03 11:51 - 00030922 _____ C:\ComboFix.txt 2013-08-03 11:41 - 2013-05-08 08:39 - 01910632 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\tcpip.sys 2013-08-03 11:41 - 2010-11-20 12:52 - 00057856 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ndproxy.sys 2013-08-03 11:41 - 2010-11-20 11:23 - 00261632 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\netbt.sys 2013-08-03 11:41 - 2010-11-20 11:21 - 00119296 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\tdx.sys 2013-08-03 11:41 - 2010-11-20 11:19 - 00147456 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\cdrom.sys 2013-08-03 11:41 - 2009-07-14 02:10 - 00023040 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\asyncmac.sys 2013-08-03 11:41 - 2009-07-14 02:10 - 00021504 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ws2ifsl.sys 2013-08-03 11:41 - 2009-07-14 02:00 - 00094208 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\Serial.sys 2013-08-03 11:41 - 2009-07-14 01:19 - 00105472 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\i8042prt.sys 2013-08-03 11:40 - 2012-08-22 20:12 - 00950128 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ndis.sys 2013-08-03 11:40 - 2011-03-29 05:32 - 00052224 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\usbehci.sys 2013-08-03 11:40 - 2010-11-20 12:50 - 00056832 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\ndisuio.sys 2013-08-03 11:40 - 2009-07-14 02:09 - 00044544 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\netbios.sys 2013-08-03 11:40 - 2009-07-14 01:19 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\intelppm.sys 2013-08-03 11:39 - 2011-12-28 06:01 - 00498176 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\afd.sys 2013-08-03 11:38 - 2009-07-14 01:19 - 00006144 _____ (Microsoft Corporation) C:\windows\SysWOW64\Drivers\null.sys 2013-08-03 11:28 - 2011-06-26 08:45 - 00256000 _____ C:\windows\PEV.exe 2013-08-03 11:28 - 2010-11-07 19:20 - 00208896 _____ C:\windows\MBR.exe 2013-08-03 11:28 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2013-08-03 11:28 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2013-08-03 11:28 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2013-08-03 11:28 - 2000-08-31 02:00 - 00098816 _____ C:\windows\sed.exe 2013-08-03 11:28 - 2000-08-31 02:00 - 00080412 _____ C:\windows\grep.exe 2013-08-03 11:28 - 2000-08-31 02:00 - 00068096 _____ C:\windows\zip.exe 2013-08-03 11:25 - 2013-08-03 11:51 - 00000000 ____D C:\Qoobox 2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-08-03 11:24 - 2013-08-03 11:49 - 00000000 ____D C:\windows\erdnt 2013-08-03 11:24 - 2013-08-03 11:19 - 05097855 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe 2013-08-02 23:36 - 2013-08-02 23:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe 2013-08-02 23:30 - 2013-08-02 23:30 - 00000000 ____D C:\FRST 2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable 2013-08-02 23:29 - 2013-08-02 23:26 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe 2013-08-02 23:29 - 2013-08-02 23:26 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe 2013-08-02 23:29 - 2013-08-02 23:24 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe 2013-08-02 23:29 - 2013-08-02 23:24 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe 2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT 2013-08-02 22:39 - 2010-11-20 15:24 - 00345088 _____ (Microsoft Corporation) C:\windows\system32\Utilman.exe 2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html 2013-08-02 22:30 - 2013-08-03 19:00 - 00046805 _____ C:\acadminidump.dmp 2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH 2013-08-02 22:16 - 2013-08-02 23:29 - 00000000 ____D C:\Users\Administrator 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten 2013-08-02 22:16 - 2011-10-17 22:49 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Microsoft Help 2013-08-02 22:16 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Administrator\ntuser.ini 2013-08-02 22:16 - 2009-07-14 06:54 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2013-08-02 22:16 - 2009-07-14 06:49 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2013-07-16 18:40 - 2013-08-03 08:04 - 00000000 ___RD C:\Sandbox 2013-07-16 18:39 - 2013-08-03 08:04 - 00000000 ____D C:\Program Files\Sandboxie 2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer 2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum 2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum 2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum 2013-07-12 23:18 - 2013-05-02 02:06 - 00278800 _____ (Microsoft Corporation) C:\windows\system32\MpSigStub.exe 2013-07-12 23:16 - 2013-08-02 22:08 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update 2013-07-12 23:16 - 2013-08-02 22:08 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2013-07-12 23:16 - 2013-08-02 22:08 - 00000000 _____ C:\windows\SysWOW64\config.nt 2013-07-12 23:16 - 2013-07-12 23:26 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys 2013-07-12 23:16 - 2013-07-12 23:26 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys 2013-07-12 