| |
| |||||||
Log-Analyse und Auswertung: Windows XP: Avira meldet mehrere Trojaner, wurde beim Online Banking auf falsche Seite geleitet...Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
| |
04.09.2013, 12:41
| #1 |
| |  Windows XP: Avira meldet mehrere Trojaner, wurde beim Online Banking auf falsche Seite geleitet... Hi Leo, nach 3,5h scan mit ESET hier die 3 logs für Dich, lg Alex: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-09-2013
Ran by ALanghein at 2013-09-03 12:50:25 Run:2
Running from C:\Dokumente und Einstellungen\ALanghein\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Akwuq
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ekelnu
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ymvin
*****************
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Akwuq => Moved successfully.
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ekelnu => Moved successfully.
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ymvin => Moved successfully.
==== End of Fixlog ====
[CODE] ESETSmartInstaller@High as downloader log: all ok # version=8 # OnlineScannerApp.exe=1.0.0.1 # OnlineScanner.ocx=1.0.0.6920 # api_version=3.0.2 # EOSSerial=47f144a837e0c243bf1392d5b76438c3 # engine=14992 # end=finished # remove_checked=false # archives_checked=true # unwanted_checked=false # unsafe_checked=false # antistealth_checked=true # utc_time=2013-09-03 01:29:33 # local_time=2013-09-03 03:29:33 (+0100, Westeuropäische Sommerzeit) # country="Germany" # lang=1033 # osver=5.1.2600 NT Service Pack 3 # compatibility_mode=1799 16775165 100 95 20804 89511 13504 0 # scanned=133181 # found=8 # cleaned=0 # scan_time=9125 sh=1CEC9677AE3EF2F431A4C402B13A95E491A571FC ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\26\3dbd3d1a-53ee796c" sh=180D50419DE85D6417657E950CF6B3BC1ACF665C ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2013-1493.HL trojan" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\44\1064e5ec-1f541d81" sh=180D50419DE85D6417657E950CF6B3BC1ACF665C ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2013-1493.HL trojan" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\5\795ca7c5-6bed79ef" sh=1CEC9677AE3EF2F431A4C402B13A95E491A571FC ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\55\75032e37-2eccc307" sh=1CEC9677AE3EF2F431A4C402B13A95E491A571FC ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\63\32cf1dbf-14551e81" sh=3DDDDC03F7EEAC81353BF18DC67DA3308A05F780 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.PKK trojan" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\9\20937989-5b05f65a" sh=5AD6B211211B063829A1C85749428C43D4382B52 ft=1 fh=4dffb4ad718a2f6d vn="a variant of Win32/Injector.ALXK trojan" ac=I fn="C:\System Volume Information\_restore{B32AEE6A-215A-4A68-95FC-9CABBF245D43}\RP700\A0261819.exe" sh=636A17A563A4BBB6BC4F2B313F07DD7E76E0B6A9 ft=1 fh=f7bac63656545161 vn="a variant of Win32/Injector.ALXQ trojan" ac=I fn="C:\System Volume Information\_restore{B32AEE6A-215A-4A68-95FC-9CABBF245D43}\RP702\A0267954.exe" FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by ALanghein (administrator) on LANGHEIN on 03-09-2013 16:01:09
Running from C:\Dokumente und Einstellungen\ALanghein\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(brother Industries Ltd) C:\WINDOWS\system32\brsvc01a.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(brother Industries Ltd) C:\WINDOWS\system32\brss01a.exe
(Cognizance Corporation) C:\Programme\HPQ\IAM\bin\asghost.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Teruten) C:\WINDOWS\system32\FsUsbExService.Exe
(Google Inc.) C:\Programme\Google\Update\GoogleUpdate.exe
(Microsoft Corporation) C:\WINDOWS\system32\inetsrv\inetinfo.exe
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
(Microsoft Corporation) C:\WINDOWS\System32\snmp.exe
(TomTom) C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
(Hewlett-Packard Development Company, L.P.) C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Programme\Windows Media Player\WMPNetwk.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Analog Devices, Inc.) C:\Programme\Analog Devices\Core\smax4pnp.exe
(Sonic Solutions) C:\WINDOWS\System32\DLA\DLACTRLW.EXE
(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Hewlett-Packard Development Company, L.P.) C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
( Hewlett-Packard Development Company, L.P.) C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
() C:\WINDOWS\SMINST\Scheduler.exe
() C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
(Adobe Systems Inc.) C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
(Apple Computer, Inc.) C:\Programme\QuickTime\qttask.exe
(Apple Computer, Inc.) C:\Programme\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Programme\Hp\HP Software Update\HPWuSchd2.exe
(InstallShield Software Corporation) C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Agere Systems) C:\WINDOWS\AGRSMMSG.exe
(Samsung Electronics Co., Ltd.) C:\Programme\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Apple Computer, Inc.) C:\Programme\iPod\bin\iPodService.exe
(APN) C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Google Inc.) C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Programme\Messenger\msmsgs.exe
(Microsoft Corporation) C:\Programme\Windows Media Player\WMPNSCFG.exe
(TomTom) C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe
(Samsung) C:\Programme\Samsung\Kies\Kies.exe
(Samsung) C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MsmqIntCert] - regsvr32 /s mqrt.dll [x]
HKLM\...\Run: [SoundMAXPnP] - C:\Programme\Analog Devices\Core\smax4pnp.exe [925696 2005-05-20] (Analog Devices, Inc.)
HKLM\...\Run: [SoundMAX] - C:\Programme\Analog Devices\SoundMAX\Smax4.exe [716800 2005-05-06] (Analog Devices, Inc.)
HKLM\...\Run: [PTHOSTTR] - C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE [122880 2006-02-14] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [DLA] - C:\WINDOWS\System32\DLA\DLACTRLW.EXE [122940 2005-08-31] (Sonic Solutions)
HKLM\...\Run: [SynTPEnh] - C:\Programme\Synaptics\SynTP\SynTPEnh.exe [761945 2005-11-10] (Synaptics, Inc.)
HKLM\...\Run: [igfxhkcmd] - C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
HKLM\...\Run: [igfxpers] - C:\WINDOWS\system32\igfxpers.exe [118784 2006-03-23] (Intel Corporation)
HKLM\...\Run: [hpWirelessAssistant] - C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [454656 2006-02-14] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [CognizanceTS] - C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll [17920 2003-12-22] (Cognizance Corporation)
HKLM\...\Run: [QlbCtrl] - %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [x]
HKLM\...\Run: [Cpqset] - C:\Programme\HPQ\Default Settings\cpqset.exe [40960 2006-02-22] ()
HKLM\...\Run: [Recguard] - C:\WINDOWS\Sminst\Recguard.exe [1187840 2005-12-20] ()
HKLM\...\Run: [Scheduler] - C:\WINDOWS\SMINST\Scheduler.exe [892928 2006-02-15] ()
HKLM\...\Run: [WatchDog] - C:\Programme\InterVideo\DVD Check\DVDCheck.exe [184320 2005-11-08] (InterVideo Inc.)
HKLM\...\Run: [Acrobat Assistant 7.0] - C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [483328 2008-04-23] (Adobe Systems Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [282624 2006-10-25] (Apple Computer, Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Programme\iTunes\iTunesHelper.exe [256576 2006-10-30] (Apple Computer, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Programme\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [ISUSPM Startup] - C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe [221184 2004-07-27] (InstallShield Software Corporation)
HKLM\...\Run: [ISUSScheduler] - C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe [81920 2004-07-27] (InstallShield Software Corporation)
HKLM\...\Run: [NPSStartup] - [x]
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [AGRSMMSG] - C:\Windows\AGRSMMSG.exe [88203 2006-01-30] (Agere Systems)
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [KiesTrayAgent] - C:\Programme\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-15] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [avgnt] - C:\Programme\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] - C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKLM\...\RunOnce: [ (A0)] - cmd /c "C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar\mbar.exe" /rdv /s [1178424 2013-08-14] (Malwarebytes Corporation)
Winlogon\Notify\OneCard: C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll (Microsoft Corporation)
HKLM\...\Policies\Explorer: [HonorAutoRunSetting] 1
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKLM\...\Policies\Explorer: [NoDriveAutoRun] 67108863
HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun] 323
HKCU\...\Run: [PDF-Viewer] - C:\programme\PDFDruck\PDFDruck.exe [461824 2005-12-08] ()
HKCU\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2007-07-14] (Google Inc.)
