![]() |
|
Log-Analyse und Auswertung: ihavenet trojaner eingefangen - einschlägige clean software bringt nichtsWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
![]() | #1 |
| ![]() ihavenet trojaner eingefangen - einschlägige clean software bringt nichts Hallo! seit etwa 10 Tagen leitet mein notebook google-treffer auf verschiedene seiten um - hauptsächlich ihavenet-seiten. ich habe verschiedene programme durchlaufen lassen, aber der fehler kam spätestens nach wenigen minuten wieder. was vielleicht noch erwähnenswert ist: das windows sicherheitscenter startet nicht mehr, ist also deaktiviert. wenn ich ihn manuell starte, beendet er sich nach ca. einer minute wieder, und lässt sich nicht wieder starten. da ich schon 2 andere posts beobachtet habe, habe ich schon einmal das programm FRST durchlaufen lassen (ohne checkboxen zu verändern) Ergebnis FRST.txt: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-08-2013 04 Ran by Gisela d (administrator) on GISELAd on 31-08-2013 21:07:01 Running from E:\ Microsoft Windows 7 Professional Service Pack 1 (X86) OS Language: German Standard Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (AuthenTec, Inc.) C:\Program Files\Fingerprint Sensor\AtService.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Firebird Project) C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [278528 2010-02-17] (Alps Electric Co., Ltd.) HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [345144 2013-06-27] (Avira Operations GmbH & Co. KG) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [SDTray] - C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\SDWinLogon: SDWinLogon.dll [X] HKCU\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [5703408 2013-08-12] (SUPERAntiSpyware) BootExecute: autocheck autochk * sdnclean.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKCU - {6238FE9C-8CA3-41E5-9B3E-2D4F89DBBF5D} URL = hxxp://www.google.de/search?q={searchTerms} SearchScopes: HKCU - {F4C638A0-D405-4C5E-A84D-141730F4E793} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=U3&apn_dtid=OSJ000YYDE&apn_uid=9A115A87-90F7-42CF-B5DD-79084EA9769D&apn_sauid=3EF06D77-FED7-42D1-823A-4829A8E7DABF BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://active.macromedia.com/flash2/cabs/swflash.cab ShellExecuteHooks: SABShellExecuteHook Class - {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [115440 2013-05-08] (SuperAdBlocker.com) Tcpip\Parameters: [DhcpNameServer] 192.168.2.1 FireFox: ======== FF ProfilePath: C:\Users\Gisela d\AppData\Roaming\Mozilla\Firefox\Profiles\f46uhsx8.default FF DefaultSearchEngine: Google FF Homepage: about:blank FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\Gisela d\AppData\Roaming\Mozilla\Firefox\Profiles\f46uhsx8.default\searchplugins\ixquick---deutsch.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazondotcom-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\leo_ende_de.xml FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-de.xml FF Extension: Flashblock - C:\Users\Gisela d\AppData\Roaming\Mozilla\Firefox\Profiles\f46uhsx8.default\Extensions\{3d7eb24f-2740-49df-8937-200b1cc08f8a} FF Extension: No Name - C:\Users\Gisela d\AppData\Roaming\Mozilla\Firefox\Profiles\f46uhsx8.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi FF Extension: No Name - C:\Users\Gisela d\AppData\Roaming\Mozilla\Firefox\Profiles\f46uhsx8.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: No Name - C:\Users\Gisela d\AppData\Roaming\Mozilla\Firefox\Profiles\f46uhsx8.default\Extensions\{d40f5e7b-d2cf-4856-b441-cc613eeffbe3}.xpi ========================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE.EXE [119056 2013-05-23] (SUPERAntiSpyware.com) R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [84024 2013-06-27] (Avira Operations GmbH & Co. KG) R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [108088 2013-06-27] (Avira Operations GmbH & Co. KG) R2 ATService; C:\Program Files\Fingerprint Sensor\AtService.exe [1803512 2009-05-15] (AuthenTec, Inc.) R2 FirebirdGuardianDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe [81920 2008-06-13] (Firebird Project) R3 FirebirdServerDefaultInstance; C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe [2723840 2008-06-13] (Firebird Project) R2 MBAMScheduler; C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 SDScannerService; C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.) R2 SDUpdateService; C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.) S2 SDWSCService; C:\Program Files\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== S3 acpials; C:\Windows\System32\DRIVERS\acpials.sys [7680 2009-07-14] (Microsoft Corporation) R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [84744 