Windows 7: Win32.downloader.gen Infektion

BSPVX · 31.08.2013, 11:28

Hallo,

ich brauch bitte Hilfe bei der Entfernung von Win32.Downloader.gen von einem WIN7 Rechner:

Logfile Spybot S&D:

Code:

ATTFilter

--- Search result list ---
Win32.Downloader.gen: [SBI $F65FFCFA]  Bibliothek (Datei, nothing done)
  C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll
  Properties.size=638560
  Properties.md5=6796F6E449F90A543DC3345538ACC46F
  Properties.filedate=1362485924
  Properties.filedatetext=2013-03-05 14:18:44

Win32.Downloader.gen: [SBI $82F4FAFD]  Daten (Datei, nothing done)
  C:\END
  Properties.size=9
  Properties.md5=A103FDF7348130EF3F3FEF56B1700A27
  Properties.filedate=1363457926
  Properties.filedatetext=2013-03-16 20:18:46


--- Spybot - Search & Destroy version: 1.6.2  (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SDWinSec.exe (1.0.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-03-05 TeaTimer.exe (1.6.6.32)
2011-03-21 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-11-04 advcheck.dll (1.6.5.20)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2013-04-11 Includes\Adware.sbi (*)
2013-08-28 Includes\AdwareC.sbi (*)
2010-08-13 Includes\Cookies.sbi (*)
2012-11-14 Includes\Dialer.sbi (*)
2013-04-11 Includes\DialerC.sbi (*)
2013-04-11 Includes\HeavyDuty.sbi (*)
2012-11-14 Includes\Hijackers.sbi (*)
2013-04-11 Includes\HijackersC.sbi (*)
2013-08-21 Includes\iPhone.sbi (*)
2013-06-25 Includes\Keyloggers.sbi (*)
2013-04-11 Includes\KeyloggersC.sbi (*)
2004-11-29 Includes\LSP.sbi (*)
2013-05-29 Includes\Malware.sbi (*)
2013-08-28 Includes\MalwareC.sbi (*)
2012-11-14 Includes\PUPS.sbi (*)
2013-08-06 Includes\PUPSC.sbi (*)
2010-01-25 Includes\Revision.sbi (*)
2012-11-14 Includes\Security.sbi (*)
2013-04-11 Includes\SecurityC.sbi (*)
2008-06-03 Includes\Spybots.sbi (*)
2008-06-03 Includes\SpybotsC.sbi (*)
2013-05-22 Includes\Spyware.sbi (*)
2013-08-06 Includes\SpywareC.sbi (*)
2012-11-19 Includes\Tracks.uti
2013-01-16 Includes\Trojans.sbi (*)
2013-08-13 Includes\TrojansC-02.sbi (*)
2013-08-27 Includes\TrojansC-03.sbi (*)
2013-08-28 Includes\TrojansC-04.sbi (*)
2013-06-13 Includes\TrojansC-05.sbi (*)
2013-04-19 Includes\TrojansC.sbi (*)
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll



--- System information ---
Unknown Windows version 6.1 (Build: 7601) Service Pack 1 (6.1.7601)


--- Startup entries list ---
Located: HK_LM:Run, Adobe ARM
command: "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
   file: C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
   size: 958576
    MD5: 48BE298F7FD1BEF4D8FBACB04D8D95C4

Located: HK_LM:Run, APSDaemon
command: "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
   file: C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
   size: 59720
    MD5: 61E4289E91E88C90478D7F4BEB10DCF7

Located: HK_LM:Run, avgnt
command: "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
   file: C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
   size: 345144
    MD5: A548F8A683351B2CEA080F7DA6ECDE9C

Located: HK_LM:Run, CheckPoint Cleanup
command: C:\Users\SV\AppData\Local\Temp\cpes_clean_launcher.exe C:\Users\SV\AppData\Local\Temp\cpes_clean.exe
   file: C:\Users\SV\AppData\Local\Temp\cpes_clean_launcher.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
   file: C:\Program Files (x86)\QuickTime\QTTask.exe
   size: 421888
    MD5: 9ACCBC5891BA51B5B29C1A88F80D4CE3

Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
   file: C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
   size: 253816
    MD5: D63797E8E7781EE1500A810CB6194FA6

Located: HK_CU:Run, SearchProtect
  where: .DEFAULT...
command: \SearchProtect\bin\cltmng.exe
   file: \SearchProtect\bin\cltmng.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, WLStart
  where: .DEFAULT...
command: "C:\Program Files (x86)\Windows Live\Installer\wlstart.exe" /nosearch /nohomepage
   file: C:\Program Files (x86)\Windows Live\Installer\wlstart.exe
   size: 786760
    MD5: A7DACCCCBE1ED1D572DC83776DB69F22

Located: HK_CU:Run, 
  where: S-1-5-21-771582602-4057858738-3947029243-1002...
command: 
   file: 
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:Run, Akamai NetSession Interface
  where: S-1-5-21-771582602-4057858738-3947029243-1002...
command: "C:\Users\SV\AppData\Local\Akamai\netsession_win.exe"
   file: C:\Users\SV\AppData\Local\Akamai\netsession_win.exe
   size: 4489472
    MD5: 10E89F598469C60D8C87A8218089A87D

Located: HK_CU:Run, NokiaSuite.exe
  where: S-1-5-21-771582602-4057858738-3947029243-1002...
command: C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe -tray
   file: C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
   size: 1083264
    MD5: F39C8E7A58DEF4704FF16FCC7FCED2E6

Located: HK_CU:Run, RESTART_STICKY_NOTES
  where: S-1-5-21-771582602-4057858738-3947029243-1002...
command: C:\Windows\System32\StikyNot.exe
   file: C:\Windows\System32\StikyNot.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:Run, SpybotSD TeaTimer
  where: S-1-5-21-771582602-4057858738-3947029243-1002...
command: C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
   file: C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
   size: 2260480
    MD5: 390679F7A217A5E73D756276C40AE887

Located: HK_CU:Run, SearchProtect
  where: S-1-5-18...
command: \SearchProtect\bin\cltmng.exe
   file: \SearchProtect\bin\cltmng.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: HK_CU:RunOnce, WLStart
  where: S-1-5-18...
command: "C:\Program Files (x86)\Windows Live\Installer\wlstart.exe" /nosearch /nohomepage
   file: C:\Program Files (x86)\Windows Live\Installer\wlstart.exe
   size: 786760
    MD5: A7DACCCCBE1ED1D572DC83776DB69F22

Located: Startup (allgemein), Bluetooth.lnk
  where: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Program Files (x86)\Lenovo\Bluetooth Software\BTTray.exe
   file: C:\Program Files (x86)\Lenovo\Bluetooth Software\BTTray.exe
   size: 0
    MD5: D41D8CD98F00B204E9800998ECF8427E
         Warning: if the file is actually larger than 0 bytes,
         the checksum could not be properly calculated!

