verseuchte email mit zip anhang geöffnet

D.T. · 30.08.2013, 17:14

Hallo zusammen,

also ich Dummerle hab was ganz sau sau blödes gemacht.
In meinem GMX-Posteingang (nicht spamverdacht) war eine email von einem luis ziegler inkasso büro. Eine angebliche Rechnung im Anhang (zip) die ich versuchte zu öffnen, nix passiert. Habe email beantwortet mit Frage nach der Rechnung.

email noch im Posteingang.

Habe scanvorgang von Norton durchlaufen lassen, es wurde nix gefunden.

Es fällt mir auch nichts auf, habe ich was eingefangen? Wer kann mir helfen, bzw. bitte in einfachen Schritten.

Danke für jegliche Hilfe, könnte mich totärgern über meine Dussligkeit.

Gruß
D.T.

aharonov · 30.08.2013, 17:22

Hallo,

wenn du deinen Rechner nach Malware untersuchen lassen willst, dann arbeite bitte diese Anleitung ab und poste die resultierenden Logfiles hier.

D.T. · 30.08.2013, 17:33

Auch wenn mich Norton davor warnt zip opener zu installieren?

aharonov · 30.08.2013, 17:39

Nicht Zip Opener installieren!!
Das ist ein Werbebanner, nicht dort Download drücken sondern bei FRST!

D.T. · 30.08.2013, 17:57

LastRegBack: 2012-10-04 17:33

==================== End Of Log ============================

==================== Memory info ===========================

Percentage of memory in use: 86%
Total physical RAM: 1643.64 MB
Available physical RAM: 226.75 MB
Total Pagefile: 3287.64 MB
Available Pagefile: 1026.52 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:149.04 GB) (Free:102.87 GB) NTFS
Drive d: (Data) (Fixed) (Total:148.65 GB) (Free:17.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 41D68339)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End Of Log ============================Error: (08/26/2013 11:24:03 AM) (Source: VDS Basic Provider) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Microsoft Office Sessions:
=========================
Error: (08/30/2013 06:20:32 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 240008

Error: (08/30/2013 06:20:32 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 240008

Error: (08/30/2013 06:20:32 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/30/2013 06:20:31 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 239009

Error: (08/30/2013 06:20:31 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 239009

Error: (08/30/2013 06:20:31 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/30/2013 06:20:30 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 238011

Error: (08/30/2013 06:20:30 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 238011

Error: (08/30/2013 06:20:30 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/30/2013 06:20:29 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 236997

CodeIntegrity Errors:
===================================
Date: 2013-07-14 17:28:32.586
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\AK\icsak.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 17:28:31.899
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 16:56:49.240
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\AK\icsak.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 16:56:48.320
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 16:34:35.382
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\AK\icsak.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 16:34:34.767
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 16:19:01.376
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\AK\icsak.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 16:19:00.497
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 15:34:49.246
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\AK\icsak.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

Date: 2013-07-14 15:34:48.756
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

==================== Memory info ===========================

Percentage of memory in use: 86%
Total physical RAM: 1643.64 MB
Available physical RAM: 220.55 MB
Total Pagefile: 3287.64 MB
Available Pagefile: 1018.42 MB
Total Virtual: 8192 MB
Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: (WINDOWS) (Fixed) (Total:149.04 GB) (Free:102.87 GB) NTFS
Drive d: (Data) (Fixed) (Total:148.65 GB) (Free:17.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: 41D68339)
Partition 1: (Active) - (Size=400 MB) - (Type=27)
Partition 2: (Not Active) - (Size=149 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=149 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Kannst Du damit was anfangen????
Mach ich jetzt mit Schritt 3 weiter?

Ich schwitz Blut und Wasser, daß ich ja auch alles richtig mache.

Gruß
D.T.

aharonov · 30.08.2013, 18:03

Hallo,

nein das ist nur ein Teil eines Logs.
Füge bitte die kompletten Inhalte der von FRST erstellten Dateien FRST.txt und Addition.txt hier ein.