2013-03-28] (Avira Operations GmbH & Co. KG) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135136 2013-03-28] (Avira Operations GmbH & Co. KG) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-03-28] (Avira Operations GmbH & Co. KG) R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [22856 2013-04-04] (Malwarebytes Corporation) R0 PBADRV; C:\Windows\System32\DRIVERS\PBADRV.sys [26608 2008-06-04] (Dell Inc) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS [12880 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS [67664 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2012-08-27] (Avira GmbH) S3 thal2usb; C:\Windows\System32\Drivers\thal2usb.sys [29184 2009-01-12] (Thesycon GmbH, Germany) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [48128 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-31 20:08 - 2013-08-31 20:08 - 00000530 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e0e18174-165d-4c07-a33a-bc6d0edc3616.job 2013-08-31 20:08 - 2013-08-31 20:08 - 00000530 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 0236deb0-ba1a-40f7-ac2c-fcb82ed26be2.job 2013-08-31 20:08 - 2013-08-31 20:08 - 00000000 ____D C:\Users\Gisela d\AppData\Roaming\SUPERAntiSpyware.com 2013-08-31 20:07 - 2013-08-31 20:07 - 00001971 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk 2013-08-31 20:06 - 2013-08-31 20:08 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-08-31 20:06 - 2013-08-31 20:06 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2013-08-31 19:41 - 2013-08-31 19:41 - 00001024 _____ C:\.rnd 2013-08-30 22:45 - 2013-08-30 22:47 - 02050466 _____ C:\Users\Gisela d\Downloads\b_pdf.pdf.part 2013-08-28 00:03 - 2013-08-28 00:05 - 00000000 ____D C:\Users\Gisela d\Downloads\anti spyware programm setups von robert 2013-08-27 23:45 - 2013-08-31 19:40 - 00000000 ____D C:\AdwCleaner 2013-08-27 23:22 - 2013-08-27 23:22 - 00000000 ____D C:\Users\Gisela d\AppData\Roaming\Malwarebytes 2013-08-27 23:22 - 2013-08-27 23:22 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-08-27 23:22 - 2013-08-27 23:22 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-08-27 23:22 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2013-08-27 22:59 - 2013-08-27 22:59 - 00000000 ____D C:\Users\Gisela d\Documents\ProcAlyzer Dumps 2013-08-26 23:22 - 2013-08-27 22:59 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-26 23:21 - 2013-08-26 23:29 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-08-26 23:21 - 2009-01-25 13:14 - 00015224 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean.exe 2013-08-26 16:31 - 2013-08-31 19:41 - 00001693 _____ C:\Windows\setupact.log 2013-08-26 16:31 - 2013-08-26 16:31 - 00002296 _____ C:\Windows\PFRO.log 2013-08-26 16:31 - 2013-08-26 16:31 - 00000000 _____ C:\Windows\setuperr.log 2013-08-26 14:07 - 2013-08-26 14:07 - 00000000 ____D C:\Program Files\Speccy 2013-08-26 14:07 - 2013-08-26 14:07 - 00000000 ____D C:\Program Files\Recuva 2013-08-26 14:06 - 2013-08-26 14:06 - 00000000 ____D C:\Program Files\Defraggler 2013-08-26 14:05 - 2013-08-26 14:05 - 00000000 ____D C:\Program Files\CCleaner 2013-08-26 14:03 - 2013-08-26 14:03 - 04100432 _____ (Piriform Ltd) C:\Users\Gisela d\Downloads\dfsetup215.exe 2013-08-26 14:03 - 2013-08-26 14:03 - 03843072 _____ (Piriform Ltd) C:\Users\Gisela d\Downloads\rcsetup148.exe 2013-08-26 14:02 - 2013-08-26 14:02 - 04429440 _____ (Piriform Ltd) C:\Users\Gisela d\Downloads\ccsetup404.exe 2013-08-26 13:48 - 2013-08-26 14:08 - 00000000 ___RD C:\Users\Gisela d\Desktop\Werkzeuge 2013-08-26 13:29 - 2013-08-26 13:56 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-08-26 13:29 - 2012-08-23 16:48 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll 2013-08-26 13:29 - 2012-08-23 16:44 - 00014848 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys 2013-08-26 13:29 - 2012-08-23 16:40 - 00049664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys 2013-08-26 13:29 - 2012-08-23 16:10 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll 2013-08-26 13:29 - 2012-08-23 16:10 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe 2013-08-26 13:29 - 2012-08-23 15:52 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll 2013-08-26 13:29 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll 2013-08-26 13:29 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll 2013-08-26 13:29 - 2012-08-23 15:32 - 00032768 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll 2013-08-26 13:29 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2013-08-26 13:29 - 2012-08-23 13:40 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe 2013-08-26 13:29 - 2012-08-23 13:32 - 00317440 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe 2013-08-26 13:29 