HKCU\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Programme\Windows Media Player\WMPNSCFG.exe [204288 2006-11-03] (Microsoft Corporation)
HKCU\...\Run: [TomTomHOME.exe] - C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe [247728 2011-12-05] (TomTom)
HKCU\...\Run: [Internet Manager] - C:\Programme\T-Mobile\InternetManager_H\Internet Manager.exe [x]
HKCU\...\Run: [KiesPreload] - C:\Programme\Samsung\Kies\Kies.exe [1564016 2013-07-15] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Programme\Samsung\Kies\KiesAirMessage.exe -startup [x]
HKCU\...\Run: [] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-15] (Samsung)
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 323
HKCU\...\Policies\Explorer: [NoDriveAutoRun] 67108863
HKU\179599\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Default User\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Motte\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Motte\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [ 2006-10-25] (Apple Computer, Inc.)
HKU\Motte\...\Run: [WMPNSCFG] - C:\Programme\Windows Media Player\WMPNSCFG.exe [ 2006-11-03] (Microsoft Corporation)
HKU\Nutzer\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Nutzer\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [ 2006-10-25] (Apple Computer, Inc.)
HKU\Puppi\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Puppi\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [ 2006-10-25] (Apple Computer, Inc.)
HKU\Puppi\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2007-07-14] (Google Inc.)
HKU\Puppi\...\Run: [KiesPDLR] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-07-15] (Samsung)
HKU\Puppi\...\Run: [WMPNSCFG] - C:\Programme\Windows Media Player\WMPNSCFG.exe [ 2006-11-03] (Microsoft Corporation)
HKU\Puppi\...\Run: [Google Update] - C:\Dokumente und Einstellungen\Puppi\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [ 2013-07-13] (Google Inc.)
HKU\Puppi\...\Run: [] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-07-15] (Samsung)
HKU\Puppi\...\Run: [ChromeFrameHelper] - C:\Dokumente und Einstellungen\Puppi\Lokale Einstellungen\Anwendungsdaten\Google\Chrome Frame\Application\28.0.1500.95\chrome_frame_helper.exe [ 2013-07-25] (Google Inc.)
SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
ProxyServer: localhost:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://avira.search.ask.com/?p2=%5EB0Q%5EYYYYYY%5EYY%5EDE&gct=hp&o=APN11074&apn_ptnrs=%5EB0Q&apn_dtid=%5EYYYYYY%5EYY%5EDE&tpid=AVIRA-V7&apn_dbr=ie_8.0.6001.18702&trgb=ALL&apn_uid=894FC0C0-473A-49EA-80BA-5F0485B6646F&itbv=12.2.2.663&doi=2013-09-02&psv=
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1377874551375&tguid=66920-6787-1377874551375-1BEC96FE8E422D04C0C9213B85A6D62B&q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programme\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU -Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: t-mobile - No CLSID Value -
Winsock: Catalog9 01 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 30 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{B0023DEB-8417-4757-B9B6-53C751E805BB}: [NameServer]172.31.8.254,172.31.8.101
FireFox:
========
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "urls_to_restore_on_startup": [
CHR Plugin: (Shockwave Flash) - C:\Programme\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll No File
CHR Extension: (Chrome In-App Payments service) - C:\DOKUME~1\ALANGH~1\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
========================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [69632 2007-01-19] (Adobe Systems)
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 ASChannel; C:\Programme\HPQ\IAM\Bin\ASChnl.dll [117248 2005-06-01] (Cognizance Corporation)
R2 Brother XP spl Service; C:\WINDOWS\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R2 btwdins; C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe [258103 2006-02-15] (Broadcom Corporation.)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-06-07] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-06-07] (Google Inc.)
S2 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2012-08-20] (Google)
R3 hpqcxs08; C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll [225280 2007-01-19] (Hewlett-Packard Co.)
R2 hpqddsvc; C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll [131072 2007-01-19] (Hewlett-Packard Co.)
R2 hpqwmiex; C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe [98304 2006-01-12] (Hewlett-Packard Development Company, L.P.)
S3 IDriverT; c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation)
R2 IISADMIN; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [492608 2006-10-30] (Apple Computer, Inc.)
R2 LightScribeService; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [73728 2006-01-20] (Hewlett-Packard Company)
S3 LPDSVC; C:\Windows\system32\tcpsvcs.exe [19456 2004-08-04] (Microsoft Corporation)
S2 MSMQ; C:\WINDOWS\system32\mqsvc.exe [4608 2008-04-14] (Microsoft Corporation)
S2 MSMQTriggers; C:\WINDOWS\system32\mqtgsvc.exe [117248 2008-04-14] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S2 PCA; C:\WINDOWS\SMINST\PCAngel.exe [294912 2006-01-12] (SoftThinks)
R2 SMTPSVC; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R2 TomTomHOMEService; C:\Programme\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-12-05] (TomTom)
R2 W3SVC; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R2 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
R2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]
==================== Drivers (Whitelisted) ====================
S3 actser; C:\Windows\System32\drivers\actser.sys [29440 2004-12-16] (Siemens AG)
R3 AEAudioService; C:\Windows\System32\drivers\AEAudio.sys [152960 2005-06-07] (Andrea Electronics Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-09-02] (Avira Operations GmbH & Co. KG)
S3 btaudio; C:\Windows\System32\drivers\btaudio.sys [401664 2006-02-15] (Broadcom Corporation.)
S3 BTDriver; C:\Windows\System32\DRIVERS\btport.sys [30363 2006-02-15] (Broadcom Corporation.)
R3 BTKRNL; C:\Windows\System32\DRIVERS\btkrnl.sys [1342570 2006-02-15] (Broadcom Corporation.)
S3 BTWDNDIS; C:\Windows\System32\DRIVERS\btwdndis.sys [148168 2006-02-15] (Broadcom Corporation.)
S3 btwmodem; C:\Windows\System32\DRIVERS\btwmodem.sys [30189 2006-02-15] (Broadcom Corporation.)
S3 BTWUSB; C:\Windows\System32\Drivers\btwusb.sys [57096 2006-02-15] (Broadcom Corporation.)
S3 cleanhlp; C:\EEK\Run\cleanhlp32.sys [50200 2013-08-30] (Emsisoft GmbH)
R2 DLABOIOM; C:\Windows\System32\DLA\DLABOIOM.SYS [25628 2005-08-31] (Sonic Solutions)
R1 DLACDBHM; C:\Windows\System32\Drivers\DLACDBHM.SYS [5628 2005-08-25] (Sonic Solutions)
R2 DLADResN; C:\Windows\System32\DLA\DLADResN.SYS [2496 2005-08-31] (Sonic Solutions)
R2 DLAIFS_M; C:\Windows\System32\DLA\DLAIFS_M.SYS [86524 2005-08-31] (Sonic Solutions)
R2 DLAOPIOM; C:\Windows\System32\DLA\DLAOPIOM.SYS [14684 2005-08-31] (Sonic Solutions)
R2 DLAPoolM; C:\Windows\System32\DLA\DLAPoolM.SYS [6364 2005-08-31] (Sonic Solutions)
R1 DLARTL_N; C:\Windows\System32\Drivers\DLARTL_N.SYS [22684 2005-08-25] (Sonic Solutions)
R2 DLAUDFAM; C:\Windows\System32\DLA\DLAUDFAM.SYS [94332 2005-08-31] (Sonic Solutions)
R2 DLAUDF_M; C:\Windows\System32\DLA\DLAUDF_M.SYS [87036 2005-08-31] (Sonic Solutions)
R2 DRVNDDM; C:\Windows\System32\Drivers\DRVNDDM.SYS [40544 2005-08-12] (Sonic Solutions)
R1 eabfiltr; C:\Windows\System32\DRIVERS\eabfiltr.sys [7808 2005-09-19] (Hewlett-Packard Development Company, L.P.)
S3 eabusb; C:\Windows\System32\DRIVERS\eabusb.sys [5760 2005-09-19] (Hewlett-Packard Development Company, L.P.)
R3 FsUsbExDisk; C:\WINDOWS\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 G3GRUMDM; C:\Windows\System32\DRIVERS\g3grumdm.sys [24832 2004-10-05] (Option N.V.)