D.T. · 30.08.2013, 18:13

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-08-2013
Ran by twa (administrator) on 30-08-2013 19:09:43
Running from C:\Users\twa\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
(Toshiba Europe GmbH) C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(TOSHIBA) C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\TOPI.exe
(TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
(Toshiba) C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
(OpenOffice.org) C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe
(Sony Corporation) C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosAVRC.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe
(TOSHIBA CORPORATION.) C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\tosBtProc.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
(TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
(Nero AG) c:\Program Files (x86)\Nero\Update\NASvc.exe
(Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(McAfee, Inc.) c:\PROGRA~2\mcafee\SITEAD~1\saui.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
() C:\Users\twa\Downloads\gmer_2.1.19163.exe
() C:\Users\twa\Downloads\gmer_2.1.19163.exe
(Farbar) C:\Users\twa\Downloads\FRST64 (1).exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [TosNC] - C:\Program Files\Toshiba\BulletinBoard\TosNcCore.exe [597928 2011-03-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38304 2010-12-14] (TOSHIBA Corporation)
HKLM\...\Run: [Toshiba TEMPRO] - C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe [1546720 2011-02-10] (Toshiba Europe GmbH)
HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [566184 2010-09-28] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] - C:\Program Files\Toshiba\SmoothView\SmoothView.exe [570680 2009-08-13] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [915320 2010-10-28] (TOSHIBA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11580520 2010-11-10] (Realtek Semiconductor)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2181224 2010-11-03] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2387752 2010-09-30] (Synaptics Incorporated)
HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [709976 2010-02-05] (TOSHIBA Corporation)
HKLM\...\Run: [SmartFaceVWatcher] - C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [238080 2009-10-19] (TOSHIBA Corporation)
HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation)
HKCU\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [247728 2012-01-23] (TomTom)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
MountPoints2: F - F:\setup_vmb_lite.exe /checkApplicationPresence
MountPoints2: {9b44b2ee-14ec-11e2-95e0-dc0ea13a0205} - F:\setup_vmb_lite.exe /checkApplicationPresence
MountPoints2: {9b44b2f4-14ec-11e2-95e0-dc0ea13a0205} - F:\setup_vmb_lite.exe /checkApplicationPresence
MountPoints2: {fbb499b2-0e25-11e2-80b0-806e6f6e6963} - F:\AutoRun.exe
MountPoints2: {fbb499fd-0e25-11e2-80b0-e0ca949e5127} - F:\AutoRun.exe
HKLM-x32\...\Run: [NBAgent] - c:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1409424 2011-06-29] (Nero AG)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-06-29] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [532480 2010-11-09] (TOSHIBA)
HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2010-03-04] (TOSHIBA Electronics, Inc.)
HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2010-08-15] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [ITSecMng] - C:\Program Files (x86)\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe [83336 2009-07-22] (TOSHIBA CORPORATION)
HKLM-x32\...\Run: [TWebCamera] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2475384 2010-11-02] (TOSHIBA CORPORATION.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1644680 2013-02-08] (Ask)
HKLM-x32\...\Run: [Reader Library Launcher] - C:\Program Files (x86)\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe [906648 2010-07-13] (Sony Corporation)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
HKU\Default\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
HKU\Default User\...\Run: [TOPI.EXE] - C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe [846936 2011-05-16] (TOSHIBA)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth Manager.lnk
ShortcutTarget: Bluetooth Manager.lnk -> C:\Program Files (x86)\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe (TOSHIBA CORPORATION.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Toshiba Places Icon Utility.lnk
ShortcutTarget: Toshiba Places Icon Utility.lnk -> C:\Program Files\TOSHIBA\TOSHIBA Places Icon Utility\TosDIMonitor.exe (Toshiba)
Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TRDCReminder.lnk
ShortcutTarget: TRDCReminder.lnk -> C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (TOSHIBA Europe)
Startup: C:\Users\twa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk
ShortcutTarget: OpenOffice.org 3.3.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = iGoogle
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} -  No File
URLSearchHook: (No Name) - {f361b100-73c5-4793-8bcc-6e5c41510210} -  No File
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
SearchScopes: HKCU - DefaultScope {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&dt=072013&q={searchTerms}&src=IE-SearchBox
SearchScopes: HKCU - 235C78969DD94F1D8FD58BAF4D8CE056 URL = hxxp://search.babylon.com/?q={searchTerms}&AF=109958&tt=290312_bexdll&babsrc=SP_ss&mntrId=702dc8ba000000000000e0ca949e5127
SearchScopes: HKCU - {C4669D35-1B3D-4101-AEA2-10D077E08D9A} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=E1CFED37-0C6E-4CF5-9443-38A2EB5EA012&apn_sauid=D2255953-19AF-4671-81DD-8452D63971DF
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: CBAbzockschutz.InitToolbarBHO - {2e250b90-0e7a-42a3-9d65-e39f9f227fa4} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
BHO-x32: Babylon toolbar helper - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - COMPUTERBILD-Abzockschutz - {353e2a48-6254-4bd3-88f4-3b51a0ca7870} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Babylon Toolbar - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} -  No File
Toolbar: HKCU - No Name - {F361B100-73C5-4793-8BCC-6E5C41510210} -  No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} -  No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 192.168.2.1