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll 2013-08-26 13:29 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll 2013-08-26 13:29 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe 2013-08-26 13:29 - 2012-08-23 12:08 - 02739712 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll 2013-08-26 13:29 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2013-08-26 13:28 - 2012-08-24 19:05 - 00136560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2013-08-26 13:28 - 2012-08-24 19:02 - 00369856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2013-08-26 13:28 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2013-08-26 13:28 - 2012-08-24 18:56 - 01039360 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2013-08-26 13:28 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll 2013-08-26 13:12 - 2013-08-26 13:18 - 05536272 _____ (TeamViewer GmbH) C:\Users\Gisela d\Downloads\TeamViewer_Setup_de.exe 2013-08-25 12:44 - 2013-08-31 19:41 - 00000330 _____ C:\Windows\Tasks\Zwmqp.job 2013-08-25 12:44 - 2013-08-25 12:44 - 00458752 __RSH C:\Windows\system32\winloads.dll 2013-08-19 09:42 - 2013-08-19 09:42 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-08-15 13:09 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-08-15 13:09 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-08-15 13:09 - 2013-07-26 05:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-08-15 13:09 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-15 13:09 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-08-15 13:09 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-08-15 13:09 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-08-15 13:09 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-08-15 08:33 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-15 08:33 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-15 08:33 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe 2013-08-15 08:33 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-15 08:33 - 2013-07-09 06:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-15 08:33 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-15 08:33 - 2013-07-09 06:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-15 08:33 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-15 08:33 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-15 08:33 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-15 08:33 - 2013-07-06 07:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-08-15 08:33 - 2013-06-15 05:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2013-08-12 10:23 - 2013-08-12 10:36 - 576240553 _____ (Igor Pavlov) C:\Users\Gisela d\Desktop\ipC3_OU_20130801.exe 2013-08-04 18:35 - 2013-08-15 13:12 - 00000000 ____D C:\Windows\system32\MRT ==================== One Month Modified Files and Folders ======= 2013-08-31 21:06 - 2013-08-31 21:06 - 00000000 ____D C:\FRST 2013-08-31 20:48 - 2012-07-27 21:44 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-31 20:16 - 2009-12-05 17:59 - 01563091 _____ C:\Windows\WindowsUpdate.log 2013-08-31 20:08 - 2013-08-31 20:08 - 00000530 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e0e18174-165d-4c07-a33a-bc6d0edc3616.job 2013-08-31 20:08 - 2013-08-31 20:08 - 00000530 _____ C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 0236deb0-ba1a-40f7-ac2c-fcb82ed26be2.job 2013-08-31 20:08 - 2013-08-31 20:08 - 00000000 ____D C:\Users\Gisela d\AppData\Roaming\SUPERAntiSpyware.com 2013-08-31 20:08 - 2013-08-31 20:06 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-08-31 20:07 - 2013-08-31 20:07 - 00001971 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk 2013-08-31 20:06 - 2013-08-31 20:06 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2013-08-31 19:49 - 2009-07-14 06:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-31 19:49 - 2009-07-14 06:34 - 00014032 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-31 19:41 - 2013-08-31 19:41 - 00001024 _____ C:\.rnd 2013-08-31 19:41 - 2013-08-26 16:31 - 00001693 _____ C:\Windows\setupact.log 2013-08-31 19:41 - 2013-08-25 12:44 - 00000330 _____ C:\Windows\Tasks\Zwmqp.job 2013-08-31 19:41 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-31 19:40 - 2013-08-27 23:45 - 00000000 ____D C:\AdwCleaner 2013-08-31 19:32 - 2009-12-05 18:07 - 01498742 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-30 23:38 - 2011-05-23 18:50 - 00000000 ____D C:\Users\Gisela d\Documents\Privatkorrespondenz 2013-08-30 23:22 - 2009-12-20 11:40 - 00000000 ____D C:\Users\Gisela d\Documents\Briefköpfe 2013-08-30 22:47 - 2013-08-30 22:45 - 02050466 _____ C:\Users\Gisela d\Downloads\b_pdf.pdf.part 2013-08-28 00:05 - 2013-08-28 00:03 - 00000000 ____D C:\Users\Gisela d\Downloads\anti spyware programm setups