23:16 - 2013-07-12 23:26 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys 2013-07-12 23:16 - 2013-05-09 10:59 - 00080816 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys 2013-07-12 23:16 - 2013-05-09 10:59 - 00072016 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys 2013-07-12 23:16 - 2013-05-09 10:59 - 00065336 _____ C:\windows\system32\Drivers\aswRvrt.sys 2013-07-12 23:16 - 2013-05-09 10:59 - 00064288 _____ (AVAST Software) C:\windows\system32\Drivers\aswTdi.sys 2013-07-12 23:16 - 2013-05-09 10:59 - 00033400 _____ (AVAST Software) C:\windows\system32\Drivers\aswFsBlk.sys 2013-07-12 23:16 - 2013-05-09 10:58 - 00287840 _____ (AVAST Software) C:\windows\system32\aswBoot.exe 2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software 2013-07-12 23:15 - 2013-05-09 10:58 - 00041664 _____ (AVAST Software) C:\windows\avastSS.scr 2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk 2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer 2013-07-12 18:52 - 2013-07-12 23:15 - 00000000 ____D C:\ProgramData\AVAST Software 2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log 2013-07-11 16:34 - 2013-06-12 01:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-07-11 16:34 - 2013-06-12 01:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-07-11 16:34 - 2013-06-12 01:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-07-11 16:34 - 2013-06-12 01:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-07-11 16:34 - 2013-06-12 01:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-07-11 16:34 - 2013-06-12 01:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-07-11 16:34 - 2013-06-12 01:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-07-11 16:34 - 2013-06-12 01:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-07-11 16:34 - 2013-06-12 01:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-07-11 16:34 - 2013-06-12 01:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-07-11 16:34 - 2013-06-12 01:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-07-11 16:34 - 2013-06-12 01:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-07-11 16:34 - 2013-06-12 01:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-07-11 16:34 - 2013-06-12 00:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-11 16:34 - 2013-06-12 00:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-07-11 16:34 - 2013-06-07 05:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-07-11 16:34 - 2013-06-07 04:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-07-11 16:33 - 2013-06-12 01:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-07-11 16:33 - 2013-06-12 01:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-07-11 16:33 - 2013-06-12 01:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-07-11 16:33 - 2013-06-12 01:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-07-11 16:33 - 2013-06-12 01:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-07-11 16:33 - 2013-06-12 01:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-07-11 16:33 - 2013-06-12 01:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-07-11 16:33 - 2013-06-12 01:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika 2013-07-11 14:17 - 2013-06-05 05:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-07-11 14:17 - 2013-06-04 08:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll 2013-07-11 14:17 - 2013-06-04 06:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll 2013-07-11 14:17 - 2013-05-06 08:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL 2013-07-11 14:17 - 2013-05-06 06:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL 2013-07-11 14:17 - 2013-04-10 01:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll 2013-07-11 14:17 - 2013-04-03 00:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll 2013-07-11 13:56 - 2013-07-11 14:05 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder 2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer 2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines 2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics 2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe 2013-07-11 13:54 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona 2013-07-11 13:54 - 2011-10-17 22:49 - 00000000 ____D C:\Users\Gast\AppData\Local\Microsoft Help 2013-07-11 13:54 - 2009-07-27 16:09 - 00000020 ___SH C:\Users\Gast\ntuser.ini ==================== One Month Modified Files and Folders ======= 2013-08-04 11:14 - 2013-08-04 11:14 - 00001105 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk 2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Malwarebytes 2013-08-04 11:14 - 2013-08-04 11:14 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-08-04 11:08 - 2013-08-04 11:08 - 00003200 _____ C:\AdwCleaner[S1].txt 2013-08-04 11:03 - 2013-08-04 11:07 - 00666633 _____ C:\Users\Administrator\Desktop\adwcleaner.exe 2013-08-04 00:31 - 2013-08-03 22:41 - 00000000 ____D C:\Kaspersky Rescue Disk 10.0 2013-08-03 19:00 - 2013-08-02 22:30 - 00046805 _____ C:\acadminidump.dmp 2013-08-03 15:12 - 2011-06-21 02:48 - 00000000 ____D