S3 G3GRUSER; C:\Windows\System32\DRIVERS\g3gruser.sys [21760 2004-10-05] (Option N.V.)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2006-12-06] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2006-12-06] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2006-12-06] (HP)
R3 ialm; C:\Windows\System32\DRIVERS\ialmnt5.sys [1166972 2006-03-23] (Intel Corporation)
R3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [48728 2013-09-03] (MalwareBytes)
R3 MQAC; C:\WINDOWS\system32\drivers\mqac.sys [92544 2008-04-13] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S3 Rasirda; C:\Windows\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
S3 SMCIRDA; C:\Windows\System32\DRIVERS\smcirda.sys [35913 2001-08-18] (SMC)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [642560 2006-08-24] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-02] (Avira GmbH)
S3 vsbus; C:\Windows\System32\DRIVERS\vsb.sys [15264 2005-07-18] ()
S3 vserial; C:\Windows\System32\DRIVERS\vserial.sys [47744 2005-07-18] ()
R3 w39n51; C:\Windows\System32\DRIVERS\w39n51.sys [1428096 2006-01-19] (Intel® Corporation)
S3 W8100PCI; C:\Windows\System32\DRIVERS\mrv8k51.sys [258560 2004-10-05] (Marvell Semiconductor, Inc)
U5 Browser; C:\Windows\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\ALANGH~1\LOKALE~1\Temp\catchme.sys [x]
S3 dtscsi; No ImagePath
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [x]
S3 filtertdidriver; system32\drivers\ewfiltertdidriver.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 JL2005C; System32\Drivers\jl2005c.sys [x]
U5 Messenger; C:\Windows\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U5 Sdbus; C:\Windows\System32\Drivers\Sdbus.sys [79232 2008-04-13] (Microsoft Corporation)
S3 ss_bbus; system32\DRIVERS\ss_bbus.sys [x]
S3 ss_bmdfl; system32\DRIVERS\ss_bmdfl.sys [x]
S3 ss_bmdm; system32\DRIVERS\ss_bmdm.sys [x]
S3 ss_bus; system32\DRIVERS\ss_bus.sys [x]
S3 ss_mdfl; system32\DRIVERS\ss_mdfl.sys [x]
S3 ss_mdm; system32\DRIVERS\ss_mdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 15:43 - 2013-09-03 15:43 - 95587704 _____ C:\WINDOWS\system32\랱媊ƌ
2013-09-03 12:52 - 2013-09-03 12:52 - 02347384 _____ (ESET) C:\Dokumente und Einstellungen\ALanghein\Desktop\esetsmartinstaller_enu.exe
2013-09-03 12:15 - 2013-09-03 12:15 - 01084685 _____ (Farbar) C:\Dokumente und Einstellungen\ALanghein\Desktop\FRST.exe
2013-09-03 11:12 - 2013-09-03 11:12 - 00048728 _____ (MalwareBytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2013-09-03 10:33 - 2013-09-03 11:40 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar
2013-09-03 10:32 - 2013-09-03 10:33 - 12907592 _____ (Malwarebytes Corp.) C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar-1.07.0.1005.exe
2013-09-03 10:19 - 2013-09-03 10:19 - 00017324 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Ereignisse.txt
2013-09-03 10:15 - 2013-09-03 10:15 - 00000000 ___SD C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix
2013-09-03 10:12 - 2013-09-03 10:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090313-01.dmp
2013-09-03 10:00 - 2013-09-03 10:11 - 00000000 __SDC C:\ComboFix
2013-09-03 09:53 - 2013-09-03 09:53 - 05119472 ____R (Swearware) C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix.exe
2013-09-02 14:48 - 2013-09-02 14:48 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Avira
2013-09-02 14:44 - 2013-09-02 14:44 - 00000000 ____D C:\Programme\AskPartnerNetwork
2013-09-02 14:42 - 2013-09-02 14:42 - 00001671 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2013-09-02 14:42 - 2013-09-02 14:42 - 00000000 ____D C:\Programme\Avira
2013-09-02 14:42 - 2013-09-02 14:41 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-09-02 14:42 - 2013-09-02 14:41 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-09-02 14:42 - 2013-09-02 14:41 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2013-09-02 14:42 - 2013-09-02 14:41 - 00028520 _____ (Avira GmbH) C:\WINDOWS\system32\Drivers\ssmdrv.sys
2013-09-02 14:25 - 2013-09-02 14:25 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-04.dmp
2013-09-02 14:01 - 2013-09-02 14:01 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-03.dmp
2013-09-02 13:44 - 2008-03-08 06:54 - 00000211 ____C C:\Boot.bak
2013-09-02 13:44 - 2004-08-03 23:00 - 00262448 _RSHC C:\cmldr
2013-09-02 13:43 - 2013-09-02 13:44 - 00000000 RSHDC C:\cmdcons
2013-09-02 13:20 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-09-02 13:20 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-09-02 13:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-09-02 13:16 - 2013-09-02 13:19 - 00000000 ___DC C:\Qoobox
2013-09-02 13:15 - 2013-09-02 13:15 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-02 13:05 - 2013-09-02 13:08 - 00000000 ___DC C:\AdwCleaner
2013-09-02 12:49 - 2013-09-02 12:49 - 01037134 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\adwcleaner.exe
2013-09-02 12:20 - 2013-09-02 12:20 - 00000000 ____D C:\Programme\7-Zip
2013-09-02 11:55 - 2013-09-02 11:55 - 00016868 _____ C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Ereignisse.txt
2013-09-02 11:12 - 2013-09-02 11:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-02.dmp
2013-09-02 11:08 - 2013-09-02 11:08 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-01.dmp
2013-09-02 10:46 - 2013-09-02 10:46 - 00000000 ___DC C:\FRST
2013-09-02 10:44 - 2013-09-02 10:44 - 00000152 _____ C:\Dokumente und Einstellungen\ALanghein\defogger_reenable
2013-09-02 10:05 - 2013-09-02 10:05 - 00377856 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\gmer_2.1.19163.exe
2013-09-02 10:03 - 2013-09-02 10:03 - 00050477 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Defogger.exe
2013-09-02 09:29 - 2012-06-15 16:39 - 00169744 _____ C:\WINDOWS\system32\ztvunrar36.dll
2013-09-02 09:29 - 2012-06-15 16:35 - 00185616 _____ C:\WINDOWS\system32\ztvunrar39.dll
2013-09-02 09:29 - 2012-06-15 16:33 - 00605968 _____ (Igor Pavlov) C:\WINDOWS\system32\ztv7z.dll
2013-09-02 09:29 - 2012-06-15 16:33 - 00077072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ztvcabinet.dll
2013-09-02 09:29 - 2005-08-26 01:50 - 00077312 _____ C:\WINDOWS\system32\ztvunace26.dll
2013-09-02 09:29 - 2003-02-02 20:06 - 00153088 _____ C:\WINDOWS\system32\UNRAR3.dll
2013-09-02 09:29 - 2002-03-06 01:00 - 00075264 _____ C:\WINDOWS\system32\unacev2.dll
2013-09-02 09:17 - 2013-09-02 09:17 - 00000000 ___DC C:\MaxAVLiveUpdate
2013-08-30 16:57 - 2013-08-13 08:38 - 00032328 _____ C:\WINDOWS\Launcher.exe
2013-08-30 16:16 - 2013-08-30 16:17 - 00000000 ___DC C:\EEK
2013-08-30 15:59 - 2013-08-30 15:59 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\TrojanHunter
2013-08-30 15:46 - 2013-08-30 16:05 - 00000000 ____D C:\Programme\TrojanHunter 5.5
2013-08-30 15:46 - 2013-08-30 15:46 - 00059392 ____R C:\WINDOWS\system32\streamhlp.dll
2013-08-30 15:19 - 2013-08-30 17:09 - 00065536 _____ C:\WINDOWS\system32\config\SpybotSD.evt
2013-08-30 13:34 - 2013-08-30 13:34 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-30 13:31 - 2013-08-30 13:31 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Malwarebytes
2013-08-30 07:43 - 2013-08-30 07:43 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService\IETldCache
2013-08-30 07:29 - 2013-09-02 14:25 - 00000000 ____C C:\#$%^.txt
2013-08-28 11:33 - 2013-08-28 11:33 - 00004135 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 11:33 - 2013-08-28 11:33 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-19 11:59 - 2013-08-19 12:40 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Max
2013-08-15 07:36 - 2013-08-15 07:36 - 00014862 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-15 07:30 - 2013-08-15 07:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-15 07:29 - 2013-08-15 07:29 - 00005564 _____ C:\WINDOWS\KB2863058.log
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-15 07:20 - 2013-08-15 07:30 - 00011495 _____ C:\WINDOWS\KB2859537.log
2013-08-15 07:20 - 2013-08-15 07:30 - 00010684 _____ C:\WINDOWS\KB2850869.log
==================== One Month Modified Files and Folders =======
2013-09-03 16:00 - 2006-08-02 22:07 - 00000000 ____D C:\Programme
2013-09-03 16:00 - 2004-08-07 08:08 - 01487723 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-03 15:43 - 2013-09-03 15:43 - 95587704 _____ C:\WINDOWS\system32\랱媊ƌ
2013-09-03 12:52 - 2013-09-03 12:52 - 02347384 _____ (ESET) C:\Dokumente und Einstellungen\ALanghein\Desktop\esetsmartinstaller_enu.exe
2013-09-03 12:49 - 2004-08-07 08:47 - 00000209 _____ C:\WINDOWS\wiadebug.log
2013-09-03 12:47 - 2006-08-20 17:23 - 00002509 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Microsoft Office Word 2003.lnk