von robert 2013-08-27 23:58 - 2013-02-20 13:59 - 00017920 ___SH C:\Users\Gisela d\Thumbs.db 2013-08-27 23:22 - 2013-08-27 23:22 - 00000000 ____D C:\Users\Gisela d\AppData\Roaming\Malwarebytes 2013-08-27 23:22 - 2013-08-27 23:22 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-08-27 23:22 - 2013-08-27 23:22 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware 2013-08-27 22:59 - 2013-08-27 22:59 - 00000000 ____D C:\Users\Gisela d\Documents\ProcAlyzer Dumps 2013-08-27 22:59 - 2013-08-26 23:22 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-26 23:29 - 2013-08-26 23:21 - 00000000 ____D C:\Program Files\Spybot - Search & Destroy 2 2013-08-26 16:57 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\rescache 2013-08-26 16:31 - 2013-08-26 16:31 - 00002296 _____ C:\Windows\PFRO.log 2013-08-26 16:31 - 2013-08-26 16:31 - 00000000 _____ C:\Windows\setuperr.log 2013-08-26 14:12 - 2009-12-06 02:56 - 00000000 ____D C:\Windows\Panther 2013-08-26 14:08 - 2013-08-26 13:48 - 00000000 ___RD C:\Users\Gisela d\Desktop\Werkzeuge 2013-08-26 14:07 - 2013-08-26 14:07 - 00000000 ____D C:\Program Files\Speccy 2013-08-26 14:07 - 2013-08-26 14:07 - 00000000 ____D C:\Program Files\Recuva 2013-08-26 14:06 - 2013-08-26 14:06 - 00000000 ____D C:\Program Files\Defraggler 2013-08-26 14:05 - 2013-08-26 14:05 - 00000000 ____D C:\Program Files\CCleaner 2013-08-26 14:03 - 2013-08-26 14:03 - 04100432 _____ (Piriform Ltd) C:\Users\Gisela d\Downloads\dfsetup215.exe 2013-08-26 14:03 - 2013-08-26 14:03 - 03843072 _____ (Piriform Ltd) C:\Users\Gisela d\Downloads\rcsetup148.exe 2013-08-26 14:02 - 2013-08-26 14:02 - 04429440 _____ (Piriform Ltd) C:\Users\Gisela d\Downloads\ccsetup404.exe 2013-08-26 13:56 - 2013-08-26 13:29 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-08-26 13:30 - 2009-12-06 02:55 - 00000000 ____D C:\Windows\system32\Drivers\de-DE 2013-08-26 13:30 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\system32\de-DE 2013-08-26 13:21 - 2010-12-22 10:48 - 00000000 ____D C:\Users\Gisela d\AppData\Roaming\TeamViewer 2013-08-26 13:18 - 2013-08-26 13:12 - 05536272 _____ (TeamViewer GmbH) C:\Users\Gisela d\Downloads\TeamViewer_Setup_de.exe 2013-08-25 12:44 - 2013-08-25 12:44 - 00458752 __RSH C:\Windows\system32\winloads.dll 2013-08-22 10:28 - 2009-12-20 11:40 - 00000000 ____D C:\Users\Gisela d\Documents\Atteste 2013-08-22 09:48 - 2012-07-27 21:44 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe 2013-08-22 09:48 - 2011-06-16 16:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl 2013-08-19 16:26 - 2012-05-06 15:46 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-08-19 09:42 - 2013-08-19 09:42 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-08-18 19:28 - 2009-07-14 06:53 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-08-16 09:26 - 2009-12-26 19:24 - 00000000 ____D C:\ProgramData\PSYPRCFG 2013-08-16 09:26 - 2009-12-26 19:23 - 00000000 ____D C:\Program Files\Psyprax 2013-08-16 08:38 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\Microsoft.NET 2013-08-15 13:12 - 2013-08-04 18:35 - 00000000 ____D C:\Windows\system32\MRT 2013-08-15 13:11 - 2010-01-01 16:50 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-08-15 13:11 - 2009-12-25 20:54 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-08-15 13:08 - 2009-12-20 11:40 - 00000000 ____D C:\Users\Gisela d\Documents\Agentur für Arbeit 2013-08-12 12:05 - 2012-07-03 18:12 - 00001631 _____ C:\Users\Public\Desktop\ifap praxisCENTER 3.lnk 2013-08-12 12:05 - 2012-07-03 18:08 - 00000000 ____D C:\ifapDB 2013-08-12 10:36 - 2013-08-12 10:23 - 576240553 _____ (Igor Pavlov) C:\Users\Gisela d\Desktop\ipC3_OU_20130801.exe 2013-08-01 10:56 - 2009-12-20 11:40 - 00000000 ____D C:\Users\Gisela d\Documents\Anträge Files to move or delete: ==================== C:\Users\GISELA~1\AppData\Local\Temp\Quarantine.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer_.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer_Desktop.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer_Resource_de.dll C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer_Resource_en.dll C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer_Service.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\TeamViewer_StaticRes.dll C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\tv_w32.dll C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\tv_w32.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\tv_x64.dll C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\tv_x64.