Located: Startup (Benutzer), Dropbox.lnk
  where: C:\Users\SV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup...
command: C:\Users\SV\AppData\Roaming\Dropbox\bin\Dropbox.exe
   file: C:\Users\SV\AppData\Roaming\Dropbox\bin\Dropbox.exe
   size: 27776968
    MD5: F7E1CCBAD109329203AACB1E87BE614C



--- Browser helper object list ---
{3A2D5EBA-F86D-4BD3-A177-019765996711} (PDF Architect Helper)
          location: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
          BHO name: PDF Architect Helper
        CLSID name: PDF Architect Helper
              Path: C:\Program Files (x86)\PDF Architect\
         Long name:    PDFIEHelper.dll
        Short name:       PDFIEH~1.DLL
    Date (created): 09.01.2013 18:27:30
Date (last access): 16.03.2013 18:38:48

Logfile defogger (defogger_disable.txt)

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 11:12 on 31/08/2013 (SV)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

logfile FRS.txt:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 30-08-2013 01
Ran by SV (administrator) on SV-PC on 31-08-2013 11:48:29
Running from C:\Users\SV\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisService.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe
(NVIDIA Corporation) C:\windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
() C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe
(Egis Technology Inc. ) C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
() c:\Program Files\Ocster Backup\bin\backupService-ox.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\HelperService.exe
(pdfforge GbR) C:\Program Files (x86)\PDF Architect\ConversionService.exe
() c:\Program Files\Ocster Backup\bin\oxHelper.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLEDService.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtLED\RtLED.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Akamai Technologies, Inc.) C:\Users\SV\AppData\Local\Akamai\netsession_win.exe
(Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
(Nokia) C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTMon.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\SV\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Akamai Technologies, Inc.) C:\Users\SV\AppData\Local\Akamai\netsession_win.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclUSBSrv64.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Nokia) C:\Program Files (x86)\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
(Safer Networking Limited) C:\Program Files (x86)\Spybot - Search & Destroy\SpybotSD.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [IAAnotif] - C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [NvCplDaemon] - C:\windows\system32\NvCpl.dll [17412200 2010-04-07] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10821224 2010-06-02] (Realtek Semiconductor)
HKCU\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKCU\...\Run: [Akamai NetSession Interface] - C:\Users\SV\AppData\Local\Akamai\netsession_win.exe [4489472 2013-06-05] (Akamai Technologies, Inc.)
HKCU\...\Run: [] -  [x]
HKCU\...\Run: [NokiaSuite.exe] - C:\Program Files (x86)\Nokia\Nokia Suite\NokiaSuite.exe [1083264 2012-01-10] (Nokia)
HKLM-x32\...\Run: [CheckPoint Cleanup] - C:\Users\SV\AppData\Local\Temp\cpes_clean_launcher.exe C:\Users\SV\AppData\Local\Temp\cpes_clean.exe [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-29] (Avira Operations GmbH & Co. KG)
HKU\Default\...\RunOnce: [WLStart] - C:\Program Files (x86)\Windows Live\Installer\wlstart.exe [786760 2009-07-26] (Microsoft Corporation)
HKU\Simon\...\Run: [SearchProtect] - C:\Users\Simon\AppData\Roaming\SearchProtect\bin\cltmng.exe [2852640 2013-05-08] (Conduit)
HKU\UpdatusUser\...\Run: [FactoryTest] - C:\Windows\Test.bat [x]
HKU\UpdatusUser\...\Run: [Power2GoExpress] - C:\Program Files (x86)\Lenovo\Power2Go\Power2GoExpress.exe [2532648 2009-07-13] (Cyberlink)
AppInit_DLLs: C:\windows\system32\nvinitx.dll [95848 2010-04-07] (NVIDIA Corporation)
AppInit_DLLs-x32: C:\windows\SysWOW64\nvinit.dll [89704 2010-04-07] (NVIDIA Corporation)
Lsa: [Notification Packages] scecli EgisPwdFilter EgisDSPwdFilter EgisPLPwdFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\Lenovo\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\SV\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\SV\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - DefaultScope {798483AF-902B-4A95-A039-E884066AC38C} URL = 
SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=LENDF8&pc=MALN&src=IE-SearchBox
SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2613550
BHO-x32: PDF Architect Helper - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GbR)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: IEPwdBankBHO Class - {56CBB761-DA41-4E31-B270-B13B4B0A61D0} - C:\Program Files (x86)\EgisTec BioExcess\EgisIEPwdBank.dll (Egis Technology Inc. )
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} -  No File
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: entrusted Toolbar - {e44a1809-4d10-4ab8-b343-3326b64c7cdd} - C:\Program Files (x86)\entrusted\prxtbentr.dll (Conduit Ltd.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - PDF Architect Toolbar - {25A3A431-30BB-47C8-AD6A-E1063801134F} - C:\Program Files (x86)\PDF Architect\PDFIEPlugin.dll (pdfforge GbR)
Toolbar: HKLM-x32 - entrusted Toolbar - {e44a1809-4d10-4ab8-b343-3326b64c7cdd} - C:\Program Files (x86)\entrusted\prxtbentr.dll (Conduit Ltd.)
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @checkpoint.com/FFApi - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\wikipedia-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\SV\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: firefox - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\firefox@ghostery.com.xpi
FF Extension: pencil - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\pencil@evolus.vn.xpi
FF Extension: trackmenot - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\trackmenot@mrl.nyu.edu.xpi
FF Extension: No Name - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF Extension: No Name - C:\Users\SV\AppData\Roaming\Mozilla\Firefox\Profiles\t06aumas.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF HKLM-x32\...\Firefox\Extensions: [fe_8.0@nokia.com] C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_8.0
FF Extension: Firefox Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Bookmarks Connector\FirefoxExtension_8.0
FF HKLM-x32\...\Firefox\Extensions: [FFPDFArchitectConverter@pdfarchitect.com] C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF Extension: PDF Architect Converter For Firefox - C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt
FF HKLM-x32\...\Thunderbird\Extensions: [te_9.0@nokia.com] C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0
FF Extension: Thunderbird Address Book Synchronisation Extension - C:\Program Files (x86)\Nokia\Nokia Suite\Connectors\Thunderbird Connector\ThunderbirdExtension_9.0