2013-09-03 12:15 - 2013-09-03 12:15 - 01084685 _____ (Farbar) C:\Dokumente und Einstellungen\ALanghein\Desktop\FRST.exe
2013-09-03 11:40 - 2013-09-03 10:33 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar
2013-09-03 11:13 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2013-09-03 11:12 - 2013-09-03 11:12 - 00048728 _____ (MalwareBytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2013-09-03 11:11 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\SMINST
2013-09-03 11:10 - 2004-08-07 08:08 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-03 11:09 - 2004-08-07 08:47 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-09-03 11:08 - 2007-02-05 18:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB923414$
2013-09-03 11:08 - 2006-08-10 12:00 - 00000300 ___SH C:\Dokumente und Einstellungen\ALanghein\ntuser.ini
2013-09-03 11:08 - 2006-08-10 12:00 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein
2013-09-03 11:08 - 2006-04-18 02:05 - 00524288 _____ C:\WINDOWS\system32\config\Credenti.evt
2013-09-03 10:33 - 2013-09-03 10:32 - 12907592 _____ (Malwarebytes Corp.) C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar-1.07.0.1005.exe
2013-09-03 10:19 - 2013-09-03 10:19 - 00017324 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Ereignisse.txt
2013-09-03 10:15 - 2013-09-03 10:15 - 00000000 ___SD C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix
2013-09-03 10:12 - 2013-09-03 10:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090313-01.dmp
2013-09-03 10:12 - 2009-02-18 11:03 - 00000000 ____D C:\WINDOWS\Minidump
2013-09-03 10:11 - 2013-09-03 10:00 - 00000000 __SDC C:\ComboFix
2013-09-03 09:53 - 2013-09-03 09:53 - 05119472 ____R (Swearware) C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix.exe
2013-09-03 09:52 - 2006-08-13 03:44 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-09-03 09:44 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\Registration
2013-09-02 14:48 - 2013-09-02 14:48 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Avira
2013-09-02 14:44 - 2013-09-02 14:44 - 00000000 ____D C:\Programme\AskPartnerNetwork
2013-09-02 14:44 - 2011-12-23 13:08 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Mozilla
2013-09-02 14:42 - 2013-09-02 14:42 - 00001671 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2013-09-02 14:42 - 2013-09-02 14:42 - 00000000 ____D C:\Programme\Avira
2013-09-02 14:41 - 2013-09-02 14:42 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-09-02 14:41 - 2013-09-02 14:42 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-09-02 14:41 - 2013-09-02 14:42 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2013-09-02 14:41 - 2013-09-02 14:42 - 00028520 _____ (Avira GmbH) C:\WINDOWS\system32\Drivers\ssmdrv.sys
2013-09-02 14:25 - 2013-09-02 14:25 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-04.dmp
2013-09-02 14:25 - 2013-08-30 07:29 - 00000000 ____C C:\#$%^.txt
2013-09-02 14:01 - 2013-09-02 14:01 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-03.dmp
2013-09-02 13:44 - 2013-09-02 13:43 - 00000000 RSHDC C:\cmdcons
2013-09-02 13:44 - 2004-08-07 07:47 - 00000327 _RSHC C:\boot.ini
2013-09-02 13:34 - 2006-04-18 02:10 - 00085608 _____ C:\WINDOWS\system32\lsass.log
2013-09-02 13:31 - 2011-04-25 18:43 - 00553326 _____ C:\WINDOWS\setupapi.log
2013-09-02 13:19 - 2013-09-02 13:16 - 00000000 ___DC C:\Qoobox
2013-09-02 13:15 - 2013-09-02 13:15 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-02 13:08 - 2013-09-02 13:05 - 00000000 ___DC C:\AdwCleaner
2013-09-02 13:05 - 2013-04-05 14:40 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\CallingID
2013-09-02 12:49 - 2013-09-02 12:49 - 01037134 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\adwcleaner.exe
2013-09-02 12:20 - 2013-09-02 12:20 - 00000000 ____D C:\Programme\7-Zip
2013-09-02 11:55 - 2013-09-02 11:55 - 00016868 _____ C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Ereignisse.txt
2013-09-02 11:28 - 2008-10-05 18:15 - 00001100 _____ C:\WINDOWS\system32\d3d8caps.dat
2013-09-02 11:12 - 2013-09-02 11:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-02.dmp
2013-09-02 11:08 - 2013-09-02 11:08 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-01.dmp
2013-09-02 10:46 - 2013-09-02 10:46 - 00000000 ___DC C:\FRST
2013-09-02 10:44 - 2013-09-02 10:44 - 00000152 _____ C:\Dokumente und Einstellungen\ALanghein\defogger_reenable
2013-09-02 10:05 - 2013-09-02 10:05 - 00377856 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\gmer_2.1.19163.exe
2013-09-02 10:03 - 2013-09-02 10:03 - 00050477 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Defogger.exe
2013-09-02 09:58 - 2007-05-15 17:02 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Software_Download_Security_Freeware
2013-09-02 09:53 - 2006-08-02 22:07 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü
2013-09-02 09:36 - 2004-08-07 07:57 - 00290088 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-02 09:17 - 2013-09-02 09:17 - 00000000 ___DC C:\MaxAVLiveUpdate
2013-08-31 08:01 - 2004-08-07 07:57 - 00228848 _____ C:\WINDOWS\setupact.log
2013-08-31 07:50 - 2007-02-08 12:33 - 00000000 ____D C:\Programme\Games
2013-08-30 19:24 - 2006-08-10 12:00 - 00000000 ___RD C:\Dokumente und Einstellungen\ALanghein\Startmenü\Programme\Autostart
2013-08-30 19:12 - 2006-08-02 13:20 - 00000000 ____D C:\Programme\Google
2013-08-30 17:09 - 2013-08-30 15:19 - 00065536 _____ C:\WINDOWS\system32\config\SpybotSD.evt
2013-08-30 17:02 - 2006-04-18 01:54 - 00000234 ____C C:\WINDOWS\wininit.ini
2013-08-30 16:17 - 2013-08-30 16:16 - 00000000 ___DC C:\EEK
2013-08-30 16:05 - 2013-08-30 15:46 - 00000000 ____D C:\Programme\TrojanHunter 5.5
2013-08-30 15:59 - 2013-08-30 15:59 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\TrojanHunter
2013-08-30 15:46 - 2013-08-30 15:46 - 00059392 ____R C:\WINDOWS\system32\streamhlp.dll
2013-08-30 14:01 - 2013-07-29 12:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-08-30 13:34 - 2013-08-30 13:34 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-30 13:31 - 2013-08-30 13:31 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Malwarebytes
2013-08-30 10:50 - 2004-08-07 08:08 - 00032642 _____ C:\WINDOWS\SchedLgU.Txt
2013-08-30 10:50 - 2004-08-07 08:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-08-30 10:47 - 2013-07-13 10:42 - 00001210 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2627080624-2748659677-743147931-1008UA.job
2013-08-30 10:47 - 2013-07-13 10:42 - 00001158 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2627080624-2748659677-743147931-1008Core.job
2013-08-30 10:38 - 2010-06-07 10:27 - 00001090 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-30 10:38 - 2010-06-07 10:27 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-30 10:01 - 2013-04-05 07:36 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-08-30 10:01 - 2006-08-02 22:07 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService
2013-08-30 07:43 - 2013-08-30 07:43 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService\IETldCache
2013-08-29 11:45 - 2008-12-20 18:16 - 00000966 _____ C:\WINDOWS\Tasks\Google Software Updater.job
2013-08-28 11:33 - 2013-08-28 11:33 - 00004135 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 11:33 - 2013-08-28 11:33 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 11:33 - 2004-08-07 08:07 - 01394458 ____C C:\WINDOWS\tsoc.log
2013-08-28 11:33 - 2004-08-07 08:07 - 00160595 _____ C:\WINDOWS\iis6.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00973720 ____C C:\WINDOWS\comsetup.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00596066 ____C C:\WINDOWS\ntdtcsetup.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00160725 ____C C:\WINDOWS\ocmsn.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00150108 ____C C:\WINDOWS\tabletoc.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00001374 _____ C:\WINDOWS\imsins.log
2013-08-28 11:33 - 2004-08-07 07:50 - 03012351 ____C C:\WINDOWS\FaxSetup.log
2013-08-28 11:33 - 2004-08-07 07:50 - 01493001 ____C C:\WINDOWS\ocgen.log
2013-08-28 11:33 - 2004-08-07 07:50 - 00527115 ____C C:\WINDOWS\netfxocm.log
2013-08-28 11:33 - 2004-08-07 07:50 - 00210832 ____C C:\WINDOWS\MedCtrOC.log
2013-08-28 11:33 - 2004-08-07 07:50 - 00151946 ____C C:\WINDOWS\msgsocm.log
2013-08-28 11:33 - 2004-08-07 07:49 - 00839202 ____C C:\WINDOWS\msmqinst.log
2013-08-26 17:35 - 2008-10-03 12:45 - 00000190 __SHC C:\Dokumente und Einstellungen\Puppi\ntuser.ini
2013-08-26 17:35 - 2008-10-03 12:45 - 00000000 ___DC C:\Dokumente und Einstellungen\Puppi