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\uninstall.exe C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\x86\Teamviewer_PrintProcessor.dll C:\Users\GISELA~1\AppData\Local\Temp\TeamViewer\Version8\outlook\TeamViewerMeetingAddIn.dll C:\Users\GISELA~1\AppData\Local\Temp\SUPERSetup\setup.dll C:\Users\GISELA~1\AppData\Local\Temp\OCS\ICSharpCode.SharpZipLib.dll C:\Users\GISELA~1\AppData\Local\Temp\OCS\ocs_v7f.exe C:\Users\GISELA~1\AppData\Local\Temp\OCS\Downloads\fc14996dfa99adfc7baae624196888c5\43308be390dd9a265ab3d01712f64d72\SUPER103AntiSpyware.exe C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\CbsProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\CompatProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\DismCore.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\DismCorePS.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\DismHost.exe C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\DismProv.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\DmiProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\FolderProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\IntlProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\LogProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\MsiProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\OSProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\SmiProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\TransmogProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\UnattendProvider.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\wdscore.dll C:\Users\GISELA~1\AppData\Local\Temp\AEE30360-2802-4571-B81F-C186A5EDCAC8\WimProvider.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-08-22 09:01 ==================== End Of Log ============================ Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-08-2013 04 Ran by Gisela d at 2013-08-31 21:07:28 Running from E:\ Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) 7-Zip 9.20 Adobe Flash Player 11 ActiveX (Version: 11.8.800.94) Adobe Flash Player 11 Plugin (Version: 11.8.800.94) Adobe Reader XI (11.0.03) - Deutsch (Version: 11.0.03) AuthenTec Fingerprint Software (Version: 8.4.2.5) Avira Free Antivirus (Version: 13.0.0.3885) BioAPI Framework (Version: 1.0.1) Canon MP550 series MP Drivers CCleaner (Version: 4.04) Defraggler (Version: 2.15) Dell Driver Download Manager (HKCU Version: 2.1.0.0) Dell Resource CD (Version: 1.00.0000) Dell Security Device Driver Pack (Version: 1.3.039) Dell Touchpad (Version: 7.1002.101.102) HYPERCOM CT-API 01.07 HYPERCOM medMobile 01.06 HYPERCOM medView 01.01 ifapDB Anwendungen (Version: 3.8.0.108) Intel(R) Graphics Media Accelerator Driver Intel(R) TV Wizard Java 7 Update 25 (Version: 7.0.250) Java Auto Updater (Version: 2.1.9.5) Java(TM) 6 Update 16 (Version: 6.0.160) Malwarebytes Anti-Malware Version 1.75.0.1300 (Version: 1.75.0.1300) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office Excel MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (Version: 14.0.5130.5003) Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000) Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1) Microsoft Office OneNote MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Proof (Italian) 2007 (Version: 12.0.6612.1000) Microsoft Office Proofing (German) 2007 (Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Office Word MUI (German) 2007 (Version: 12.0.6612.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053) Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001) Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219) Mozilla Firefox 23.0.1 (x86 de) (Version: 23.0.1) Mozilla Maintenance Service (Version: 23.0.1) MSI to redistribute MS VS2005 CRT libraries (Version: 8.0.50727.42) OpenOffice.org 3.1 (Version: 3.1.9420) praxisCENTER (Version: 1.0.2.71) Psyprax Recuva (Version: 1.48) RICOH Media Driver ver.2.07.01.01 (Version: 2.07.01.01) Speccy (Version: 1.22) Spybot - Search & Destroy (Version: 2.1.21) SUPERAntiSpyware (Version: 5.6.1030) Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update für Microsoft Office Excel 2007 Help (KB963678) Update für Microsoft Office Powerpoint 2007 Help (KB963669) Update für Microsoft Office Word 2007 Help (KB963665) UPEK TouchChip Fingerprint Reader (Version: 1.1.0) Windows XP Mode (Version: 1.3.7600.16422) Windows-Treiberpaket - AuthenTec Inc. (ATSwpWDF) Biometric (05/13/2009 8.4.2.0) (Version: 05/13/2009 8.4.2.0) Windows-Treiberpaket - Dell Inc. PBADRV System (01/07/2008 1.0.1.5) (Version: 01/07/2008 1.0.1.5) ==================== Restore Points ========================= ==================== Hosts content: ========================== 2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {12342AA0-D00F-4C3B-B8A7-332D5E61EF23} - System32\Tasks\Microsoft\Windows\MUI\Lpksetup => C:\Windows\System32\lpksetup.exe [2010-11-20] (Microsoft Corporation) Task: {160B00AA-C1A3-48A6-AADE-9B4171F76E00} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-22] (Adobe