==================== Services (Whitelisted) =================

R2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
R2 Akamai; c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll [4569856 2013-07-02] (Akamai Technologies, Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-29] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-29] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-29] (Avira Operations GmbH & Co. KG)
R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [903456 2010-04-20] (Broadcom Corporation.)
R2 EgisTec Data Security Service; C:\Program Files (x86)\EgisTec BioExcess\EgisDSService.exe [314736 2010-05-28] (Egis Technology Inc. )
R2 EgisTec Service Help; C:\Program Files (x86)\EgisTec Port Locker\Egishlpsvc.exe [322416 2010-05-19] (Egis Technology Inc. )
R2 IGRS; C:\Program Files (x86)\Lenovo\ReadyComm\common\IGRS.exe [38152 2009-07-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm AppSvc; C:\Program Files\Lenovo\ReadyComm\AppSvc.exe [509192 2009-08-14] (Lenovo Group Limited)
S3 Lenovo ReadyComm ConnSvc; C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe [579400 2009-09-22] (Lenovo Group Limited)
R2 ocster_backup; c:\Program Files\Ocster Backup\bin\backupService-ox.exe [21280 2011-06-29] ()
R2 PDF Architect Helper Service; C:\Program Files (x86)\PDF Architect\HelperService.exe [1324104 2013-01-09] (pdfforge GbR)
R2 PDF Architect Service; C:\Program Files (x86)\PDF Architect\ConversionService.exe [795208 2013-01-09] (pdfforge GbR)
S3 PS_MDP; C:\Program Files (x86)\Lenovo\ReadyComm\PS_MDP.dll [276296 2009-07-16] (Lenovo Group Limited)
S2 ReadyComm.DirectRouter; C:\Program Files (x86)\Lenovo\ReadyComm\common\router.dll [103688 2009-07-14] (Lenovo Group Limited)
R2 RtLedService; C:\Program Files\Realtek\RtLED\RtLEDService.exe [311296 2010-02-05] (Realtek Semiconductor Corp.)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-29] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-29] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-29] (Avira Operations GmbH & Co. KG)
S3 Bridge0; C:\Windows\System32\drivers\WDBridge.sys [79376 2009-07-16] (Lenovo)
R3 JmUsbCcgp; C:\Windows\System32\DRIVERS\jmccgp.sys [17520 2009-12-03] (JMicron Technology Corp.)
R3 JmUsbVideo; C:\Windows\System32\Drivers\jmcam.sys [54000 2009-12-03] (JMicron Technology Corp.)
R3 JmUsbVideo2; C:\Windows\System32\Drivers\jmcam_lo.sys [28656 2009-12-03] (JMicron Technology Corp.)
R3 wdmirror; C:\Windows\System32\DRIVERS\WDMirror.sys [11280 2009-07-16] (Lenovo)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-31 11:33 - 2013-08-31 11:33 - 00219307 _____ C:\Users\SV\Desktop\SpybotSD.Results.txt
2013-08-31 11:13 - 2013-08-31 11:13 - 00377856 _____ C:\Users\SV\Desktop\gmer_2.1.19163.exe
2013-08-31 11:12 - 2013-08-31 11:12 - 00000466 _____ C:\Users\SV\Desktop\defogger_disable.log
2013-08-31 11:12 - 2013-08-31 11:12 - 00000000 _____ C:\Users\SV\defogger_reenable
2013-08-31 11:04 - 2013-08-31 11:04 - 00050477 _____ C:\Users\SV\Desktop\Defogger.exe
2013-08-30 20:18 - 2013-08-30 20:18 - 00000000 ____D C:\FRST
2013-08-30 08:32 - 2013-08-30 08:39 - 00000000 ____D C:\windows\system32\MRT
2013-08-30 08:25 - 2013-07-25 05:54 - 17830400 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2013-08-30 08:25 - 2013-07-25 05:37 - 02312704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2013-08-30 08:25 - 2013-07-25 05:35 - 10926080 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2013-08-30 08:25 - 2013-07-25 05:31 - 01346560 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2013-08-30 08:25 - 2013-07-25 05:30 - 01392128 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2013-08-30 08:25 - 2013-07-25 05:29 - 01494528 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2013-08-30 08:25 - 2013-07-25 05:29 - 00237056 _____ (Microsoft Corporation) C:\windows\system32\url.dll
2013-08-30 08:25 - 2013-07-25 05:29 - 00086016 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 02147840 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00816640 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00729088 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00599040 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2013-08-30 08:25 - 2013-07-25 05:28 - 00173056 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2013-08-30 08:25 - 2013-07-25 05:27 - 02382848 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2013-08-30 08:25 - 2013-07-25 05:27 - 00096768 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2013-08-30 08:25 - 2013-07-25 05:26 - 00248320 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2013-08-30 08:25 - 2013-07-25 04:40 - 12334080 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2013-08-30 08:25 - 2013-07-25 04:32 - 01800704 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2013-08-30 08:25 - 2013-07-25 04:30 - 09738752 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2013-08-30 08:25 - 2013-07-25 04:26 - 01129472 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2013-08-30 08:25 - 2013-07-25 04:26 - 01104384 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2013-08-30 08:25 - 2013-07-25 04:25 - 01427968 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2013-08-30 08:25 - 2013-07-25 04:24 - 00231936 _____ (Microsoft Corporation) C:\windows\SysWOW64\url.dll
2013-08-30 08:25 - 2013-07-25 04:24 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 01796096 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00717824 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00607744 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00420864 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2013-08-30 08:25 - 2013-07-25 04:23 - 00142848 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2013-08-30 08:25 - 2013-07-25 04:22 - 02382848 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2013-08-30 08:25 - 2013-07-25 04:22 - 00176640 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2013-08-30 08:25 - 2013-07-25 04:22 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2013-08-29 13:06 - 2013-08-29 13:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-29 12:57 - 2013-08-29 12:57 - 00000000 ____D C:\Users\SV\AppData\Roaming\Avira
2013-08-29 12:52 - 2013-08-29 12:52 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-08-29 12:51 - 2013-08-29 12:51 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-29 12:45 - 2013-08-29 12:51 - 00000000 ____D C:\ProgramData\Avira
2013-08-29 12:45 - 2013-08-29 12:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-29 12:45 - 2013-08-29 11:35 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-08-29 12:45 - 2013-08-29 11:35 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-08-29 12:45 - 2013-08-29 11:35 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-08-29 11:45 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL
2013-08-29 11:45 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL
2013-08-29 11:45 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2013-08-29 11:45 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2013-08-29 11:45 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\windows\system32\wintrust.dll
2013-08-29 11:45 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2013-08-29 11:45 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\windows\system32\crypt32.dll
2013-08-29 11:45 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\windows\system32\cryptsvc.dll
2013-08-29 11:45 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\windows\system32\cryptnet.dll
2013-08-29 11:45 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2013-08-29 11:45 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\windows\SysWOW64\wintrust.dll
2013-08-29 11:45 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\windows\SysWOW64\crypt32.dll
2013-08-29 11:45 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptsvc.dll
2013-08-29 11:45 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptnet.dll
2013-08-29 11:45 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys
2013-08-29 11:45 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tssecsrv.sys