Chrome: 
=======
CHR HomePage: hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=072013
CHR RestoreOnStartup: "hxxp://de.msn.com/?pc=UP97&ocid=UP97DHP&dt=072013", "hxxp://www.google.com/ig/redirectdomain?brand=TEUA&bmod=TEUA"
CHR DefaultSearchURL: (Ask) - hxxp://websearch.ask.com/redirect?client=cr&src=kw&tb=ORJ&o=&locale=&apn_uid=E1CFED37-0C6E-4CF5-9443-38A2EB5EA012&apn_ptnrs=U3&apn_sauid=D2255953-19AF-4671-81DD-8452D63971DF&apn_dtid=OSJ000YYDE&q={searchTerms}
CHR DefaultSuggestURL: (Ask) - hxxp://ss.websearch.ask.com/query?qsrc=2922&li=ff&sstype=prefix&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\21.0.1180.79\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_271.dll No File
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.62\pdf.dll ()
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\twa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.50.146.1_0\McChPlg.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U33) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.330.3) - C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Reader Application Detector) - C:\Program Files (x86)\Sony\ReaderDesktop\npreaderdetectmoz.dll No File
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (npFFApi) - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
CHR Extension: (SiteAdvisor) - C:\Users\twa\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.6.2.1341_1
CHR Extension: (Norton Identity Protection) - C:\Users\twa\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.0.10_0
CHR Extension: (Chrome In-App Payments service) - C:\Users\twa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx

==================== Services (Whitelisted) =================

R2 IconMan_R; C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [1809920 2010-08-04] (Realsil Microelectronics Inc.)
R2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\McSACore.exe [120592 2013-05-22] (McAfee, Inc.)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R2 TemproMonitoringService; C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [112080 2011-02-10] (Toshiba Europe GmbH)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-20] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-05-20] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-27] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-08-27] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20130829.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20130829.001\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\VirusDefs\20130829.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\VirusDefs\20130829.023\ENG64.SYS [126040 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\VirusDefs\20130829.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\VirusDefs\20130829.023\EX64.SYS [2099288 2013-08-29] (Symantec Corporation)
R3 SRTSP; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-07-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
R1 SymNetS; C:\Windows\system32\drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [x]
U3 fxlcipow; \??\C:\Users\twa\AppData\Local\Temp\fxlcipow.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-30 18:59 - 2013-08-30 18:59 - 00377856 _____ C:\Users\twa\Downloads\gmer_2.1.19163.exe
2013-08-30 18:52 - 2013-08-30 18:53 - 00006179 _____ C:\Users\twa\Downloads\Addition.txt
2013-08-30 18:50 - 2013-08-30 18:50 - 00000000 ____D C:\FRST
2013-08-30 18:48 - 2013-08-30 18:48 - 01579080 _____ (Farbar) C:\Users\twa\Downloads\FRST64.exe
2013-08-30 18:28 - 2013-08-30 18:28 - 00714816 _____ C:\Users\twa\Downloads\ZipOpenerSetup (1).exe
2013-08-30 18:26 - 2013-08-30 18:26 - 00714816 _____ C:\Users\twa\Downloads\ZipOpenerSetup.exe
2013-08-30 17:51 - 2013-08-30 17:51 - 02092792 _____ C:\Users\twa\Downloads\avira_free_antivirus.exe
2013-08-30 17:46 - 2013-08-30 17:47 - 110344048 _____ C:\Users\twa\Downloads\avira_free_antivirus_de.exe
2013-08-30 15:35 - 2013-08-30 15:35 - 00063722 _____ C:\Users\twa\Downloads\Extras.Txt
2013-08-30 15:30 - 2013-08-30 15:30 - 00106932 _____ C:\Users\twa\Downloads\OTL.Txt
2013-08-30 15:19 - 2013-08-30 15:19 - 00003120 _____ C:\{D4FEA8F8-E7BB-4A03-B7B7-E6AC858B3B68}
2013-08-30 14:50 - 2013-08-30 14:50 - 00602112 _____ (OldTimer Tools) C:\Users\twa\Downloads\OTL.exe
2013-08-30 14:50 - 2013-08-30 14:50 - 00602112 _____ (OldTimer Tools) C:\Users\twa\Downloads\OTL (1).exe
2013-08-30 08:33 - 2013-08-30 08:33 - 00093126 _____ C:\Users\twa\Downloads\Forderung der stornierten Zahlung Ihrer Bestellung 29.08.2013 (2).zip
2013-08-30 08:28 - 2013-08-30 08:28 - 00093126 _____ C:\Users\twa\Downloads\Forderung der stornierten Zahlung Ihrer Bestellung 29.08.2013 (1).zip
2013-08-30 08:26 - 2013-08-30 08:26 - 00093126 _____ C:\Users\twa\Downloads\Forderung der stornierten Zahlung Ihrer Bestellung 29.08.2013.zip
2013-08-28 19:31 - 2013-08-28 19:31 - 00001463 _____ C:\Users\twa\Downloads\URLLink.acsm
2013-08-25 13:20 - 2013-08-25 13:20 - 00009204 _____ C:\Users\twa\Desktop\Unbenannt 1.odt
2013-08-21 11:41 - 2013-08-21 13:51 - 17737608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-08-15 09:02 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 09:02 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 09:02 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 09:02 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 09:02 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 09:02 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 09:02 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-15 09:02 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-15 09:02 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-15 09:02 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-15 09:02 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-15 09:02 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-15 09:02 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-15 09:02 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-14 09:08 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 09:08 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 09:08 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 09:08 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 09:08 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-14 09:08 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-14 09:08 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-14 09:08 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-14 09:07 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 09:07 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-14 09:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 09:06 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 09:06 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-14 09:06 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 09:06 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 09:06 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-08-14 09:06 