Systems Incorporated) Task: {166805AB-CF90-4A7B-AD27-7CD83418462C} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files\Spybot - Search & Destroy 2\SDScan.exe No File Task: {50F29A11-2469-44A9-AAAE-534992D6E96C} - System32\Tasks\User_Feed_Synchronization-{827DF622-E136-4631-9FA0-94FCDBD565AE} => C:\Windows\system32\msfeedssync.exe [2013-03-30] (Microsoft Corporation) Task: {51DE5B60-7E37-4652-AC28-5F165350919C} - System32\Tasks\SUPERAntiSpyware Scheduled Task e0e18174-165d-4c07-a33a-bc6d0edc3616 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-05-23] (SUPERAdBlocker.com) Task: {5FED014F-D17F-4D53-8472-EAF002974A55} - System32\Tasks\Zwmqp => C:\Windows\system32\winloads.dll [2013-08-25] () Task: {7E8F4BE6-0C9B-443D-B44C-8153830145DF} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-07-22] (Piriform Ltd) Task: {933C33C6-74ED-43EC-8E6C-A12418697AD3} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe No File Task: {96184BE1-D3EB-483B-A531-3D52C09D8055} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files\Spybot - Search & Destroy 2\SDImmunize.exe No File Task: {F5A9C8A1-BA60-476A-A251-BE80BE8310A6} - System32\Tasks\SUPERAntiSpyware Scheduled Task 0236deb0-ba1a-40f7-ac2c-fcb82ed26be2 => C:\Program Files\SUPERAntiSpyware\SASTask.exe [2013-05-23] (SUPERAdBlocker.com) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task 0236deb0-ba1a-40f7-ac2c-fcb82ed26be2.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Task: C:\Windows\Tasks\SUPERAntiSpyware Scheduled Task e0e18174-165d-4c07-a33a-bc6d0edc3616.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Task: C:\Windows\Tasks\Zwmqp.job => C:\Windows\system32\winloads.dll ==================== Loaded Modules (whitelisted) ============= 2013-08-27 23:22 - 2013-04-04 14:50 - 00527944 _____ (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll 2013-08-27 23:22 - 2013-04-04 14:50 - 02191944 _____ (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbamnet.dll 2009-07-14 02:07 - 2009-07-14 03:14 - 00064000 _____ (Fraunhofer Institut Integrierte Schaltungen IIS) C:\Windows\System32\l3codeca.acm 2009-07-14 00:09 - 2009-07-28 23:23 - 03646976 _____ (Intel Corporation) C:\Windows\system32\igd10umd32.dll 2009-07-14 01:23 - 2009-07-14 03:16 - 00046592 _____ (Microsoft Corporation) C:\Windows\system32\sdautoplay.dll 2011-06-06 12:29 - 2010-11-20 14:21 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\SPP.dll 2009-07-14 01:23 - 2009-07-14 03:16 - 00056320 _____ (Microsoft Corporation) C:\Windows\system32\VssTrace.DLL 2011-06-06 12:29 - 2010-11-20 14:21 - 00907776 _____ (Microsoft Corporation) C:\Windows\system32\sdengin2.dll 2011-06-06 12:30 - 2010-11-20 14:21 - 01159168 _____ (Microsoft Corporation) C:\Windows\system32\sysmain.dll 2011-03-06 18:28 - 2010-03-12 14:00 - 01548288 _____ (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.dll 2011-03-06 18:28 - 2010-02-26 22:32 - 00109122 _____ (Alps Electric Co., Ltd.) C:\Windows\system32\Vxdif.dll 2011-03-06 18:28 - 2010-01-14 21:39 - 00069632 _____ (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\EzAuto.dll 2011-06-11 01:58 - 2011-06-11 01:58 - 04422992 _____ (Microsoft Corporation) C:\Windows\system32\mfc100u.dll 2011-06-11 01:58 - 2011-06-11 01:58 - 00773968 _____ (Microsoft Corporation) C:\Windows\system32\MSVCR100.dll 2011-06-11 01:58 - 2011-06-11 01:58 - 00421200 _____ (Microsoft Corporation) C:\Windows\system32\MSVCP100.dll 2011-06-06 12:29 - 2010-11-20 14:19 - 00127488 _____ (Microsoft Corporation) C:\Windows\system32\LOGONCLI.DLL 2012-08-16 08:33 - 2012-07-04 23:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\BROWCLI.DLL 2011-06-11 01:58 - 2011-06-11 01:58 - 00064336 _____ (Microsoft Corporation) C:\Windows\system32\MFC100DEU.DLL 2012-12-18 12:04 - 2013-06-27 16:35 - 00739384 _____ (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\ccwkrlib.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00054840 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\cfglib.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00349752 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccguard.dll 2012-12-18 12:04 - 2013-05-07 17:00 - 00030432 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccgrdrc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00229432 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccgrdw.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00378424 _____ (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\grdcore.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00218168 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\gpipc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00059448 _____ (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avipc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00418872 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccwgrd.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00790584 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccgen.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00049208 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccgenrc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00219192 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccupdate.dll 2012-12-18 12:04 - 2012-12-05 18:08 - 00029472 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccupdrc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00082488 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\cclic.dll 2012-12-18 12:04 - 2013-02-12 17:32 - 00011632 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\cclicrc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00207928 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccmsg.dll 2012-12-18 12:04 - 2013-02-12 17:32 - 00010608 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccmsgrc.dll 2012-12-18 12:04 - 2012-11-28 16:09 - 04780832 _____ (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\rcimage.dll 2012-12-18 12:04 - 2013-02-12 17:32 - 00016240 _____ (Avira Operations GmbH & Co. KG) c:\program files\avira\antivir desktop\ccmainrc.dll 2012-12-18 12:04 - 2013-06-27 16:35 - 00212536 _____ (Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\ccupdw.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-26 23:21 - 2013-05-16 10:55 - 00614872 _____ (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDLicense.dll 2013-08-26 23:21 - 2012-08-23 10:45 - 02169224 _____ (Embarcadero Technologies, Inc.) C:\Program Files\Spybot - Search & Destroy 2\rtl150.bpl 2013-08-26 23:21 - 2013-05-16 10:55 - 00883152 _____ (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\snlBase150.bpl 2013-08-26 23:21 - 2013-05-16 10:55 - 00113496 _____ () C:\Program Files\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2013-08-26 23:21 - 2012-08-23 10:45 - 02477736 _____ (Embarcadero Technologies, Inc.) C:\Program Files\Spybot - Search & Destroy 2\vcl150.bpl 2013-08-26 23:21 - 2013-05-16 10:55 - 03643800 _____ (Project JEDI) C:\Program Files\Spybot - Search & Destroy 2\Jcl150.bpl 2013-08-26 23:21 - 2013-05-16 10:55 - 00416600 _____ () C:\Program Files\Spybot - Search & Destroy 2\DEC150.bpl 2009-07-14 01:23 - 2009-07-14 03:16 - 00043008 _____ (Microsoft Corporation) C:\Windows\system32\SrClient.dll 2013-08-26 23:21 - 2013-05-16 10:55 - 02521048 _____ (Safer-Networking Ltd.) C:\Program Files\Spybot - Search & Destroy 2\SDResources.dll 2013-08-15 13:09 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll 2009-07-14 01:45 - 2009-07-14 03:15 - 00226816 _____ (Microsoft Corporation) C:\Windows\System32\LocationApi.dll 2009-07-14 01:45 - 2009-07-14 03:16 - 00129024 _____ (Microsoft Corporation) C:\Windows\System32\SensorsApi.dll 2011-06-06 12:28 - 2010-11-20 14:21 - 00189952 _____ (Microsoft Corporation) C:\Windows\System32\WDSCORE.dll 2013-03-30 21:25 - 2013-03-30 21:25 - 01988096 _____ (Microsoft Corporation) C:\Windows\system32\D3D10Warp.dll 2013-03-30 21:26 - 2013-03-30 21:26 - 00523264 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2009-07-14 01:40 - 2009-07-14 03:16 - 00108544 _____ (Microsoft Corporation) C:\Program Files\Windows Sidebar\wlsrvc.dll 2009-02-26 16:45 - 2009-02-26 16:45 - 00043392 _____ (Microsoft Corporation) C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL 2011-03-06 18:28 - 2010-02-26 22:32 - 00109122 _____ (Alps Electric Co., Ltd.) C:\Windows\system32\VXDIF.DLL 2011-03-06 18:28 - 2010-03-12 14:00 - 01548288 _____ (Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.DLL 2009-07-14 02:12 - 2009-07-14 03:14 - 00523776 _____ (Microsoft Corporation) C:\Windows\System32\hhctrl.ocx 2011-06-06 12:29 - 2010-11-20 14:19 - 00209920 _____ (Microsoft Corporation) C:\Windows\System32\mstask.dll 2013-08-19 09:42 - 2013-08-19 09:42 - 03551640 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2011-06-06 12:29 - 2010-11-20 14:21 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\t2embed.dll 2009-12-05 20:07 - 2009-07-28 23:26 - 00549888 _____ (Intel Corporation) C:\Windows\system32\igdumdx32.dll 2009-12-05 20:07 - 2009-07-28 23:31 - 04233728 _____ (Intel Corporation) C:\Windows\system32\igdumd32.dll 2013-08-22 09:48 - 2013-08-22 09:48 - 16166280 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ==================== Alternate Data Streams (whitelisted) ========== AlternateDataStreams: C:\Users\Gisela d\Thumbs.db:encryptable AlternateDataStreams: C:\Users\Gisela d\Documents\Thumbs.db:encryptable ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/31/2013 07:57:45 PM) (Source: Application Hang) (User: ) Description: Programm OTL.exe, Version 3.2.69.