==================== One Month Modified Files and Folders =======

2013-08-31 11:45 - 2010-08-25 14:19 - 01926643 _____ C:\windows\WindowsUpdate.log
2013-08-31 11:38 - 2009-07-14 06:45 - 00013632 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-31 11:38 - 2009-07-14 06:45 - 00013632 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-31 11:36 - 2013-08-31 11:36 - 01587214 _____ (Farbar) C:\Users\SV\Desktop\FRST64.exe
2013-08-31 11:33 - 2013-08-31 11:33 - 00219307 _____ C:\Users\SV\Desktop\SpybotSD.Results.txt
2013-08-31 11:13 - 2013-08-31 11:13 - 00377856 _____ C:\Users\SV\Desktop\gmer_2.1.19163.exe
2013-08-31 11:12 - 2013-08-31 11:12 - 00000466 _____ C:\Users\SV\Desktop\defogger_disable.log
2013-08-31 11:12 - 2013-08-31 11:12 - 00000000 _____ C:\Users\SV\defogger_reenable
2013-08-31 11:12 - 2011-01-19 19:05 - 00000000 ____D C:\Users\SV
2013-08-31 11:04 - 2013-08-31 11:04 - 00050477 _____ C:\Users\SV\Desktop\Defogger.exe
2013-08-31 10:59 - 2012-04-27 20:58 - 00000884 _____ C:\windows\Tasks\Adobe Flash Player Updater.job
2013-08-31 10:51 - 2011-01-22 12:38 - 00000000 ____D C:\Users\SV\AppData\Roaming\Dropbox
2013-08-31 10:50 - 2011-01-22 12:39 - 00000000 ___RD C:\Users\SV\Dropbox
2013-08-31 10:48 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2013-08-31 10:48 - 2009-07-14 06:51 - 00092463 _____ C:\windows\setupact.log
2013-08-30 20:18 - 2013-08-30 20:18 - 00000000 ____D C:\FRST
2013-08-30 19:30 - 2010-08-25 14:37 - 00594520 _____ C:\windows\PFRO.log
2013-08-30 17:35 - 2012-04-26 20:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-30 08:51 - 2011-01-19 21:45 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-30 08:46 - 2010-08-25 22:04 - 00657910 _____ C:\windows\system32\perfh007.dat
2013-08-30 08:46 - 2010-08-25 22:04 - 00131250 _____ C:\windows\system32\perfc007.dat
2013-08-30 08:46 - 2009-07-14 07:13 - 01529334 _____ C:\windows\system32\PerfStringBackup.INI
2013-08-30 08:39 - 2013-08-30 08:32 - 00000000 ____D C:\windows\system32\MRT
2013-08-30 08:31 - 2011-02-23 22:19 - 78161360 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2013-08-30 08:24 - 2009-07-14 05:20 - 00000000 ____D C:\windows\system32\NDF
2013-08-29 17:16 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2013-08-29 13:06 - 2013-08-29 13:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-29 12:57 - 2013-08-29 12:57 - 00000000 ____D C:\Users\SV\AppData\Roaming\Avira
2013-08-29 12:52 - 2013-08-29 12:52 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avnetflt.sys
2013-08-29 12:51 - 2013-08-29 12:51 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-29 12:51 - 2013-08-29 12:45 - 00000000 ____D C:\ProgramData\Avira
2013-08-29 12:45 - 2013-08-29 12:45 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-29 11:59 - 2012-04-27 20:58 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2013-08-29 11:59 - 2012-04-27 20:58 - 00003822 _____ C:\windows\System32\Tasks\Adobe Flash Player Updater
2013-08-29 11:59 - 2011-06-29 18:48 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-29 11:35 - 2013-08-29 12:45 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avipbb.sys
2013-08-29 11:35 - 2013-08-29 12:45 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avgntflt.sys
2013-08-29 11:35 - 2013-08-29 12:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\windows\system32\Drivers\avkmgr.sys
2013-08-07 04:22 - 2011-01-19 19:19 - 00278800 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe

Files to move or delete:
====================
C:\Users\Simon\AppData\Local\Temp\AskSLib.dll
C:\Users\Simon\AppData\Local\Temp\nsc1E89.exe
C:\Users\Simon\AppData\Local\Temp\nssE995.exe
C:\Users\Simon\AppData\Local\Temp\nsx131E.exe
C:\Users\Simon\AppData\Local\Temp\nsxB324.exe
C:\Users\Simon\AppData\Local\Temp\SearchHelper.exe
C:\Users\Simon\AppData\Local\Temp\SecondStepInstaller.exe
C:\Users\Simon\AppData\Local\Temp\SPStub.exe
C:\Users\Simon\AppData\Local\Temp\ct3281675\ffLogic.exe
C:\Users\Simon\AppData\Local\Temp\ct3281675\ieLogic.exe
C:\Users\Simon\AppData\Local\Temp\ct3281675\spff.exe
C:\Users\Simon\AppData\Local\Temp\ct3281675\statisticsStub.exe
C:\Users\SV\AppData\Local\Temp\NOSEventMessages.dll
C:\Users\SV\AppData\Local\Temp\ose00000.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-29 17:03