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 09:06 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-08-14 09:06 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-08-14 09:06 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-08-14 09:06 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-14 09:06 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-08-14 09:06 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-08-14 09:06 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-08-14 09:06 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-08-14 09:06 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-08-14 09:03 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-01 17:32 - 2013-08-01 17:32 - 00001750 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-01 17:31 - 2013-08-01 17:32 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-01 17:31 - 2013-08-01 17:32 - 00000000 ____D C:\Program Files\iTunes
2013-08-01 17:31 - 2013-08-01 17:32 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-01 17:31 - 2013-08-01 17:31 - 00000000 ____D C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2013-08-30 19:09 - 2013-08-30 19:09 - 01579080 _____ (Farbar) C:\Users\twa\Downloads\FRST64 (1).exe
2013-08-30 19:09 - 2011-08-22 11:52 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-30 18:59 - 2013-08-30 18:59 - 00377856 _____ C:\Users\twa\Downloads\gmer_2.1.19163.exe
2013-08-30 18:54 - 2012-04-02 17:59 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-30 18:53 - 2013-08-30 18:52 - 00006179 _____ C:\Users\twa\Downloads\Addition.txt
2013-08-30 18:50 - 2013-08-30 18:50 - 00000000 ____D C:\FRST
2013-08-30 18:50 - 2009-07-14 06:45 - 00025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-30 18:50 - 2009-07-14 06:45 - 00025120 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-30 18:48 - 2013-08-30 18:48 - 01579080 _____ (Farbar) C:\Users\twa\Downloads\FRST64.exe
2013-08-30 18:28 - 2013-08-30 18:28 - 00714816 _____ C:\Users\twa\Downloads\ZipOpenerSetup (1).exe
2013-08-30 18:26 - 2013-08-30 18:26 - 00714816 _____ C:\Users\twa\Downloads\ZipOpenerSetup.exe
2013-08-30 18:22 - 2010-11-21 08:50 - 00654844 _____ C:\Windows\system32\perfh007.dat
2013-08-30 18:22 - 2010-11-21 08:50 - 00130426 _____ C:\Windows\system32\perfc007.dat
2013-08-30 18:22 - 2009-07-14 07:13 - 01500254 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-30 18:20 - 2011-12-10 13:30 - 01462475 _____ C:\Windows\WindowsUpdate.log
2013-08-30 17:51 - 2013-08-30 17:51 - 02092792 _____ C:\Users\twa\Downloads\avira_free_antivirus.exe
2013-08-30 17:47 - 2013-08-30 17:46 - 110344048 _____ C:\Users\twa\Downloads\avira_free_antivirus_de.exe
2013-08-30 15:43 - 2012-01-08 16:33 - 00000000 ____D C:\Users\twa\AppData\Roaming\Skype
2013-08-30 15:35 - 2013-08-30 15:35 - 00063722 _____ C:\Users\twa\Downloads\Extras.Txt
2013-08-30 15:30 - 2013-08-30 15:30 - 00106932 _____ C:\Users\twa\Downloads\OTL.Txt
2013-08-30 15:19 - 2013-08-30 15:19 - 00003120 _____ C:\{D4FEA8F8-E7BB-4A03-B7B7-E6AC858B3B68}
2013-08-30 14:50 - 2013-08-30 14:50 - 00602112 _____ (OldTimer Tools) C:\Users\twa\Downloads\OTL.exe
2013-08-30 14:50 - 2013-08-30 14:50 - 00602112 _____ (OldTimer Tools) C:\Users\twa\Downloads\OTL (1).exe
2013-08-30 14:07 - 2011-08-22 11:52 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-30 14:07 - 2011-08-22 11:38 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-08-30 14:07 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-30 14:06 - 2010-11-21 05:47 - 00054344 _____ C:\Windows\PFRO.log
2013-08-30 14:06 - 2009-07-14 06:51 - 00075594 _____ C:\Windows\setupact.log
2013-08-30 08:33 - 2013-08-30 08:33 - 00093126 _____ C:\Users\twa\Downloads\Forderung der stornierten Zahlung Ihrer Bestellung 29.08.2013 (2).zip
2013-08-30 08:29 - 2013-01-31 03:12 - 00000000 ____D C:\Program Files\McAfee
2013-08-30 08:28 - 2013-08-30 08:28 - 00093126 _____ C:\Users\twa\Downloads\Forderung der stornierten Zahlung Ihrer Bestellung 29.08.2013 (1).zip
2013-08-30 08:26 - 2013-08-30 08:26 - 00093126 _____ C:\Users\twa\Downloads\Forderung der stornierten Zahlung Ihrer Bestellung 29.08.2013.zip
2013-08-29 15:36 - 2012-01-04 16:30 - 00000000 ____D C:\Users\twa\AppData\Roaming\SoftGrid Client
2013-08-28 19:31 - 2013-08-28 19:31 - 00001463 _____ C:\Users\twa\Downloads\URLLink.acsm
2013-08-25 13:20 - 2013-08-25 13:20 - 00009204 _____ C:\Users\twa\Desktop\Unbenannt 1.odt
2013-08-21 13:51 - 2013-08-21 11:41 - 17737608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2013-08-21 13:51 - 2012-04-02 17:59 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-21 13:51 - 2012-04-02 17:59 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-21 13:51 - 2012-01-08 19:19 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-15 08:44 - 2013-07-28 14:14 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 08:40 - 2012-05-17 12:51 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-01 17:32 - 2013-08-01 17:32 - 00001750 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-01 17:32 - 2013-08-01 17:31 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-01 17:32 - 2013-08-01 17:31 - 00000000 ____D C:\Program Files\iTunes
2013-08-01 17:32 - 2013-08-01 17:31 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-01 17:31 - 2013-08-01 17:31 - 00000000 ____D C:\Program Files\iPod