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 8a8 Startzeit: 01cea6735b93e141 Endzeit: 16 Anwendungspfad: E:\OTL.exe Berichts-ID: Error: (08/26/2013 04:32:04 PM) (Source: Windows Search Service) (User: ) Description: Der Index kann nicht initialisiert werden. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (08/26/2013 04:32:04 PM) (Source: Windows Search Service) (User: ) Description: Die Anwendung kann nicht initialisiert werden. Kontext: Windows Anwendung Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (08/26/2013 04:32:04 PM) (Source: Windows Search Service) (User: ) Description: Das Gatherer-Objekt kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (08/26/2013 04:32:04 PM) (Source: Windows Search Service) (User: ) Description: Plug-In in <Search.TripoliIndexer> kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Element nicht gefunden. (HRESULT : 0x80070490) (0x80070490) Error: (08/26/2013 04:32:00 PM) (Source: Windows Search Service) (User: ) Description: Plug-In in <Search.JetPropStore> kann nicht initialisiert werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (08/26/2013 04:32:00 PM) (Source: Windows Search Service) (User: ) Description: Die Eigenschaftenspeicherdaten können von Windows Search nicht geladen werden. Kontext: Windows Anwendung, SystemIndex Katalog Details: Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800) (0xc0041800) Error: (08/26/2013 04:32:00 PM) (Source: Windows Search Service) (User: ) Description: Windows Search wird aufgrund eines Problems bei der Indizierung The catalog is corrupt beendet. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (08/26/2013 04:31:59 PM) (Source: Windows Search Service) (User: ) Description: Vom Suchdienst wurden beschädigte Datendateien im Index {id=4700} erkannt. Vom Dienst wird versucht, dieses Problem durch Neuerstellung des Indexes automatisch zu beheben. Details: Der Inhaltsindexkatalog ist fehlerhaft. (HRESULT : 0xc0041801) (0xc0041801) Error: (08/26/2013 04:31:59 PM) (Source: Windows Search Service) (User: ) Description: Der Jet-Eigenschaftenspeicher kann von Windows Search nicht geöffnet werden. Details: 0x%08x (0xc0041800 - Die Inhaltsindexdatenbank ist fehlerhaft. (HRESULT : 0xc0041800)) System errors: ============= Error: (08/31/2013 07:41:59 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/31/2013 07:36:14 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/31/2013 07:17:03 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Updating Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error: (08/31/2013 07:17:03 PM) (Source: Service Control Manager) (User: ) Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Spybot-S&D 2 Updating Service erreicht. Error: (08/31/2013 07:16:32 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/30/2013 10:31:41 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/30/2013 00:07:07 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/30/2013 08:29:36 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/28/2013 04:29:38 PM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Error: (08/28/2013 08:33:43 AM) (Source: Service Control Manager) (User: ) Description: Der Dienst "Spybot-S&D 2 Security Center Service" ist vom Dienst "Sicherheitscenter" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1058 Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 34% Total physical RAM: 3539.17 MB Available physical RAM: 2335.07 MB Total Pagefile: 7076.63 MB Available Pagefile: 5682.5 MB Total Virtual: 2047.88 MB Available Virtual: 1892.53 MB ==================== Drives ================================ Drive c: (SYSTEM) (Fixed) (Total:232.04 GB) (Free:178.46 GB) NTFS Drive e: (usb_robert) (Removable) (Total:14.91 GB) (Free:8.38 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 38000000) Partition 1: (Not Active) - (Size=118 MB) - (Type=DE) Partition 2: (Active) - (Size=750 MB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=232 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 15 GB) (Disk ID: 00000000) Partition 1: (Active) - (Size=15 GB) - (Type=07 NTFS) ==================== End Of Log ============================ |
Themen zu ihavenet trojaner eingefangen - einschlägige clean software bringt nichts |
adobe, antivir, antivirus, avira, browser, ccsetup, desktop, device driver, excel, explorer, farbar, farbar recovery scan tool, fehler, firefox, firefox 23.0.1, flash player, helper, homepage, ihavenet trojaner google umleitung, mozilla, plug-in, refresh, registry, safer networking, scan, security, seiten, services.exe, software, svchost.exe, temp, trojaner, usb, windows |