==================== End Of Log ============================

Logfile FRS addition .txt:

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 30-08-2013 01
Ran by SV at 2013-08-31 11:49:03
Running from C:\Users\SV\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

   
 Update for Microsoft Office 2007 (KB2508958) (x32)
AAVUpdateManager (x32 Version: 18.00.0000)
Adobe AIR (x32 Version: 3.0.0.4080)
Adobe Community Help (x32 Version: 3.4.980)
Adobe Content Viewer (x32 Version: 1.4.0)
Adobe Download Assistant (x32 Version: 1.0.6)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94)
Adobe InDesign CS5.5 (x32 Version: 7.5)
Adobe Media Player (x32 Version: 1.8)
Adobe Reader XI (11.0.03) - Deutsch (x32 Version: 11.0.03)
Akamai NetSession Interface (HKCU)
Akamai NetSession Interface Service (x32)
Allway Sync version 11.3.11 (x32)
ANNO 1602 (x32)
Apple Application Support (x32 Version: 2.3.4)
Apple Mobile Device Support (Version: 3.4.1.2)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.26)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
Bing Bar (x32 Version: 7.0.850.0)
BioExcess (x32 Version: 6.0.48.175)
Bonjour (Version: 3.0.0.2)
Broadcom 802.11 Wireless Driver (x32 Version: 1.0.0.0)
CyberLink YouCam (x32 Version: 3.0.2626)
Die Siedler IV (x32)
dm-Fotowelt (x32)
dows-Treiberpaket - Lenovo (ACPIVPC) System  (10/19/2009 5.4.0.1) (Version: 10/19/2009 5.4.0.1)
Dropbox (HKCU Version: 2.0.22)
Dungeon Keeper 2 (x32 Version: 2.0.0.32)
Energy Management (x32 Version: 5.4.1.9)
entrusted Toolbar (x32 Version: 6.11.2.6)
ETDWare PS/2-x64 7.0.4.17_WHQL (Version: 7.0.4.17)
GIMP 2.8.0 (Version: 2.8.0)
GOG.com Dungeon Keeper 2
Intel(R) Control Center (x32 Version: 1.2.1.1007)
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2104)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) Matrix Storage Manager
iTunes (Version: 10.4.1.10)
Java 7 Update 25 (x32 Version: 7.0.250)
Java Auto Updater (x32 Version: 2.1.9.5)
Junk Mail filter update (x32 Version: 14.0.8089.726)
Lenovo Bluetooth with Enhanced Data Rate Software (Version: 6.2.1.1900)
Lenovo EasyCamera (x32 Version: 1.0.7.1)
Lenovo OneKey Recovery (Version: 7.0.1628)
Lenovo OneKey Recovery (x32 Version: 7.0.1628)
Lenovo ReadyComm 5 (x32 Version: 5.1.1.20)
Lenovo ReadyComm 5.0 Service (x32 Version: 5.0.0.1)
Lenovo Security Suite (x32 Version: 2.0.10.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Choice Guard (x32 Version: 2.0.48.0)
Microsoft IntelliPoint 8.0 (Version: 8.01.249.0)
Microsoft Office 2003 Web Components (x32 Version: 11.0.8003.0)
Microsoft Office 2007 Primary Interop Assemblies (x32 Version: 12.0.4518.1014)
Microsoft Office 2007 Service Pack 3 (SP3) (x32)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (x32 Version: 2.0.4024.1)
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32)
Microsoft Office Publisher MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Small Business 2007 (x32 Version: 12.0.6612.1000)
Microsoft Office Small Business Connectivity Components (x32 Version: 2.0.7024.0)
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft SQL Server Native Client (Version: 9.00.4035.00)
Microsoft SQL Server VSS Writer (Version: 9.00.4035.00)
Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft_VC100_CRT_SP1_x64 (Version: 10.0.40219.1)
Microsoft_VC100_CRT_SP1_x86 (x32 Version: 10.0.40219.1)
Microsoft_VC80_ATL_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (x32 Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (x32 Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (x32 Version: 1.00.0000)
Mozilla Firefox 23.0.1 (x86 de) (x32 Version: 23.0.1)
Mozilla Maintenance Service (x32 Version: 23.0.1)
MSVC80_x64_v2 (Version: 1.0.3.0)
MSVC80_x86_v2 (x32 Version: 1.0.3.0)
MSVC90_x64 (Version: 1.0.1.2)
MSVC90_x86 (x32 Version: 1.0.1.2)
MSVCRT (x32 Version: 14.0.1468.721)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
Nokia Connectivity Cable Driver (x32 Version: 7.1.69.0)
Nokia Suite (x32 Version: 3.3.86.0)
NVIDIA Drivers (Version: 1.10.59.37)
NVIDIA Updatus (x32 Version: 1.0.3)
Ocster Backup: Freeware Windows Edition (Version: 1.71)
PC Connectivity Solution (x32 Version: 11.5.29.0)
PDF Architect (x32 Version: 1.0.52.8917)
PDF Settings CS5 (x32 Version: 10.0)
PDFCreator (x32 Version: 1.6.2)
PDFTK Builder 3.5.3 (x32)
Port Locker (Version: 1.0.5.20)
Port Locker (x32 Version: 1.0.5.20)
Power2Go (x32 Version: 5.6.0.4809d4)
QuickTime (x32 Version: 7.74.80.86)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6128)
Realtek USB 2.0 Card Reader (x32 Version: 6.1.7600.30117)
RtLED (Version: 1.0.2)
Skype Click to Call (x32 Version: 5.6.8442)
Skype™ 5.10 (x32 Version: 5.10.116)
Spybot - Search & Destroy (x32 Version: 1.6.2)
Steuer-Spar-Erklärung 2013 (x32 Version: 18.08)
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch) (x32 Version: 9.00.4035.00)
Update for 2007 Microsoft Office System (KB967642) (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition (x32)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition (x32)
Update für Microsoft Office Excel 2007 Help (KB963678) (x32)
Update für Microsoft Office Outlook 2007 Help (KB963677) (x32)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (x32)
Update für Microsoft Office Word 2007 Help (KB963665) (x32)
VLC media player 2.0.7 (x32 Version: 2.0.7)
Windows Driver Package - Broadcom (BTHUSB) Bluetooth  (04/08/2010 6.3.5.430) (Version: 04/08/2010 6.3.5.430)
Windows Driver Package - Broadcom HIDClass  (07/28/2009 6.2.0.9800) (Version: 07/28/2009 6.2.0.9800)
Windows Live Anmelde-Assistent (x32 Version: 5.000.818.5)
Windows Live Call (x32 Version: 14.0.8064.0206)
Windows Live Communications Platform (x32 Version: 14.0.8064.206)
Windows Live Essentials (x32 Version: 14.0.8089.0726)
Windows Live Essentials (x32 Version: 14.0.8089.726)
Windows Live Fotogalerie (x32 Version: 14.0.8081.709)
Windows Live Mail (x32 Version: 14.0.8089.0726)
Windows Live Messenger (x32 Version: 14.0.8089.0726)
Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
Windows Live Sync (x32 Version: 14.0.8089.726)
Windows Live Writer (x32 Version: 14.0.8089.0726)
Windows Live-Uploadtool (x32 Version: 14.0.8014.1029)
Windows-Treiberpaket - Nokia pccsmcfd  (08/22/2008 7.0.0.0) (Version: 08/22/2008 7.0.0.0)