Files to move or delete:
====================
C:\Users\twa\AppData\Local\Temp\APNStub.exe
C:\Users\twa\AppData\Local\Temp\ICReinstall_ZipOpenerSetup (1).exe
C:\Users\twa\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\twa\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\twa\AppData\Local\Temp\PhotoScape_V3.6.1.exe
C:\Users\twa\AppData\Local\Temp\SkypeSetup.exe
C:\Users\twa\AppData\Local\Temp\tbZon2.dll
C:\Users\twa\AppData\Local\Temp\Uninstall.exe
C:\Users\twa\AppData\Local\Temp\~vis0000\dtslatestinstaller.exe
C:\Users\twa\AppData\Local\Temp\{D280DD4C-CF17-439C-BC3F-8077614A0E47}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{C37C839E-BD50-4839-8000-30B8D680566F}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{A5C6E939-AF08-44E1-BC8D-48F2498D2879}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{93CF37B4-A6FF-4950-8257-546EF5928C27}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Clean_tool.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Clean_tool64.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\CUninstaller.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\handlecmsg.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Install.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\Launcher.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vistalib32.dll
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vistalib64.dll
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vsdrinst.exe
C:\Users\twa\AppData\Local\Temp\{907A1104-E812-4b5c-959B-E4DAB37A96AB}\vsdrinst64.exe
C:\Users\twa\AppData\Local\Temp\{628F9D1E-9FF8-4D4D-A148-C07D251DD3BC}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{4826722A-E9E1-4AF1-8C4C-D554A36AB646}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{20D24D12-3903-4313-98E6-4552DC0D25EF}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{1B1A91B7-1506-4B7E-BFD9-23E7C94D84CC}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\{0BE6A78E-2E51-40AA-BED5-B9F25CA3DBF7}\InstallFlashPlayer.exe
C:\Users\twa\AppData\Local\Temp\{0783274A-9A1B-4D07-9DDD-E1EA510A2079}\ISBEW64.exe
C:\Users\twa\AppData\Local\Temp\wtj744xr.tmp\setup_dm_Fotowelt.exe
C:\Users\twa\AppData\Local\Temp\UTPSDLL\GdiPlus.dll
C:\Users\twa\AppData\Local\Temp\UTPSDLL\mfc40u.dll
C:\Users\twa\AppData\Local\Temp\UTPSDLL\mfc71.dll
C:\Users\twa\AppData\Local\Temp\UTPSDLL\MFC71u.dll
C:\Users\twa\AppData\Local\Temp\UTPSDLL\msvcp60.dll
C:\Users\twa\AppData\Local\Temp\UTPSDLL\msvcp71.dll
C:\Users\twa\AppData\Local\Temp\UTPSDLL\msvcr71.dll
C:\Users\twa\AppData\Local\Temp\tgqfvwzv.tmp\fotokasten_comfort_[2116]_4-4-3.exe
C:\Users\twa\AppData\Local\Temp\SDIAG_4b136e79-6d5e-47aa-8c8c-922b87232727\DiagPackage.dll
C:\Users\twa\AppData\Local\Temp\SDIAG_4a0833c0-7376-428c-a04d-819c417621bf\DiagPackage.dll
C:\Users\twa\AppData\Local\Temp\jcnjo3w7.tmp\scribus-1.4.0-windows.exe
C:\Users\twa\AppData\Local\Temp\is357113909\OpenItSetup.exe
C:\Users\twa\AppData\Local\Temp\is357113909\wajam_validate.exe
C:\Users\twa\AppData\Local\Temp\InstallShare7389\bab_setup.exe
C:\Users\twa\AppData\Local\Temp\giza3g5t.tmp\PhotoScape_V3.6.1.exe
C:\Users\twa\AppData\Local\Temp\f58egdyw.tmp\setup_dm_Fotowelt.exe
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\CbsProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\CompatProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\DismCore.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\DismCorePS.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\DismHost.exe
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\DismProv.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\DmiProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\FolderProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\IntlProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\LogProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\MsiProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\OSProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\SmiProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\TransmogProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\UnattendProvider.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\wdscore.dll
C:\Users\twa\AppData\Local\Temp\F4AAF6E6-4800-47A8-AAA6-52198235101C\WimProvider.dll
C:\Users\twa\AppData\Local\Temp\DE99.dir\InstallFlashPlayer.exe
C:\Users\twa\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ffx.exe
C:\Users\twa\AppData\Local\Temp\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbar4ie.exe
C:\Users\twa\AppData\Local\Temp\779nb9fu.tmp\fotokasten_comfort_[2116]_4-4-3.exe
C:\Users\twa\AppData\Local\Temp\683F3BDB-BAB0-7891-8B4D-D7449048C680\BExternal.dll
C:\Users\twa\AppData\Local\Temp\683F3BDB-BAB0-7891-8B4D-D7449048C680\IECookieLow.dll
C:\Users\twa\AppData\Local\Temp\683F3BDB-BAB0-7891-8B4D-D7449048C680\MyBabylonTB.exe
C:\Users\twa\AppData\Local\Temp\683F3BDB-BAB0-7891-8B4D-D7449048C680\Setup.exe
C:\Users\twa\AppData\Local\Temp\683F3BDB-BAB0-7891-8B4D-D7449048C680\sqlite3.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\CbsProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\CompatProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\DismCore.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\DismCorePS.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\DismHost.exe
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\DismProv.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\DmiProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\FolderProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\IntlProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\LogProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\MsiProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\OSProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\SmiProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\TransmogProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\UnattendProvider.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\wdscore.dll
C:\Users\twa\AppData\Local\Temp\24889261-5583-458C-A9B2-B38E21593E5C\WimProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\CbsProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\CompatProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\DismCore.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\DismCorePS.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\DismHost.exe
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\DismProv.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\DmiProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\FolderProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\IntlProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\LogProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\MsiProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\OSProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\SmiProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\TransmogProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\UnattendProvider.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\wdscore.dll
C:\Users\twa\AppData\Local\Temp\22151293-6530-468F-8E83-24FB16F858DE\WimProvider.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2012-10-04 17:33