C:\ProgramData\PDFC 2013-08-03 15:12 - 2011-06-21 02:45 - 00000000 ____D C:\ProgramData\HPQLOG 2013-08-03 15:10 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-08-03 15:10 - 2009-07-14 06:51 - 00117007 _____ C:\windows\setupact.log 2013-08-03 11:51 - 2013-08-03 11:51 - 00030922 _____ C:\ComboFix.txt 2013-08-03 11:51 - 2013-08-03 11:25 - 00000000 ____D C:\Qoobox 2013-08-03 11:49 - 2013-08-03 11:24 - 00000000 ____D C:\windows\erdnt 2013-08-03 11:46 - 2009-07-14 04:34 - 00000215 _____ C:\windows\system.ini 2013-08-03 11:43 - 2011-08-30 19:27 - 00488512 _____ C:\windows\PFRO.log 2013-08-03 11:42 - 2009-07-14 04:34 - 93323264 _____ C:\windows\system32\config\software.bak 2013-08-03 11:42 - 2009-07-14 04:34 - 32243712 _____ C:\windows\system32\config\system.bak 2013-08-03 11:42 - 2009-07-14 04:34 - 00786432 _____ C:\windows\system32\config\default.bak 2013-08-03 11:42 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\security.bak 2013-08-03 11:42 - 2009-07-14 04:34 - 00262144 _____ C:\windows\system32\config\sam.bak 2013-08-03 11:37 - 2011-10-14 19:15 - 00000000 ____D C:\Users\Katharina 2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-08-03 11:25 - 2013-08-03 11:25 - 00000000 ___RD C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-08-03 11:19 - 2013-08-03 11:24 - 05097855 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe 2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iTunes 2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files\iPod 2013-08-03 08:05 - 2013-05-22 18:19 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-08-03 08:05 - 2012-04-29 21:00 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\vlc 2013-08-03 08:05 - 2011-11-28 21:36 - 00000000 ____D C:\ProgramData\Apple Computer 2013-08-03 08:05 - 2011-06-21 02:44 - 00000000 ____D C:\ProgramData\FLEXnet 2013-08-03 08:05 - 2009-07-14 05:20 - 00000000 ____D C:\windows\AppCompat 2013-08-03 08:04 - 2013-07-16 18:40 - 00000000 ___RD C:\Sandbox 2013-08-03 08:04 - 2013-07-16 18:39 - 00000000 ____D C:\Program Files\Sandboxie 2013-08-03 08:04 - 2009-07-14 05:20 - 00000000 ____D C:\windows\registration 2013-08-02 23:38 - 2011-08-30 19:01 - 01781084 _____ C:\windows\WindowsUpdate.log 2013-08-02 23:36 - 2013-08-02 23:36 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Adobe 2013-08-02 23:30 - 2013-08-02 23:30 - 00000000 ____D C:\FRST 2013-08-02 23:29 - 2013-08-02 23:29 - 00000000 _____ C:\Users\Administrator\defogger_reenable 2013-08-02 23:29 - 2013-08-02 22:16 - 00000000 ____D C:\Users\Administrator 2013-08-02 23:29 - 2011-06-21 02:34 - 00700168 _____ C:\windows\system32\perfh007.dat 2013-08-02 23:29 - 2011-06-21 02:34 - 00148964 _____ C:\windows\system32\perfc007.dat 2013-08-02 23:29 - 2009-07-14 07:13 - 01621244 _____ C:\windows\system32\PerfStringBackup.INI 2013-08-02 23:26 - 2013-08-02 23:29 - 01781485 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe 2013-08-02 23:26 - 2013-08-02 23:29 - 00377856 _____ C:\Users\Administrator\Desktop\gmer_2.1.19163.exe 2013-08-02 23:26 - 2013-08-02 23:26 - 00141312 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT 2013-08-02 23:24 - 2013-08-02 23:29 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Administrator\Desktop\mbam-setup-1.75.0.1300.exe 2013-08-02 23:24 - 2013-08-02 23:29 - 00050477 _____ C:\Users\Administrator\Desktop\Defogger.exe 2013-08-02 23:20 - 2012-10-15 11:51 - 00000000 ____D C:\Program Files (x86)\Pythagoras 2013-08-02 22:35 - 2013-08-02 22:35 - 00063958 _____ C:\Users\Potti\GPReport.html 2013-08-02 22:35 - 2013-03-15 22:13 - 00000000 ____D C:\Users\Potti 2013-08-02 22:33 - 2013-03-15 22:44 - 00141312 _____ C:\Users\Potti\AppData\Local\GDIPFONTCACHEV1.DAT 2013-08-02 22:29 - 2013-08-02 22:29 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Auer - Die Bausoftware GmbH 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Vorlagen 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Startmenü 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Netzwerkumgebung 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Lokale Einstellungen 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Eigene Dateien 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Druckumgebung 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Musik 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Documents\Eigene Bilder 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Start Menu\Programme 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\Administrator\Anwendungsdaten 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Verlauf 2013-08-02 22:16 - 2013-08-02 22:16 - 00000000 _SHDL C:\Users\ADMINI~1\AppData\Local\Anwendungsdaten 2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-02 22:11 - 2009-07-14 06:45 - 00020944 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-02 22:08 - 2013-07-12 23:16 - 00003924 _____ C:\windows\System32\Tasks\avast! Emergency Update 2013-08-02 22:08 - 2013-07-12 23:16 - 00001922 _____ C:\Users\Public\Desktop\avast! Free Antivirus.lnk 2013-08-02 22:08 - 2013-07-12 23:16 - 00000000 _____ C:\windows\SysWOW64\config.nt 2013-08-02 22:06 - 2013-01-01 12:26 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job 2013-07-28 23:46 - 2012-11-18 18:59 - 01070416 _____ C:\xxbgtask.log 2013-07-25 21:17 - 2011-10-15 09:43 - 00000000 ____D C:\Users\Katharina\AppData\Local\cache 2013-07-21 23:00 - 2011-11-10 19:34 - 00000000 ____D C:\Users\Katharina\Documents\Veldidena 2013-07-21 20:25 - 2011-11-10 16:55 - 00005934 _____ C:\Users\Katharina\Documents\plot.log 2013-07-15 19:59 - 2012-07-17 18:24 - 00001116 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-15 19:39 - 2013-01-01 12:26 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater 2013-07-15 19:39 - 2012-11-12 21:09 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-07-15 19:39 - 2012-11-12 21:09 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-07-15 19:28 - 2013-07-15 19:28 - 00000000 ____D C:\Users\Katharina\AppData\Roaming\TeamViewer 2013-07-15 19:27 - 2012-07-17 18:24 - 00001112 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-15 19:27 - 2011-10-20 10:56 - 00000035 _____ C:\Users\Public\Documents\AtherosServiceConfig.ini 2013-07-14 23:48 - 2012-04-17 17:38 - 00001154 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job 2013-07-14 17:48 - 2012-04-17 17:38 - 00001132 _____ C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job 2013-07-13 14:00 - 2012-09-20 20:22 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk 2013-07-13 13:54 - 2012-07-17 18:24 - 00004112 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2013-07-13 13:54 - 2012-07-17 18:24 - 00003860 _____ C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswVmm.sys.sum 2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSP.sys.sum 2013-07-12 23:26 - 2013-07-12 23:26 - 00000175 _____ C:\windows\system32\Drivers\aswSnx.sys.sum 2013-07-12 23:26 - 2013-07-12 23:16 - 01030952 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys 2013-07-12 23:26 - 2013-07-12 23:16 - 00378944 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys 2013-07-12 23:26 - 2013-07-12 23:16 - 00189936 _____ C:\windows\system32\Drivers\aswVmm.sys 2013-07-12 23:15 - 2013-07-12 23:15 - 00000000 ____D C:\Program Files\AVAST Software 2013-07-12 23:15 - 2013-07-12 18:52 - 00000000 ____D C:\ProgramData\AVAST Software 2013-07-12 23:02 - 2012-02-28 15:32 - 00000000 ____D C:\ProgramData\Electronic Arts 2013-07-12 22:58 - 2011-08-30 19:22 - 00000000 ____D C:\ProgramData\Norton 2013-07-12 22:54 - 2011-10-14 19:24 - 00141312 _____ C:\Users\Katharina\AppData\Local\GDIPFONTCACHEV1.DAT 2013-07-12 22:53 - 2009-07-14 06:45 - 00492616 _____ C:\windows\system32\FNTCACHE.DAT 2013-07-12 18:59 - 2013-07-12 18:59 - 00001162 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk 2013-07-12 18:59 - 2013-07-12 18:59 - 00000000 ____D C:\Program Files (x86)\TeamViewer 2013-07-12 18:42 - 2013-07-12 18:42 - 00000002 _____ C:\AvastSetup.log 2013-07-11 22:13 - 2009-07-14 07:08 - 00032640 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-11 22:11 - 2013-03-15 04:03 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-07-11 22:11 - 2009-07-27 16:36 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-11 22:11 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-11 16:35 - 2011-10-14 19:36 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-07-11 15:03 - 2013-07-11 15:03 - 00000000 ____D C:\Users\Katharina\Documents\Monika 2013-07-11 14:05 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\Documents\Bluetooth Folder 2013-07-11 13:56 - 2013-07-11 13:56 - 00141312 _____ C:\Users\Gast\AppData\Local\GDIPFONTCACHEV1.DAT 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Intel Corporation 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\hpqLog 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\HILTI 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Apple Computer 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\PDFC 2013-07-11 13:56 - 2013-07-11 13:56 - 00000000 ____D C:\Users\Gast\AppData\Local\BMExplorer 2013-07-11 13:56 - 2011-08-30 19:13 - 00000000 ____D C:\Users\Public\Documents\Atheros 2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ___RD C:\Users\Gast\Virtual Machines 2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Synaptics 2013-07-11 13:55 - 2013-07-11 13:55 - 00000000 ____D C:\Users\Gast\AppData\Roaming\Adobe 2013-07-11 13:55 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Vorlagen 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Startmenü 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Netzwerkumgebung 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Lokale Einstellungen 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Eigene Dateien 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Druckumgebung 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Musik 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Documents\Eigene Bilder 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Verlauf 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\AppData\Local\Anwendungsdaten 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 _SHDL C:\Users\Gast\Anwendungsdaten 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Roaming\DigitalPersona 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\VirtualStore 2013-07-11 13:54 - 2013-07-11 13:54 - 00000000 ____D C:\Users\Gast\AppData\Local\DigitalPersona 2013-07-08 21:15 - 2011-10-17 22:03 - 00000052 _____ C:\windows\SysWOW64\DOErrors.log 2013-07-07 09:59 - 2011-11-01 11:45 - 00000348 _____ C:\windows\Tasks\HPCeeScheduleForKatharina.job 2013-07-06 02:59 - 2011-11-01 11:45 - 00003210 _____ C:\windows\System32\Tasks\HPCeeScheduleForKatharina ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-25 19:21 ==================== End Of Log ============================ --- --- --- Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-08-2013 Ran by Administrator at 2013-08-04 11:23:33 Running from C:\Users\Administrator\Desktop Boot Mode: Safe Mode (with Networking) ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) (x32) 2007 Microsoft Office system (x32 Version: 12.0.6612.1000) 64 Bit HP CIO Components Installer (Version: 6.2.2) ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.3) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94) Adobe Reader X (10.1.7) - Deutsch (x32 Version: 10.1.7) Agatha Christie - Peril at End House (x32 Version: 2.2.0.95) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) ArcSoft TotalMedia (x32 Version: 1.0.48.25) ArcSoft TotalMedia (x32 Version: 2.0.39.12) ArcSoft Webcam Sharing Manager (x32 Version: 2.0.0.30) Atheros Driver Installation Program (x32 Version: 9.2) AUER Success.6 Lernversion (x32 Version: 06.00.0228) AutoCAD 2012 Language Pack - Deutsch (Version: 18.2.51.0) AutoCAD LT 2012 - Deutsch (Version: 18.2.51.0) AutoCAD LT 2012 Language Pack - Deutsch (Version: 18.2.51.0) Autodesk Content Service (x32 Version: 2.0.90) Autodesk Inventor Fusion 2012 (Version: 1.0.0.79) Autodesk Inventor Fusion 2012 Language Pack (Version: 1.0.0.79) Autodesk Inventor Fusion Plugin for AutoCAD 2012 (Version: 0.0.1.138) Autodesk Inventor Fusion plug-in for AutoCAD 2012 (Version: 0.0.1.138) Autodesk Inventor Fusion Plugin Language Pack for AutoCAD 2012 (Version: 0.0.1.138) Autodesk Material Library 2012 (x32 Version: 2.5.0.8) Autodesk Material Library Base Resolution Image Library 2012 (x32 Version: 2.5.0.8) avast! Free Antivirus (x32 Version: 8.0.1489.0) Bejeweled 2 Deluxe (x32 Version: 2.2.0.95) Bing Bar (x32 Version: 7.1.361.0) Bing Rewards Client Installer (x32 Version: 16.0.345.0) Blasterball 3 (x32 Version: 2.2.0.95) Bluetooth Win7 Suite (64) (Version: 7.02.000.55) Bonjour (Version: 3.0.0.10) Bounce Symphony (x32 Version: 2.2.0.95) Build-a-Lot - The Elizabethan Era (x32 Version: 2.2.0.95) Cake Mania (x32 Version: 2.2.0.95) Chuzzle Deluxe (x32 Version: 2.2.0.95) Cinergy T USB XXS V2.03.03.29 (x32 Version: 2.03.03.29) Cisco EAP-FAST Module (x32 Version: 2.2.14) Cisco LEAP Module (x32 Version: 1.0.19) Cisco PEAP Module (x32 Version: 1.1.6) D3DX10 (x32 Version: 15.4.2368.0902) Device Access Manager for HP ProtectTools (Version: 6.0.0.9) Die Sims™ 3 (x32 Version: 1.19.44) Die Sims™ 3 Design-Garten-Accessoires (x32 Version: 7.0.55) Die Sims™ 3 Gib Gas-Accessoires (x32 Version: 5.0.44) Die Sims™ 3 Reiseabenteuer (x32 Version: 2.0.86) Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.95) Drive Encryption For HP ProtectTools (Version: 6.0.33.24411) Energy Star Digital Logo (x32 Version: 1.0.1) Evernote v. 4.2.2 (x32 Version: 4.2.2.3979) Face Recognition for HP ProtectTools (Version: 6.00.4303) Facebook Messenger 2.1.4814.0 (x32 Version: 2.1.4814.0) Farm Frenzy (x32 Version: 2.2.0.95) FARO LS 1.1.406.58 (x32 Version: 4.6.58.2) FATE (x32 Version: 2.2.0.95) File Sanitizer For HP ProtectTools (x32 Version: 6.0.0.8) Galerie de photos Windows Live (x32 Version: 15.4.3502.0922) GeoGebra (x32 Version: 4.0.21.0) Google Chrome (x32 Version: 28.0.1500.72) Google Toolbar for Internet Explorer (x32 Version: 1.0.0) Google Toolbar for Internet Explorer (x32 Version: 7.5.4209.2358) Google Update Helper (x32 Version: 1.3.21.153) Hilti PROFIS Anchor (x32 Version: 2.3.0000) Hilti PROFIS AutoUpdate (x32 Version: 1.6.0) HP 3D DriveGuard (Version: 4.1.4.1) HP Auto (Version: 1.0.12494.3472) HP Connection Manager (x32 Version: 4.1.10.1) HP Customer Experience Enhancements (x32 Version: 6.0.1.7) HP DayStarter (Version: 2.0.0.12) HP Documentation (x32 Version: 1.2.0.0) HP ESU for Microsoft Windows 7 (x32 Version: 1.1.11.1) HP Game Console (x32) HP Games (x32 Version: 1.0.1.5) HP HD Webcam [Fixed] (x32 Version: 3.3.4.07) HP HotKey Support (Version: 4.0.10.1) HP Power Assistant (Version: 2.0.2.0) HP ProtectTools Security Manager (Version: 6.00.888) HP QuickWeb (x32 Version: 3.0.0.9057) HP Setup (x32 Version: 8.5.4526.3645) HP SoftPaq Download Manager (x32 Version: 3.2.0.0) HP Software Framework (x32 Version: 4.0.112.1) HP Software Setup (x32 Version: 8.2.1.1) HP System Default Settings (x32 Version: 2.1.2) HP Wallpaper (x32 Version: 2.00) HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2) IDT Audio (x32 Version: 1.0.6325.0) Insaniquarium Deluxe (x32 Version: 2.2.0.95) Intel(R) Identity Protection Technology 1.0.71.0 (x32 Version: 1.0.71.0) Intel(R) Management Engine Components (x32 Version: 7.0.0.1144) Intel(R) Processor Graphics (x32 Version: 8.15.10.2342) Intel(R) Rapid Storage Technology (x32 Version: 10.1.2.1004) iTunes (Version: 11.0.3.42) Java Auto Updater (x32 Version: 2.0.7.1) Java(TM) 6 Update 31 (x32 Version: 6.0.310) Jewel Quest II (x32 Version: 2.2.0.95) Jewel Quest Solitaire (x32 Version: 2.2.0.95) JMicron Flash Media Controller Driver (x32 Version: 1.0.57.2) John Deere Drive Green (x32 Version: 2.2.0.95) Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft .NET Framework 4 Extended (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Access MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Professional Hybrid 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft SQL Server 2008 Management Objects (Version: 10.1.2531.0) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192) Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219) Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0) Microsoft_VC90_CRT_x86 (x32 Version: 1.0.0) MSVCRT (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) oCAD 2012 - Deutsch (Version: 18.2.51.0) PDF Complete Special Edition (x32 Version: 4.0.33) Penguins! (x32 Version: 2.2.0.95) Plants vs. Zombies (x32 Version: 2.2.0.95) PlayReady PC Runtime amd64 (Version: 1.3.0) Polar Bowler (x32 Version: 2.2.0.95) Privacy Manager for HP ProtectTools (Version: 6.00.831) ProVI2010_x64 5.1 (x32 Version: 5.1) Pythagoras (x32 Version: 12.26) Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922) Realtek Ethernet Controller All-In-One Windows Driver (x32 Version: 1.12.0016) RuckZuck (x32 Version: 6.0.10) SDK (x32 Version: 2.24.025) Skype™ 5.10 (x32 Version: 5.10.116) Slingo Deluxe (x32 Version: 2.2.0.95) SQL Server System CLR Types (Version: 10.1.2531.0) Synaptics Pointing Device Driver (Version: 15.2.11.1) TeamViewer 8 (x32 Version: 8.0.19617) Theft Recovery for HP ProtectTools (x32 Version: 6.0.0.30) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596802) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817563) 32-Bit Edition (x32) Update für Microsoft Office Excel 2007 Help (KB963678) (x32) Update für Microsoft Office Outlook 2007 Help (KB963677) (x32) Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32) Update für Microsoft Office Word 2007 Help (KB963665) (x32) Validity Fingerprint Sensor Driver (Version: 4.3.117.0) VIP Access SDK x64(1.0.0.50) (x32 Version: 1.0.0.50) Virtual Villagers - The Secret City (x32 Version: 2.2.0.95) VLC media player 2.0.1 (x32 Version: 2.0.1) Wedding Dash (x32 Version: 2.2.0.95) Windows Live (x32 Version: 15.4.3502.0922) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Fotogalerie (x32 Version: 15.4.3502.0922) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3502.0922) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922) WinZip 14.5 (x32 Version: 14.5.9095) Xobni (x32 Version: 1.9.5.13282) Xobni Core (x32 Version: 1.0.0) Zuma Deluxe (x32 Version: 2.2.0.95) ==================== Restore Points ========================= 23-07-2013 16:30:55 Windows Update 26-07-2013 18:49:15 Windows Update ==================== Hosts content: ========================== 2009-07-14 04:34 - 2013-08-03 11:46 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {24D104BA-E059-4042-BBCD-091B8B1DDBEA} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.) Task: {4FFE6CAC-D9A9-4ABF-BDE0-CC9362A7660E} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {5BED5862-9232-44B6-9FD4-595A7C0857DC} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {61D00D3F-C3F8-4657-8CB9-EFA933017D98} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company) Task: {640BFA6E-B405-4D1A-9882-4D45F0CDFFEF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.) Task: {7FBE12B0-5D8D-48C8-B4E3-A3BF3012EDC5} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe No File Task: {9DCC5731-D6F9-4BA2-A49D-BEC942790A41} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-14] (Microsoft Corporation) Task: {ADDEEFDD-8CE2-4028-9E08-406DB63E1831} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {BB2A30B6-AA5E-410A-85F6-BBA46DDC42D6} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2010-12-10] (Hewlett-Packard Company) Task: {BD9ECD7B-DEA9-4699-8EDD-43363518684D} - System32\Tasks\CreateChoiceProcessTask => C:\Windows\System32\browserchoice.exe [2010-02-23] (Microsoft Corporation) Task: {C19F0537-A9A4-4264-8F9D-5FA7EDEE3481} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-07-17] (Google Inc.) Task: {C2A47E9E-FDAD-4936-80CA-1320BE893337} - System32\Tasks\NetworkWizardVCW => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-01-25] () Task: {C918E184-1B71-442E-9F72-9D5511750F1C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-06-04] (Microsoft) Task: {C98F4C41-99A8-46C4-B6D5-28D024BAE592} - System32\Tasks\HPCeeScheduleForKATHARINA-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard) Task: {D11A732F-6A33-4773-835C-1195C30E12A4} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation) Task: {D1702CDF-A97F-461E-AFE5-8EBE38DF1B6C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-15] (Adobe Systems Incorporated) Task: {DBC78FF0-E72F-4638-AD0C-86C5910CE5A2} - System32\Tasks\HPCeeScheduleForKatharina => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard) Task: {DECBB6D4-CE38-4365-A131-CB1C3312F1F6} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.) Task: {EFE5C061-8B09-49D3-BDF3-D5A4E63EA749} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software) Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001Core.