2013-08-19 12:40 - 2013-08-19 11:59 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Max
2013-08-15 09:35 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-08-15 07:36 - 2013-08-15 07:36 - 00014862 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-15 07:36 - 2009-07-21 07:43 - 00000000 ____D C:\WINDOWS\ie8updates
2013-08-15 07:36 - 2006-04-18 01:44 - 00389340 ____C C:\WINDOWS\updspapi.log
2013-08-15 07:36 - 2004-08-07 07:57 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-08-15 07:30 - 2013-08-15 07:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-15 07:30 - 2013-08-15 07:20 - 00011495 _____ C:\WINDOWS\KB2859537.log
2013-08-15 07:30 - 2013-08-15 07:20 - 00010684 _____ C:\WINDOWS\KB2850869.log
2013-08-15 07:29 - 2013-08-15 07:29 - 00005564 _____ C:\WINDOWS\KB2863058.log
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-15 07:29 - 2007-02-05 18:05 - 00502904 ____C C:\WINDOWS\system32\TZLog.log
2013-08-15 07:27 - 2004-08-07 08:04 - 01372404 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-08-13 08:38 - 2013-08-30 16:57 - 00032328 _____ C:\WINDOWS\Launcher.exe
2013-08-09 17:46 - 2012-05-14 06:58 - 00692104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-08-09 17:46 - 2011-09-19 20:26 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-08-08 14:49 - 2007-01-19 19:04 - 00000276 _____ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2013-08-05 16:00 - 2007-02-05 18:07 - 75778376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2004-08-04 10:00] - [2008-04-14 04:22] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\Windows\System32\winlogon.exe
[2004-08-04 10:00] - [2008-04-14 04:23] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\Windows\System32\svchost.exe
[2004-08-04 10:00] - [2008-04-14 04:23] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\Windows\System32\services.exe
[2004-08-04 10:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\Windows\System32\User32.dll
[2004-08-04 10:00] - [2008-04-14 04:22] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\Windows\System32\userinit.exe
[2004-08-04 10:00] - [2008-04-14 04:23] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\Windows\System32\Drivers\volsnap.sys
[2004-08-04 10:00] - [2008-04-14 03:52] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d
==================== End Of Log ============================
--- --- --- Hallo Leo, ich hatt Dir gestern nachdem ESET 3,5h gescannt hat, bereits geantwortet, ist aber wohl nicht im Forum gelandet (oder ich habe was falsch gemacht)...Sorry!!! Grüße Alex Hier die gewünschten logs: Code:
ATTFilter Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 03-09-2013
Ran by ALanghein at 2013-09-03 12:50:25 Run:2
Running from C:\Dokumente und Einstellungen\ALanghein\Desktop
Boot Mode: Normal
==============================================
Content of fixlist:
*****************
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Akwuq
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ekelnu
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ymvin
*****************
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Akwuq => Moved successfully.
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ekelnu => Moved successfully.
C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Ymvin => Moved successfully.
==== End of Fixlog ====
Code:
ATTFilter ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=47f144a837e0c243bf1392d5b76438c3
# engine=14992
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-09-03 01:29:33
# local_time=2013-09-03 03:29:33 (+0100, Westeuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1799 16775165 100 95 20804 89511 13504 0
# scanned=133181
# found=8
# cleaned=0
# scan_time=9125
sh=1CEC9677AE3EF2F431A4C402B13A95E491A571FC ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\26\3dbd3d1a-53ee796c"
sh=180D50419DE85D6417657E950CF6B3BC1ACF665C ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2013-1493.HL trojan" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\44\1064e5ec-1f541d81"
sh=180D50419DE85D6417657E950CF6B3BC1ACF665C ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2013-1493.HL trojan" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\5\795ca7c5-6bed79ef"
sh=1CEC9677AE3EF2F431A4C402B13A95E491A571FC ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\55\75032e37-2eccc307"
sh=1CEC9677AE3EF2F431A4C402B13A95E491A571FC ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\63\32cf1dbf-14551e81"
sh=3DDDDC03F7EEAC81353BF18DC67DA3308A05F780 ft=0 fh=0000000000000000 vn="Java/Exploit.Agent.PKK trojan" ac=I fn="C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Sun\Java\Deployment\cache\6.0\9\20937989-5b05f65a"
sh=5AD6B211211B063829A1C85749428C43D4382B52 ft=1 fh=4dffb4ad718a2f6d vn="a variant of Win32/Injector.ALXK trojan" ac=I fn="C:\System Volume Information\_restore{B32AEE6A-215A-4A68-95FC-9CABBF245D43}\RP700\A0261819.exe"
sh=636A17A563A4BBB6BC4F2B313F07DD7E76E0B6A9 ft=1 fh=f7bac63656545161 vn="a variant of Win32/Injector.ALXQ trojan" ac=I fn="C:\System Volume Information\_restore{B32AEE6A-215A-4A68-95FC-9CABBF245D43}\RP702\A0267954.exe"
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-09-2013
Ran by ALanghein (administrator) on LANGHEIN on 03-09-2013 16:01:09
Running from C:\Dokumente und Einstellungen\ALanghein\Desktop
Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal
==================== Processes (Whitelisted) ===================
(brother Industries Ltd) C:\WINDOWS\system32\brsvc01a.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\sched.exe
(brother Industries Ltd) C:\WINDOWS\system32\brss01a.exe
(Cognizance Corporation) C:\Programme\HPQ\IAM\bin\asghost.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avguard.exe
(APN LLC.) C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe
(Broadcom Corporation.) C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe
(Teruten) C:\WINDOWS\system32\FsUsbExService.Exe
(Google Inc.) C:\Programme\Google\Update\GoogleUpdate.exe
(Microsoft Corporation) C:\WINDOWS\system32\inetsrv\inetinfo.exe
(Sun Microsystems, Inc.) C:\Programme\Java\jre6\bin\jqs.exe
(Hewlett-Packard Company) C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
(Microsoft Corporation) C:\WINDOWS\System32\snmp.exe
(TomTom) C:\Programme\TomTom HOME 2\TomTomHOMEService.exe
(Hewlett-Packard Development Company, L.P.) C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Programme\Windows Media Player\WMPNetwk.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE
(Analog Devices, Inc.) C:\Programme\Analog Devices\Core\smax4pnp.exe
(Sonic Solutions) C:\WINDOWS\System32\DLA\DLACTRLW.EXE
(Synaptics, Inc.) C:\Programme\Synaptics\SynTP\SynTPEnh.exe
(Intel Corporation) C:\WINDOWS\system32\igfxsrvc.exe
(Intel Corporation) C:\WINDOWS\system32\hkcmd.exe
(Intel Corporation) C:\WINDOWS\system32\igfxpers.exe
(Hewlett-Packard Development Company, L.P.) C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
( Hewlett-Packard Development Company, L.P.) C:\Programme\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
() C:\WINDOWS\SMINST\Scheduler.exe
() C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE
(Adobe Systems Inc.) C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
(Apple Computer, Inc.) C:\Programme\QuickTime\qttask.exe
(Apple Computer, Inc.) C:\Programme\iTunes\iTunesHelper.exe
(Hewlett-Packard) C:\Programme\Hp\HP Software Update\HPWuSchd2.exe
(InstallShield Software Corporation) C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe
(Sun Microsystems, Inc.) C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe
(Agere Systems) C:\WINDOWS\AGRSMMSG.exe
(Samsung Electronics Co., Ltd.) C:\Programme\Samsung\Kies\KiesTrayAgent.exe
(Avira Operations GmbH & Co. KG) C:\Programme\Avira\AntiVir Desktop\avgnt.exe
(Apple Computer, Inc.) C:\Programme\iPod\bin\iPodService.exe
(APN) C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe
(Google Inc.) C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Microsoft Corporation) C:\Programme\Messenger\msmsgs.exe
(Microsoft Corporation) C:\Programme\Windows Media Player\WMPNSCFG.exe
(TomTom) C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe
(Samsung) C:\Programme\Samsung\Kies\Kies.exe
(Samsung) C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Microsoft Corporation) C:\WINDOWS\system32\wscntfy.exe
(Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [MsmqIntCert] - regsvr32 /s mqrt.dll [x]
HKLM\...\Run: [SoundMAXPnP] - C:\Programme\Analog Devices\Core\smax4pnp.exe [925696 2005-05-20] (Analog Devices, Inc.)