==================== Restore Points  =========================

20-07-2013 05:40:14 Windows Update
22-07-2013 18:09:30 Installed QuickTime
24-07-2013 17:52:48 Windows Update
27-07-2013 19:59:17 Windows Update
29-08-2013 09:44:53 Windows Update
30-08-2013 06:22:34 Windows Update

==================== Hosts content: ==========================

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {08884F61-0407-4643-9EF0-C2C12ABC51AC} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => c:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-01-07] (Microsoft Corporation)
Task: {168438C0-F13D-40C8-90A4-467F62037569} - System32\Tasks\WPD\SqmUpload_S-1-5-21-771582602-4057858738-3947029243-1002 => C:\Windows\System32\portabledeviceapi.dll [2010-11-20] (Microsoft Corporation)
Task: {724E1C32-436F-468E-B39A-63AB4815972E} - System32\Tasks\{FE86DCAC-4D1D-4437-8903-F891E9BAC1B7} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {A4FB338E-B23C-448D-B409-C6D369E8B618} - System32\Tasks\{2344DDD3-C7B3-40C4-95C3-646859A92794} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2012-07-13] (Skype Technologies S.A.)
Task: {D9DC6A1A-E785-41A1-8123-20E1022E6515} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation)
Task: {E66E79BD-C63B-4624-B81D-0556634807DC} - System32\Tasks\AdobeAAMUpdater-1.0-SV-PC-SV => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2011-03-15] (Adobe Systems Incorporated)
Task: {FFE4E2DE-C374-4F2A-BF45-ACA2C8D590EF} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-29] (Adobe Systems Incorporated)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