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-751829164-2267940102-591571508-1001UA.job => C:\Users\Katharina\AppData\Local\Facebook\Update\FacebookUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\HPCeeScheduleForKATHARINA-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe Task: C:\windows\Tasks\HPCeeScheduleForKatharina.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Faulty Device Manager Devices ============= Name: Security Processor Loader Driver Description: Security Processor Loader Driver Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: spldr Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: aswRvrt Description: aswRvrt Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswRvrt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: avast! Network Shield Support Description: avast! Network Shield Support Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswTdi Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: aswVmm Description: aswVmm Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswVmm Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. ==================== Event log errors: ========================= Application errors: ================== Error: (08/03/2013 11:28:17 AM) (Source: System Restore) (User: ) Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\windows\system32\wbem\wmiprvse.exe; Beschreibung = ComboFix created restore point; Fehler = 0x8007043c). Error: (08/03/2013 11:28:17 AM) (Source: VSS) (User: ) Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x8007043c, Der Dienst kann nicht im abgesicherten Modus gestartet werden. . Vorgang: VSS-Server wird instanziiert Error: (08/03/2013 11:28:17 AM) (Source: VSS) (User: ) Description: Fehler bei Volumenschattenkopie-Dienst: Der COM-Server mit CLSID "{e579ab5f-1cc4-44b4-bed9-de0991ff0623}" und dem Namen "IVssCoordinatorEx2" kann nicht bei der Ausführung im abgesicherten Modus gestartet werden. Der Volumenschattenkopie-Dienst kann nicht gestartet werden, während der abgesicherte Modus ausgeführt wird. [0x8007043c, Der Dienst kann nicht im abgesicherten Modus gestartet werden. ] Vorgang: VSS-Server wird instanziiert Error: (08/02/2013 10:52:10 PM) (Source: Wininit) (User: ) Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden. Error: (08/02/2013 10:52:10 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa Ausnahmecode: 0xc0000005 Fehleroffset: 0x000007fef8d4a0ea ID des fehlerhaften Prozesses: 0x290 Startzeit der fehlerhaften Anwendung: 0xlsass.exe0 Pfad der fehlerhaften Anwendung: lsass.exe1 Pfad des fehlerhaften Moduls: lsass.exe2 Berichtskennung: lsass.exe3 Error: (08/02/2013 10:48:53 PM) (Source: Wininit) (User: ) Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden. Error: (08/02/2013 10:48:53 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa Ausnahmecode: 0xc0000005 Fehleroffset: 0x000007fef9c2a0ea ID des fehlerhaften Prozesses: 0x2a8 Startzeit der fehlerhaften Anwendung: 0xlsass.exe0 Pfad der fehlerhaften Anwendung: lsass.exe1 Pfad des fehlerhaften Moduls: lsass.exe2 Berichtskennung: lsass.exe3 Error: (08/02/2013 10:45:30 PM) (Source: Wininit) (User: ) Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden. Error: (08/02/2013 10:45:30 PM) (Source: Application Error) (User: ) Description: Name der fehlerhaften Anwendung: lsass.exe, Version: 6.1.7601.17725, Zeitstempel: 0x4ec483fc Name des fehlerhaften Moduls: PTLsaFltr64.dll_unloaded, Version: 0.0.0.0, Zeitstempel: 0x4d2ddffa Ausnahmecode: 0xc0000005 Fehleroffset: 0x000007fef908a0ea ID des fehlerhaften Prozesses: 0x290 Startzeit der fehlerhaften Anwendung: 0xlsass.exe0 Pfad der fehlerhaften Anwendung: lsass.exe1 Pfad des fehlerhaften Moduls: lsass.exe2 Berichtskennung: lsass.exe3 Error: (08/02/2013 10:42:12 PM) (Source: Wininit) (User: ) Description: Ein kritischer Systemprozess C:\windows\system32\lsass.exe ist fehlgeschlagen mit den Statuscode c0000005. Der Computer muss neu gestartet werden. System errors: ============= Error: (08/04/2013 11:14:30 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:24 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:24 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:24 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:20 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:20 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:20 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:18 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:18 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Error: (08/04/2013 11:13:18 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Computerbrowser" ist vom Dienst "Server" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068 Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 18% Total physical RAM: 4030.37 MB Available physical RAM: 3298.77 MB Total Pagefile: 8058.92 MB Available Pagefile: 7369.97 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:442.57 GB) (Free:67.53 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)] Drive d: (GONNA_WORK) (Removable) (Total:0.24 GB) (Free:0.23 GB) FAT (Disk=1 Partition=1) Drive e: (HP_RECOVERY) (Fixed) (Total:17.89 GB) (Free:2.72 GB) NTFS (Disk=0 Partition=3) ==>[System with boot components (obtained from reading drive)] Drive f: (HP_TOOLS) (Fixed) (Total:4.98 GB) (Free:2.13 GB) FAT32 (Disk=0 Partition=4) ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 13B7DE8A) Partition 1: (Active) - (Size=300 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=443 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=18 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=5 GB) - (Type=0C) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 250 MB) (Disk ID: 00000000) Partition 1: (Active) - (Size=250 MB) - (Type=06) ==================== End Of Log ============================ Gruß, pflanz. |
|
05.08.2013, 06:31
| #6 |
| /// the machine /// TB-Ausbilder | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Was passiert denn wenn Du versuchst in den normalen Modus zu booten? Nach diesem Tool kann ich Dir sagen ob wir es hinbekommen. Entgegen dem Bild bitte alles anhaken!! Downloade dir bitte Windows Repair (All In One) von hier.
__________________ --> Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig |
|
05.08.2013, 18:08
| #7 |
| | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Hallo, etwas lange Erklärung: Mein Freund hat das Passwort geändert bevor er mir den Laptop zum Reparieren gegeben hat. Als Erstes habe ich dann eine Systemwiederherstellung gemacht und dabei hat sich das Passwort wieder zurückgeändert. Der Freund ist zurzeit leider auf Urlaub. Den Trick mit der "Utilman.exe" kennst du sicher. Wenn ich nun versuche beim Anmeldebildschirm über die Konsole das Passwort zu ändern mit dem Befehl: "net user Benutzer Passwort" so kommt immer die Fehlermeldung: "Der RPC-Server ist nicht verfügbar". Weiteres braucht der Rechner SEHR LANGE bis er überhaupt zum Anmeldebildschirm kommt. Das Passwort über den Abgesicherten Modus --> Lokale Benutzer und Gruppen --> Benutzer --> Kennwort festlegen ist auch nicht möglich, mit der Fehlermeldung (ladet sicher 3-4 Minuten, bis die Fehlermeldung kommt):  Will ich dann über die secpol.msc die Kennwortrichtlinien kontrollieren, komme ich gar nicht so weit:  Denke Windows hat hier generell einen Defekt. Das Windows Repair AIO kann ich kaum richtig starten im abgesicherten Modus (System File Check --> Do It --> nichts passiert). Ich glaube langsam es ist wirklich effizienter das System neu aufzusetzen. Ich kann die Daten ja per Kaspersky Rescue Disc (außer *.exe) sichern und dann das System per Recovery Partition auf den Auslieferungszustand zurücksetzen oder? Gruß, pflanz. |
|
06.08.2013, 16:04
| #8 | |
| /// the machine /// TB-Ausbilder | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständigZitat:
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
06.08.2013, 17:58
| #9 | |
| | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständigZitat:
Trotzdem vielen Dank für deine Zeit und Mühe!! Kurze Frage noch: Kann ich *.exe Setupdateien sichern von Programmen die ich kenne? Gruß, pflanz. |
|
06.08.2013, 19:58
| #10 |
| /// the machine /// TB-Ausbilder | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Klar, war ja keine File Infector Infektion. Scann die EXE mit deinem AV Programm bevor du sie startest
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.08.2013, 06:53
| #11 | |
| | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständigZitat:
Woran hast du denn erkannt was für eine Art von Infektion dies war? |
|
07.08.2013, 12:22
| #12 |
| /// the machine /// TB-Ausbilder | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Na nen GVU, das ist kein Fileinfector, und unsere Tools hätten ganz anders angeschlagen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
07.08.2013, 13:35
| #13 | |
| | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständigZitat:
Thread kann geschlossen werden |
|
07.08.2013, 19:40
| #14 |
| /// the machine /// TB-Ausbilder | Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig Gern Geschehen
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Bundestrojaner vor 1 Monat "entfernt", jedoch NICHT vollständig |
| .dll, administrator, adobe, antivirus, avast, bingbar, der rpc-server ist nicht verfügbar, device driver, entfernen, excel, explorer, farbar, farbar recovery scan tool, flash player, frst:, google, home, installation, pdf, plug-in, registry, security, services.exe, software, svchost.exe, system, systemprozess, winlogon.exe, wsearch |
Linear-Darstellung