HKLM\...\Run: [SoundMAX] - C:\Programme\Analog Devices\SoundMAX\Smax4.exe [716800 2005-05-06] (Analog Devices, Inc.)
HKLM\...\Run: [PTHOSTTR] - C:\Programme\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE [122880 2006-02-14] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [DLA] - C:\WINDOWS\System32\DLA\DLACTRLW.EXE [122940 2005-08-31] (Sonic Solutions)
HKLM\...\Run: [SynTPEnh] - C:\Programme\Synaptics\SynTP\SynTPEnh.exe [761945 2005-11-10] (Synaptics, Inc.)
HKLM\...\Run: [igfxhkcmd] - C:\WINDOWS\system32\hkcmd.exe [77824 2006-03-23] (Intel Corporation)
HKLM\...\Run: [igfxpers] - C:\WINDOWS\system32\igfxpers.exe [118784 2006-03-23] (Intel Corporation)
HKLM\...\Run: [hpWirelessAssistant] - C:\Programme\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [454656 2006-02-14] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [CognizanceTS] - C:\PROGRA~1\HPQ\IAM\Bin\AsTsVcc.dll [17920 2003-12-22] (Cognizance Corporation)
HKLM\...\Run: [QlbCtrl] - %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [x]
HKLM\...\Run: [Cpqset] - C:\Programme\HPQ\Default Settings\cpqset.exe [40960 2006-02-22] ()
HKLM\...\Run: [Recguard] - C:\WINDOWS\Sminst\Recguard.exe [1187840 2005-12-20] ()
HKLM\...\Run: [Scheduler] - C:\WINDOWS\SMINST\Scheduler.exe [892928 2006-02-15] ()
HKLM\...\Run: [WatchDog] - C:\Programme\InterVideo\DVD Check\DVDCheck.exe [184320 2005-11-08] (InterVideo Inc.)
HKLM\...\Run: [Acrobat Assistant 7.0] - C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [483328 2008-04-23] (Adobe Systems Inc.)
HKLM\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [282624 2006-10-25] (Apple Computer, Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Programme\iTunes\iTunesHelper.exe [256576 2006-10-30] (Apple Computer, Inc.)
HKLM\...\Run: [HP Software Update] - C:\Programme\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM\...\Run: [ISUSPM Startup] - C:\PROGRA~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe [221184 2004-07-27] (InstallShield Software Corporation)
HKLM\...\Run: [ISUSScheduler] - C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe [81920 2004-07-27] (InstallShield Software Corporation)
HKLM\...\Run: [NPSStartup] - [x]
HKLM\...\Run: [SunJavaUpdateSched] - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe [254696 2011-06-09] (Sun Microsystems, Inc.)
HKLM\...\Run: [AGRSMMSG] - C:\Windows\AGRSMMSG.exe [88203 2006-01-30] (Agere Systems)
HKLM\...\Run: [Adobe ARM] - C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [KiesTrayAgent] - C:\Programme\Samsung\Kies\KiesTrayAgent.exe [311152 2013-07-15] (Samsung Electronics Co., Ltd.)
HKLM\...\Run: [avgnt] - C:\Programme\Avira\AntiVir Desktop\avgnt.exe [347192 2013-09-02] (Avira Operations GmbH & Co. KG)
HKLM\...\Run: [ApnTBMon] - C:\Programme\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe [1558480 2013-07-26] (APN)
HKLM\...\RunOnce: [ (A0)] - cmd /c "C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar\mbar.exe" /rdv /s [1178424 2013-08-14] (Malwarebytes Corporation)
Winlogon\Notify\OneCard: C:\Programme\HPQ\IAM\Bin\AsWlnPkg.dll [X]
Winlogon\Notify\WgaLogon: WgaLogon.dll (Microsoft Corporation)
HKLM\...\Policies\Explorer: [HonorAutoRunSetting] 1
HKLM\...\Policies\Explorer: [NoCDBurning] 0
HKLM\...\Policies\Explorer: [NoDriveAutoRun] 67108863
HKLM\...\Policies\Explorer: [NoDriveTypeAutoRun] 323
HKCU\...\Run: [PDF-Viewer] - C:\programme\PDFDruck\PDFDruck.exe [461824 2005-12-08] ()
HKCU\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [68856 2007-07-14] (Google Inc.)
HKCU\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [1695232 2008-04-14] (Microsoft Corporation)
HKCU\...\Run: [WMPNSCFG] - C:\Programme\Windows Media Player\WMPNSCFG.exe [204288 2006-11-03] (Microsoft Corporation)
HKCU\...\Run: [TomTomHOME.exe] - C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe [247728 2011-12-05] (TomTom)
HKCU\...\Run: [Internet Manager] - C:\Programme\T-Mobile\InternetManager_H\Internet Manager.exe [x]
HKCU\...\Run: [KiesPreload] - C:\Programme\Samsung\Kies\Kies.exe [1564016 2013-07-15] (Samsung)
HKCU\...\Run: [KiesAirMessage] - C:\Programme\Samsung\Kies\KiesAirMessage.exe -startup [x]
HKCU\...\Run: [] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [844656 2013-07-15] (Samsung)
HKCU\...\Policies\Explorer: [NoDriveTypeAutoRun] 323
HKCU\...\Policies\Explorer: [NoDriveAutoRun] 67108863
HKU\179599\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Default User\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Motte\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Motte\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [ 2006-10-25] (Apple Computer, Inc.)
HKU\Motte\...\Run: [WMPNSCFG] - C:\Programme\Windows Media Player\WMPNSCFG.exe [ 2006-11-03] (Microsoft Corporation)
HKU\Nutzer\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Nutzer\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [ 2006-10-25] (Apple Computer, Inc.)
HKU\Puppi\...\Run: [MSMSGS] - C:\Programme\Messenger\msmsgs.exe [ 2008-04-14] (Microsoft Corporation)
HKU\Puppi\...\Run: [QuickTime Task] - C:\Programme\QuickTime\qttask.exe [ 2006-10-25] (Apple Computer, Inc.)
HKU\Puppi\...\Run: [swg] - C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2007-07-14] (Google Inc.)
HKU\Puppi\...\Run: [KiesPDLR] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-07-15] (Samsung)
HKU\Puppi\...\Run: [WMPNSCFG] - C:\Programme\Windows Media Player\WMPNSCFG.exe [ 2006-11-03] (Microsoft Corporation)
HKU\Puppi\...\Run: [Google Update] - C:\Dokumente und Einstellungen\Puppi\Lokale Einstellungen\Anwendungsdaten\Google\Update\GoogleUpdate.exe [ 2013-07-13] (Google Inc.)
HKU\Puppi\...\Run: [] - C:\Programme\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [ 2013-07-15] (Samsung)
HKU\Puppi\...\Run: [ChromeFrameHelper] - C:\Dokumente und Einstellungen\Puppi\Lokale Einstellungen\Anwendungsdaten\Google\Chrome Frame\Application\28.0.1500.95\chrome_frame_helper.exe [ 2013-07-25] (Google Inc.)