==================== End Of Log ============================

--- --- ---

--- --- ---

Hab das jetzt noch mal probiert. Kannst Du damit was anfangen?

Gruß
D.T.

aharonov · 30.08.2013, 18:27

Hallo,

hast du nur die zip-Datei selbst versucht zu öffnen, oder auch das File, das "drin" war?

Schritt 1

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Schritt 2

Starte noch einmal FRST.

Setze bei Optional Scan den Haken bei Addition.txt und drücke Scan.
Wenn der Scan abgeschlossen ist, werden zwei neue Logfiles FRST.txt und Addition.txt erstellt und auf dem Desktop gespeichert.
Poste den Inhalt dieser beiden Logfiles bitte hier in deinen Thread.

D.T. · 30.08.2013, 18:36

Hi,
ganz ehrlich, ich weiß es nicht mehr.
Es ging aber kein Text auf....

Bitte nicht an mir verzweifeln.
Ich gehe jetzt mit den Schritten weiter.

Gruß
D.T.

aharonov · 30.08.2013, 18:39

Ok, alles klar.

D.T. · 30.08.2013, 18:46

Hi,
kann adw.cleaner nicht downladen, krieg andauernd Fehlermeldung
Norton möchte das auch nicht.
was nun?
Gruß
D.T.

aharonov · 30.08.2013, 18:48

Und du lädst wirklich AdwCleaner runter (und nicht wieder etwas anderes von einem gut getarnten Werbebanner)?
Falls ja, dann deaktiviere Norton temporär für diesen Download von und Scan mit AdwCleaner - der ist sauber.

D.T. · 30.08.2013, 18:50

Nein, ich lade jetzt WIRKLICH adw cleaner runter.
Fehlermeldung:
Auf das angegebene Geräd bzw. Pfad, datei kann nicht zugegriffen werden, keine Berechtigung!

Gruß
D.T.

aharonov · 30.08.2013, 18:56

Also diese Fehlermeldung erscheint, wenn du versuchst, Norton zu deaktivieren?

D.T. · 30.08.2013, 19:18

AdwCleaner Logfile:

Code:

ATTFilter

# AdwCleaner v3.001 - Report created 30/08/2013 at 20:07:41
# Updated 24/08/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : twa - TWA-TOSH
# Running from : C:\Users\twa\Downloads\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Ask
Folder Deleted : C:\ProgramData\Babylon
Folder Deleted : C:\ProgramData\Partner
Folder Deleted : C:\Program Files (x86)\Ask.com
Folder Deleted : C:\Program Files (x86)\BabylonToolbar
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Users\twa\AppData\Local\apn
Folder Deleted : C:\Users\twa\AppData\Local\Babylon
Folder Deleted : C:\Users\twa\AppData\Local\Conduit
Folder Deleted : C:\Users\twa\AppData\Local\PackageAware
Folder Deleted : C:\Users\twa\AppData\Local\Temp\BabylonToolbar
Folder Deleted : C:\Users\twa\AppData\LocalLow\AskToolbar
Folder Deleted : C:\Users\twa\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\twa\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\twa\AppData\Roaming\Babylon
File Deleted : C:\Users\twa\AppData\Local\Temp\Uninstall.exe
File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Key Deleted : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL
Key Deleted : HKLM\SOFTWARE\Classes\b
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd
Key Deleted : HKLM\SOFTWARE\Classes\Babylon.dskBnd.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore
Key Deleted : HKLM\SOFTWARE\Classes\bbylnApp.appCore.1
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr
Key Deleted : HKLM\SOFTWARE\Classes\bbylntlbr.bbylntlbrHlpr.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane
Key Deleted : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Key Deleted : HKLM\SOFTWARE\Classes\escort.escrtBtn.1
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc
Key Deleted : HKLM\SOFTWARE\Classes\esrv.BabylonESrvc.1
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd
Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater]
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{291BCCC1-6890-484A-89D3-318C928DAC1B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{B8276A94-891D-453C-9FF3-715C042A2575}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFB9ADCB-8C79-4C29-81D3-74D46A93D370}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{44C3C1DB-2127-433C-98EC-4C9412B5FC3A}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4D5132DD-BB2B-4249-B5E0-D145A8C982E1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{706D4A4B-184A-4434-B331-296B07493D2D}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8BE10F21-185F-4CA0-B789-9921674C3993}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{94C0B25D-3359-4B10-B227-F96A77DB773F}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B0B75FBA-7288-4FD3-A9EB-7EE27FA65599}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B173667F-8395-4317-8DD6-45AD1FE00047}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B32672B3-F656-46E0-B584-FE61C0BB6037}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BFE569F7-646C-4512-969B-9BE3E580D393}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2434722-5C85-4CA0-BA69-1B67E7AB3D68}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2996524-2187-441F-A398-CD6CB6B3D020}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E047E227-5342-4D94-80F7-CFB154BF55BD}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E3F79BE9-24D4-4F4D-8C13-DF2C9899F82E}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E77EEF95-3E83-4BB8-9C0D-4A5163774997}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{35C1605E-438B-4D64-AAB1-8885F097A9B1}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6E8BF012-2C85-4834-B10A-1B31AF173D70}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8375D9C8-634F-4ECB-8CF5-C7416BA5D542}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9}
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}]
Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}]
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}]
Value Deleted : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1]
Key Deleted : HKCU\Software\APN
Key Deleted : HKCU\Software\Ask.com
Key Deleted : HKCU\Software\BabylonToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKLM\Software\APN
Key Deleted : HKLM\Software\AskToolbar
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\BabylonToolbar
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\conduitEngine

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16660


-\\ Google Chrome v29.0.1547.62

[ File : C:\Users\twa\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : icon_url
Deleted : search_url
Deleted : suggest_url
Deleted : keyword

*************************

AdwCleaner[R0].txt - [9355 octets] - [30/08/2013 20:04:36]
AdwCleaner[S0].txt - [9262 octets] - [30/08/2013 20:07:41]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [9322 octets] ##########

--- --- ---

30.08.2013, 17:22	#2
aharonov /// TB-Ausbilder	verseuchte email mit zip anhang geöffnet Hallo, wenn du deinen Rechner nach Malware untersuchen lassen willst, dann arbeite bitte diese Anleitung ab und poste die resultierenden Logfiles hier. __________________ __________________

30.08.2013, 17:39	#4
aharonov /// TB-Ausbilder	verseuchte email mit zip anhang geöffnet Nicht Zip Opener installieren!! Das ist ein Werbebanner, nicht dort Download drücken sondern bei FRST! __________________ cheers, Leo

30.08.2013, 18:03	#6
aharonov /// TB-Ausbilder	verseuchte email mit zip anhang geöffnet Hallo, nein das ist nur ein Teil eines Logs. Füge bitte die kompletten Inhalte der von FRST erstellten Dateien FRST.txt und Addition.txt hier ein. __________________ --> verseuchte email mit zip anhang geöffnet

30.08.2013, 18:39	#10
aharonov /// TB-Ausbilder	verseuchte email mit zip anhang geöffnet Ok, alles klar. __________________ cheers, Leo

30.08.2013, 18:48	#12
aharonov /// TB-Ausbilder	verseuchte email mit zip anhang geöffnet Und du lädst wirklich AdwCleaner runter (und nicht wieder etwas anderes von einem gut getarnten Werbebanner)? Falls ja, dann deaktiviere Norton temporär für diesen Download von und Scan mit AdwCleaner - der ist sauber. __________________ cheers, Leo

verseuchte email mit zip anhang geöffnet

Plagegeister aller Art und deren Bekämpfung: verseuchte email mit zip anhang geöffnet