==================== Loaded Modules (whitelisted) =============

2010-05-17 14:08 - 2010-04-07 11:26 - 00095848 _____ (NVIDIA Corporation) C:\windows\system32\nvinitx.dll
2009-07-14 02:22 - 2009-07-14 03:38 - 00081408 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm
2011-06-29 18:04 - 2011-06-29 18:04 - 03249952 _____ () c:\Program Files\Ocster Backup\bin\ox.dll
2011-06-26 01:40 - 2011-06-26 01:40 - 00641024 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_xrc_vc_ox.dll
2011-06-26 01:40 - 2011-06-26 01:40 - 00622592 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_html_vc_ox.dll
2011-06-26 01:39 - 2011-06-26 01:39 - 03663872 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_core_vc_ox.dll
2011-06-26 01:38 - 2011-06-26 01:38 - 01488384 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxbase28u_vc_ox.dll
2011-06-26 01:39 - 2011-06-26 01:39 - 00875520 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxmsw28u_adv_vc_ox.dll
2011-06-26 01:40 - 2011-06-26 01:40 - 00157696 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxbase28u_xml_vc_ox.dll
2011-06-26 01:38 - 2011-06-26 01:38 - 00152576 _____ (wxWidgets development team) c:\Program Files\Ocster Backup\bin\wxbase28u_net_vc_ox.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00267776 _____ (Microsoft Corporation) C:\windows\system32\ACTIVEDS.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00236544 _____ (Microsoft Corporation) C:\windows\system32\adsldpc.dll
2010-05-27 09:55 - 2012-01-10 22:06 - 09528832 _____ (Intel Corporation) C:\windows\system32\igd10umd64.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00391456 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btmmhook.dll
2013-05-25 02:36 - 2013-05-25 02:36 - 00164016 _____ (Dropbox, Inc.) C:\Users\SV\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
2013-01-11 19:04 - 2012-12-07 15:20 - 00441856 _____ (Microsoft Corporation) C:\windows\System32\Wpc.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00557344 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btncopy.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00748032 _____ (Microsoft Corporation) C:\windows\system32\FirewallAPI.dll
2009-07-14 01:53 - 2009-07-14 03:40 - 00062976 _____ (Microsoft Corporation) C:\windows\system32\dfscli.dll
2012-08-28 20:13 - 2012-07-05 00:13 - 00059392 _____ (Microsoft Corporation) C:\windows\system32\browcli.dll
2013-03-16 12:58 - 2010-11-20 15:27 - 00145920 _____ (Microsoft Corporation) C:\windows\system32\SPPC.DLL
2013-03-16 13:00 - 2010-11-20 15:27 - 00501248 _____ (Microsoft Corporation) C:\windows\system32\WinSATAPI.dll
2009-07-14 01:26 - 2009-07-14 03:41 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\SPINF.dll
2009-07-14 02:08 - 2009-07-14 03:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\NetworkItemFactory.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00036352 _____ (Microsoft Corporation) C:\windows\system32\dtsh.dll
2009-07-14 01:35 - 2009-07-14 03:40 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\FunDisc.dll
2013-03-16 12:52 - 2010-11-20 15:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\fdproxy.dll
2009-07-14 02:08 - 2009-07-14 03:40 - 00101376 _____ (Microsoft Corporation) C:\windows\System32\fdwcn.dll
2009-07-14 02:08 - 2009-07-14 03:41 - 00120832 _____ (Microsoft Corporation) C:\windows\System32\wcnapi.dll
2009-07-14 01:35 - 2009-07-14 03:40 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\fdWNet.dll
2013-06-19 19:44 - 2013-06-19 19:44 - 01908880 _____ (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OFFICE11\msxml5.dll
2009-07-14 02:17 - 2009-07-14 03:40 - 00024576 _____ (Microsoft Corporation) C:\windows\System32\drprov.dll
2013-03-16 12:53 - 2010-11-20 15:27 - 00129536 _____ (Microsoft Corporation) C:\windows\System32\ntlanman.dll
2013-03-16 13:00 - 2010-11-20 15:26 - 00100864 _____ (Microsoft Corporation) C:\windows\System32\davclnt.dll
2009-07-14 01:23 - 2009-07-14 03:40 - 00025600 _____ (Microsoft Corporation) C:\windows\System32\DAVHLPR.dll
2013-08-29 12:45 - 2013-08-29 11:34 - 00231480 _____ (Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avsda64.dll
2011-07-12 11:33 - 2011-07-12 11:33 - 00132968 _____ (Apple Inc.) C:\Program Files\Bonjour\mdnsNSP.dll
2009-07-14 01:42 - 2009-07-14 03:41 - 01039872 _____ (Microsoft Corporation) C:\windows\system32\OPENGL32.dll
2009-07-14 01:42 - 2009-07-14 03:40 - 00165376 _____ (Microsoft Corporation) C:\windows\system32\GLU32.dll
2009-07-14 01:41 - 2009-07-14 03:40 - 00569344 _____ (Microsoft Corporation) C:\windows\system32\DDRAW.dll
2009-07-14 01:38 - 2009-07-14 03:40 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\DCIMAN32.dll
2010-05-27 09:55 - 2012-01-10 21:19 - 00110080 _____ (Intel Corporation) C:\Windows\System32\hccutils.DLL
2010-05-27 09:55 - 2012-01-10 21:19 - 00062464 _____ (Intel Corporation) C:\windows\system32\igfxsrvc.dll
2012-01-10 21:20 - 2012-01-10 21:20 - 00286720 _____ (Intel Corporation) C:\windows\system32\igfxrDEU.lrc
2010-05-27 09:55 - 2012-01-10 21:18 - 09014784 _____ (Intel Corporation) C:\Windows\System32\igfxress.dll
2012-01-10 21:12 - 2012-01-10 21:12 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2009-07-14 02:02 - 2009-07-14 03:41 - 02103296 _____ (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InkObj.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00717088 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwapi.dll
2011-06-17 20:24 - 2011-06-17 20:24 - 01658368 _____ (Microsoft Corporation) C:\windows\WinSxS\amd64_microsoft.vc80.mfc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_8448b2bd328df189\MFC80.DLL
2010-04-20 15:29 - 2010-04-20 15:29 - 00349472 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btosif.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00504608 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwhidcs.DLL
2009-07-14 02:09 - 2009-07-14 03:38 - 00425984 _____ (Microsoft Corporation) C:\windows\system32\irprops.cpl
2010-08-25 14:45 - 2010-04-20 07:29 - 00139040 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtBalloon.dll
2011-06-17 20:24 - 2011-06-17 20:24 - 00054272 _____ (Microsoft Corporation) C:\windows\WinSxS\amd64_microsoft.vc80.mfcloc_1fc8b3b9a1e18e3b_8.0.50727.6195_none_bc20f59b0bdd1acd\MFC80DEU.DLL
2010-04-20 15:29 - 2010-04-20 15:29 - 23913760 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btrez.dll
2013-03-16 12:52 - 2010-11-20 15:27 - 00047104 _____ (Microsoft Corporation) C:\windows\System32\wshBth.dll
2010-04-20 15:29 - 2010-04-20 15:29 - 00393504 _____ (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\BtwCP.DLL

==================== Alternate Data Streams (whitelisted) ==========



==================== Faulty Device Manager Devices =============

Name: Broadcom BCM2070 Bluetooth 2.1+EDR USB Device
Description: Broadcom BCM2070 Bluetooth 2.1+EDR USB Device
Class Guid: {e0cbf06c-cd8b-4647-bb8a-263b43f0f974}
Manufacturer: Broadcom
Service: BTHUSB
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Atheros AR8131 PCI-E Gigabit Ethernet Controller
Description: Atheros AR8131 PCI-E Gigabit Ethernet Controller
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Atheros
Service: L1C
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/31/2013 10:49:20 AM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Ausnahmecode: 0xc000000d
Fehleroffset: 0x0006cd9a
ID des fehlerhaften Prozesses: 0x8b0
Startzeit der fehlerhaften Anwendung: 0xdaemonu.exe0
Pfad der fehlerhaften Anwendung: daemonu.exe1
Pfad des fehlerhaften Moduls: daemonu.exe2
Berichtskennung: daemonu.exe3

Error: (08/30/2013 07:31:19 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Ausnahmecode: 0xc000000d
Fehleroffset: 0x0006cd9a
ID des fehlerhaften Prozesses: 0x8ac
Startzeit der fehlerhaften Anwendung: 0xdaemonu.exe0
Pfad der fehlerhaften Anwendung: daemonu.exe1
Pfad des fehlerhaften Moduls: daemonu.exe2
Berichtskennung: daemonu.exe3

Error: (08/30/2013 07:01:32 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Ausnahmecode: 0xc000000d
Fehleroffset: 0x0006cd9a
ID des fehlerhaften Prozesses: 0x980
Startzeit der fehlerhaften Anwendung: 0xdaemonu.exe0
Pfad der fehlerhaften Anwendung: daemonu.exe1
Pfad des fehlerhaften Moduls: daemonu.exe2
Berichtskennung: daemonu.exe3