SSODL: UPnPMonitor - {e57ce738-33e8-4c51-8354-bb4de9d215d1} - C:\WINDOWS\system32\upnpui.dll (Microsoft Corporation)
BootExecute: autocheck autochk * sdnclean.exe
==================== Internet (Whitelisted) ====================
ProxyServer: localhost:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://avira.search.ask.com/?p2=%5EB0Q%5EYYYYYY%5EYY%5EDE&gct=hp&o=APN11074&apn_ptnrs=%5EB0Q&apn_dtid=%5EYYYYYY%5EYY%5EDE&tpid=AVIRA-V7&apn_dbr=ie_8.0.6001.18702&trgb=ALL&apn_uid=894FC0C0-473A-49EA-80BA-5F0485B6646F&itbv=12.2.2.663&doi=2013-09-02&psv=
HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = hxxp://search.certified-toolbar.com?si=66920&st=bs&tid=6787&ver=4.4&ts=1377874551375&tguid=66920-6787-1377874551375-1BEC96FE8E422D04C0C9213B85A6D62B&q={searchTerms}
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL (Sonic Solutions)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.7.8313.1002\swg.dll (Google Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Programme\HPQ\IAM\Bin\ItIeAddIN.dll (Infineon Technologies AG)
BHO: JQSIEStartDetectorImpl Class - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM - Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
Toolbar: HKCU -&Adresse - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\Windows\system32\browseui.dll (Microsoft Corporation)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -&Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)
Toolbar: HKCU -Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -Avira SearchFree Toolbar plus Web Protection - {41564952-412D-5637-00A7-7A786E7484D7} - C:\Programme\AskPartnerNetwork\Toolbar\AVIRA-V7\Passport.dll (APN LLC.)
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
Handler: t-mobile - No CLSID Value -
Winsock: Catalog9 01 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 30 C:\Programme\Avira\AntiVir Desktop\avsda.dll [258104] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 192.168.1.1
Tcpip\..\Interfaces\{B0023DEB-8417-4757-B9B6-53C751E805BB}: [NameServer]172.31.8.254,172.31.8.101
FireFox:
========
FF Plugin: @java.com/JavaPlugin - C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @pack.google.com/Google Updater;version=14 - C:\Programme\Google\Google Updater\2.4.2432.1652\npCIDetect14.dll (Google)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Programme\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Programme\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\...\Firefox\Extensions: [jqs@sun.com] C:\Programme\Java\jre6\lib\deploy\jqs\ff
FF Extension: Java Quick Starter - C:\Programme\Java\jre6\lib\deploy\jqs\ff
Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR RestoreOnStartup: "urls_to_restore_on_startup": [
CHR Plugin: (Shockwave Flash) - C:\Programme\Google\Chrome\Application\29.0.1547.62\PepperFlash\pepflashplayer.dll No File
CHR Extension: (Chrome In-App Payments service) - C:\DOKUME~1\ALANGH~1\LOKALE~1\Anwendungsdaten\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR HKLM\...\Chrome\Extension: [aaaaacalgebmfelllfiaoknifldpngjh] - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\AskPartnerNetwork\Toolbar\AVIRA-V7\CRX\ToolbarCR.crx
========================== Services (Whitelisted) =================
S3 Adobe LM Service; C:\Programme\Gemeinsame Dateien\Adobe Systems Shared\Service\Adobelmsvc.exe [69632 2007-01-19] (Adobe Systems)
R2 AntiVirSchedulerService; C:\Programme\Avira\AntiVir Desktop\sched.exe [84024 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Programme\Avira\AntiVir Desktop\avguard.exe [108088 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Programme\Avira\AntiVir Desktop\AVWEBGRD.EXE [815160 2013-09-02] (Avira Operations GmbH & Co. KG)
R2 APNMCP; C:\Programme\AskPartnerNetwork\Toolbar\apnmcp.exe [168400 2013-07-26] (APN LLC.)
R2 ASChannel; C:\Programme\HPQ\IAM\Bin\ASChnl.dll [117248 2005-06-01] (Cognizance Corporation)
R2 Brother XP spl Service; C:\WINDOWS\system32\brsvc01a.exe [57344 2004-06-14] (brother Industries Ltd)
R2 btwdins; C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe [258103 2006-02-15] (Broadcom Corporation.)
S2 gupdate; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-06-07] (Google Inc.)
S3 gupdatem; C:\Programme\Google\Update\GoogleUpdate.exe [136176 2010-06-07] (Google Inc.)
S2 gusvc; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [194032 2012-08-20] (Google)
R3 hpqcxs08; C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll [225280 2007-01-19] (Hewlett-Packard Co.)
R2 hpqddsvc; C:\Programme\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll [131072 2007-01-19] (Hewlett-Packard Co.)
R2 hpqwmiex; C:\Programme\Hewlett-Packard\Shared\hpqwmiex.exe [98304 2006-01-12] (Hewlett-Packard Development Company, L.P.)
S3 IDriverT; c:\Programme\Gemeinsame Dateien\InstallShield\Driver\1050\Intel 32\IDriverT.exe [73728 2004-10-22] (Macrovision Corporation)
R2 IISADMIN; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R3 iPod Service; C:\Programme\iPod\bin\iPodService.exe [492608 2006-10-30] (Apple Computer, Inc.)
R2 LightScribeService; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [73728 2006-01-20] (Hewlett-Packard Company)
S3 LPDSVC; C:\Windows\system32\tcpsvcs.exe [19456 2004-08-04] (Microsoft Corporation)
S2 MSMQ; C:\WINDOWS\system32\mqsvc.exe [4608 2008-04-14] (Microsoft Corporation)
S2 MSMQTriggers; C:\WINDOWS\system32\mqtgsvc.exe [117248 2008-04-14] (Microsoft Corporation)
S3 ose; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)
S2 PCA; C:\WINDOWS\SMINST\PCAngel.exe [294912 2006-01-12] (SoftThinks)
R2 SMTPSVC; C:\WINDOWS\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R2 TomTomHOMEService; C:\Programme\TomTom HOME 2\TomTomHOMEService.exe [92592 2011-12-05] (TomTom)
R2 W3SVC; C:\Windows\system32\inetsrv\inetinfo.exe [15872 2008-04-14] (Microsoft Corporation)
R2 WMPNetworkSvc; C:\Programme\Windows Media Player\WMPNetwk.exe [920576 2006-11-03] (Microsoft Corporation)
R2 JavaQuickStarterService; "C:\Programme\Java\jre6\bin\jqs.exe" -service -config "C:\Programme\Java\jre6\lib\deploy\jqs\jqs.conf" [x]
==================== Drivers (Whitelisted) ====================
S3 actser; C:\Windows\System32\drivers\actser.sys [29440 2004-12-16] (Siemens AG)
R3 AEAudioService; C:\Windows\System32\drivers\AEAudio.sys [152960 2005-06-07] (Andrea Electronics Corporation)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [88840 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136672 2013-09-02] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-09-02] (Avira Operations GmbH & Co. KG)
S3 btaudio; C:\Windows\System32\drivers\btaudio.sys [401664 2006-02-15] (Broadcom Corporation.)
S3 BTDriver; C:\Windows\System32\DRIVERS\btport.sys [30363 2006-02-15] (Broadcom Corporation.)
R3 BTKRNL; C:\Windows\System32\DRIVERS\btkrnl.sys [1342570 2006-02-15] (Broadcom Corporation.)
S3 BTWDNDIS; C:\Windows\System32\DRIVERS\btwdndis.sys [148168 2006-02-15] (Broadcom Corporation.)
S3 btwmodem; C:\Windows\System32\DRIVERS\btwmodem.sys [30189 2006-02-15] (Broadcom Corporation.)
S3 BTWUSB; C:\Windows\System32\Drivers\btwusb.sys [57096 2006-02-15] (Broadcom Corporation.)