Error: (08/30/2013 05:37:59 PM) (Source: Application Error) (User: )
Description: Name der fehlerhaften Anwendung: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Name des fehlerhaften Moduls: daemonu.exe, Version: 2.0.2.414, Zeitstempel: 0x4bbc78b6
Ausnahmecode: 0xc000000d
Fehleroffset: 0x0006cd9a
ID des fehlerhaften Prozesses: 0x82c
Startzeit der fehlerhaften Anwendung: 0xdaemonu.exe0
Pfad der fehlerhaften Anwendung: daemonu.exe1
Pfad des fehlerhaften Moduls: daemonu.exe2
Berichtskennung: daemonu.exe3

Error: (08/30/2013 02:03:49 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (08/30/2013 02:03:15 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1". Fehler in Manifest- oder Richtliniendatei "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" in Zeile  WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
Die im Manifest gefundene Komponenten-ID stimmt nicht mit der ID der angeforderten Komponente überein.
Verweis: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
Definition: WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
Verwenden Sie das Programm "sxstrace.exe" für eine detaillierte Diagnose.

Error: (08/30/2013 01:58:19 PM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Mehrere requestedPrivileges-Elemente sind nicht im Manifest zulässig.

Error: (08/30/2013 08:24:16 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)

Error: (08/30/2013 08:24:16 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreMachineSleep: mDNS_Lock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)

Error: (08/29/2013 07:23:22 PM) (Source: Bonjour Service) (User: )
Description: mDNSCoreMachineSleep: mDNS_Unlock: Locking failure! mDNS_busy (1) != mDNS_reentrancy (0)


System errors:
=============
Error: (08/31/2013 10:50:23 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Media Player-Netzwerkfreigabedienst" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/31/2013 10:50:23 AM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Media Player-Netzwerkfreigabedienst erreicht.

Error: (08/31/2013 10:49:28 AM) (Source: Service Control Manager) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/31/2013 10:48:50 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/30/2013 07:34:21 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Microsoft .NET Framework NGEN v4.0.30319_X64 erreicht.

Error: (08/30/2013 07:32:38 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/30/2013 07:32:38 PM) (Source: Service Control Manager) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Search erreicht.

Error: (08/30/2013 07:32:38 PM) (Source: DCOM) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (08/30/2013 07:31:35 PM) (Source: Service Control Manager) (User: )
Description: Dienst "NVIDIA Update Service Daemon" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.

Error: (08/30/2013 07:31:01 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "ReadyComm.DirectRouter" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2


Microsoft Office Sessions:
=========================
Error: (08/27/2011 00:40:45 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 16212 seconds with 1680 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2011-03-21 20:27:50.799
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 19:55:10.086
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 18:29:11.865
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 18:11:39.837
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 17:51:16.982
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 17:43:33.794
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 17:31:11.629
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 17:17:53.056
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 16:43:28.975
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-03-21 16:32:03.337
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 73%
Total physical RAM: 1844.43 MB
Available physical RAM: 492.36 MB
Total Pagefile: 3688.86 MB
Available Pagefile: 1517.59 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:421.81 GB) (Free:313.86 GB) NTFS
Drive d: (LENOVO) (Fixed) (Total:29 GB) (Free:27.85 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 1C58B5AE)
Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=422 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=29 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=15 GB) - (Type=12)

==================== End Of Log ============================

Logfile gmer (spybot deaktiviert):

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-31 12:14:48
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\SV\AppData\Local\Temp\pxldypoc.sys


---- Threads - GMER 2.1 ----

Thread  C:\windows\System32\spoolsv.exe [1500:2940]                                                      000007fef5cc10c8
Thread  C:\windows\System32\spoolsv.exe [1500:2952]                                                      000007fef5c86144
Thread  C:\windows\System32\spoolsv.exe [1500:2956]                                                      000007fef95b5fd0
Thread  C:\windows\System32\spoolsv.exe [1500:2960]                                                      000007fef5c63438
Thread  C:\windows\System32\spoolsv.exe [1500:2964]                                                      000007fef95b63ec
Thread  C:\windows\System32\spoolsv.exe [1500:2972]                                                      000007fef77c5e5c
Thread  C:\windows\System32\spoolsv.exe [1500:2976]                                                      000007fef7815074
Thread  C:\windows\system32\svchost.exe [1572:1612]                                                      000007fefd201a70
Thread  C:\windows\system32\svchost.exe [1572:1620]                                                      000007fefd201a70
Thread  C:\windows\system32\svchost.exe [1572:1632]                                                      000007fefd201a70
Thread  C:\windows\system32\svchost.exe [1572:1640]                                                      000007fef9dc2c70
Thread  C:\windows\system32\svchost.exe [1572:1648]                                                      000007fef9dcfb40
Thread  C:\windows\system32\svchost.exe [1572:1660]                                                      000007fef9de1d20
Thread  C:\windows\system32\svchost.exe [1572:1664]                                                      000007fef9dcf6f0
Thread  C:\windows\system32\svchost.exe [1572:2032]                                                      000007fef9ab35c0
Thread  C:\windows\system32\svchost.exe [1572:4304]                                                      000007fef9ab5600
Thread  C:\windows\system32\svchost.exe [1572:1952]                                                      000007fef0bb2940
Thread  C:\windows\system32\svchost.exe [1572:1096]                                                      000007fef0b92888
Thread  C:\windows\system32\svchost.exe [1572:3716]                                                      000007fef0b92a40
Thread  C:\windows\System32\svchost.exe [1496:5048]                                                      000007fef68f9688

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                      
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002713f26ae8                      
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)  
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002713f26ae8 (not active ControlSet)  

---- EOF - GMER 2.1 ----

Ich habe hoffentlich nichts vergessen. Bitte bitte helft mir den kleinen Scheißer wieder los zu werden.

Vielen Dank.

P.S. Ich habe es gar nicht erst mit Adwcleaner versucht, da ich die anderen Threads zu dem Thema so verstanden haben, dass dies u.U. nicht so einfach geht.

Windows 7: Win32.downloader.gen Infektion

Log-Analyse und Auswertung: Windows 7: Win32.downloader.gen Infektion

Windows 7: Win32.downloader.gen Infektion

Ähnliche Themen: Windows 7: Win32.downloader.gen Infektion