S3 cleanhlp; C:\EEK\Run\cleanhlp32.sys [50200 2013-08-30] (Emsisoft GmbH)
R2 DLABOIOM; C:\Windows\System32\DLA\DLABOIOM.SYS [25628 2005-08-31] (Sonic Solutions)
R1 DLACDBHM; C:\Windows\System32\Drivers\DLACDBHM.SYS [5628 2005-08-25] (Sonic Solutions)
R2 DLADResN; C:\Windows\System32\DLA\DLADResN.SYS [2496 2005-08-31] (Sonic Solutions)
R2 DLAIFS_M; C:\Windows\System32\DLA\DLAIFS_M.SYS [86524 2005-08-31] (Sonic Solutions)
R2 DLAOPIOM; C:\Windows\System32\DLA\DLAOPIOM.SYS [14684 2005-08-31] (Sonic Solutions)
R2 DLAPoolM; C:\Windows\System32\DLA\DLAPoolM.SYS [6364 2005-08-31] (Sonic Solutions)
R1 DLARTL_N; C:\Windows\System32\Drivers\DLARTL_N.SYS [22684 2005-08-25] (Sonic Solutions)
R2 DLAUDFAM; C:\Windows\System32\DLA\DLAUDFAM.SYS [94332 2005-08-31] (Sonic Solutions)
R2 DLAUDF_M; C:\Windows\System32\DLA\DLAUDF_M.SYS [87036 2005-08-31] (Sonic Solutions)
R2 DRVNDDM; C:\Windows\System32\Drivers\DRVNDDM.SYS [40544 2005-08-12] (Sonic Solutions)
R1 eabfiltr; C:\Windows\System32\DRIVERS\eabfiltr.sys [7808 2005-09-19] (Hewlett-Packard Development Company, L.P.)
S3 eabusb; C:\Windows\System32\DRIVERS\eabusb.sys [5760 2005-09-19] (Hewlett-Packard Development Company, L.P.)
R3 FsUsbExDisk; C:\WINDOWS\system32\FsUsbExDisk.SYS [36608 2010-06-14] ()
S3 G3GRUMDM; C:\Windows\System32\DRIVERS\g3grumdm.sys [24832 2004-10-05] (Option N.V.)
S3 G3GRUSER; C:\Windows\System32\DRIVERS\g3gruser.sys [21760 2004-10-05] (Option N.V.)
S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [49920 2006-12-06] (HP)
S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2006-12-06] (HP)
S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21568 2006-12-06] (HP)
R3 ialm; C:\Windows\System32\DRIVERS\ialmnt5.sys [1166972 2006-03-23] (Intel Corporation)
R3 mbamchameleon; C:\WINDOWS\system32\drivers\mbamchameleon.sys [48728 2013-09-03] (MalwareBytes)
R3 MQAC; C:\WINDOWS\system32\drivers\mqac.sys [92544 2008-04-13] (Microsoft Corporation)
S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation)
S3 Rasirda; C:\Windows\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation)
S3 SMCIRDA; C:\Windows\System32\DRIVERS\smcirda.sys [35913 2001-08-18] (SMC)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [642560 2006-08-24] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-09-02] (Avira GmbH)
S3 vsbus; C:\Windows\System32\DRIVERS\vsb.sys [15264 2005-07-18] ()
S3 vserial; C:\Windows\System32\DRIVERS\vserial.sys [47744 2005-07-18] ()
R3 w39n51; C:\Windows\System32\DRIVERS\w39n51.sys [1428096 2006-01-19] (Intel® Corporation)
S3 W8100PCI; C:\Windows\System32\DRIVERS\mrv8k51.sys [258560 2004-10-05] (Marvell Semiconductor, Inc)
U5 Browser; C:\Windows\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)
S3 catchme; \??\C:\DOKUME~1\ALANGH~1\LOKALE~1\Temp\catchme.sys [x]
S3 dtscsi; No ImagePath
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [x]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [x]
S3 ew_usbenumfilter; system32\DRIVERS\ew_usbenumfilter.sys [x]
S3 filtertdidriver; system32\drivers\ewfiltertdidriver.sys [x]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [x]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [x]
S3 JL2005C; System32\Drivers\jl2005c.sys [x]
U5 Messenger; C:\Windows\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)
U5 ScsiPort; C:\Windows\system32\drivers\scsiport.sys [96384 2008-04-13] (Microsoft Corporation)
U5 Sdbus; C:\Windows\System32\Drivers\Sdbus.sys [79232 2008-04-13] (Microsoft Corporation)
S3 ss_bbus; system32\DRIVERS\ss_bbus.sys [x]
S3 ss_bmdfl; system32\DRIVERS\ss_bmdfl.sys [x]
S3 ss_bmdm; system32\DRIVERS\ss_bmdm.sys [x]
S3 ss_bus; system32\DRIVERS\ss_bus.sys [x]
S3 ss_mdfl; system32\DRIVERS\ss_mdfl.sys [x]
S3 ss_mdm; system32\DRIVERS\ss_mdm.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 15:43 - 2013-09-03 15:43 - 95587704 _____ C:\WINDOWS\system32\랱媊ƌ
2013-09-03 12:52 - 2013-09-03 12:52 - 02347384 _____ (ESET) C:\Dokumente und Einstellungen\ALanghein\Desktop\esetsmartinstaller_enu.exe
2013-09-03 12:15 - 2013-09-03 12:15 - 01084685 _____ (Farbar) C:\Dokumente und Einstellungen\ALanghein\Desktop\FRST.exe
2013-09-03 11:12 - 2013-09-03 11:12 - 00048728 _____ (MalwareBytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2013-09-03 10:33 - 2013-09-03 11:40 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar
2013-09-03 10:32 - 2013-09-03 10:33 - 12907592 _____ (Malwarebytes Corp.) C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar-1.07.0.1005.exe
2013-09-03 10:19 - 2013-09-03 10:19 - 00017324 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Ereignisse.txt
2013-09-03 10:15 - 2013-09-03 10:15 - 00000000 ___SD C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix
2013-09-03 10:12 - 2013-09-03 10:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090313-01.dmp
2013-09-03 10:00 - 2013-09-03 10:11 - 00000000 __SDC C:\ComboFix
2013-09-03 09:53 - 2013-09-03 09:53 - 05119472 ____R (Swearware) C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix.exe
2013-09-02 14:48 - 2013-09-02 14:48 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Avira
2013-09-02 14:44 - 2013-09-02 14:44 - 00000000 ____D C:\Programme\AskPartnerNetwork
2013-09-02 14:42 - 2013-09-02 14:42 - 00001671 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2013-09-02 14:42 - 2013-09-02 14:42 - 00000000 ____D C:\Programme\Avira
2013-09-02 14:42 - 2013-09-02 14:41 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-09-02 14:42 - 2013-09-02 14:41 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-09-02 14:42 - 2013-09-02 14:41 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2013-09-02 14:42 - 2013-09-02 14:41 - 00028520 _____ (Avira GmbH) C:\WINDOWS\system32\Drivers\ssmdrv.sys
2013-09-02 14:25 - 2013-09-02 14:25 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-04.dmp
2013-09-02 14:01 - 2013-09-02 14:01 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-03.dmp
2013-09-02 13:44 - 2008-03-08 06:54 - 00000211 ____C C:\Boot.bak
2013-09-02 13:44 - 2004-08-03 23:00 - 00262448 _RSHC C:\cmldr
2013-09-02 13:43 - 2013-09-02 13:44 - 00000000 RSHDC C:\cmdcons
2013-09-02 13:20 - 2011-06-26 08:45 - 00256000 _____ C:\WINDOWS\PEV.exe
2013-09-02 13:20 - 2010-11-07 19:20 - 00208896 _____ C:\WINDOWS\MBR.exe
2013-09-02 13:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00098816 _____ C:\WINDOWS\sed.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00080412 _____ C:\WINDOWS\grep.exe
2013-09-02 13:20 - 2000-08-31 02:00 - 00068096 _____ C:\WINDOWS\zip.exe
2013-09-02 13:16 - 2013-09-02 13:19 - 00000000 ___DC C:\Qoobox
2013-09-02 13:15 - 2013-09-02 13:15 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-02 13:05 - 2013-09-02 13:08 - 00000000 ___DC C:\AdwCleaner
2013-09-02 12:49 - 2013-09-02 12:49 - 01037134 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\adwcleaner.exe
2013-09-02 12:20 - 2013-09-02 12:20 - 00000000 ____D C:\Programme\7-Zip
2013-09-02 11:55 - 2013-09-02 11:55 - 00016868 _____ C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Ereignisse.txt
2013-09-02 11:12 - 2013-09-02 11:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-02.dmp
2013-09-02 11:08 - 2013-09-02 11:08 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-01.dmp
2013-09-02 10:46 - 2013-09-02 10:46 - 00000000 ___DC C:\FRST
2013-09-02 10:44 - 2013-09-02 10:44 - 00000152 _____ C:\Dokumente und Einstellungen\ALanghein\defogger_reenable
2013-09-02 10:05 - 2013-09-02 10:05 - 00377856 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\gmer_2.1.19163.exe
2013-09-02 10:03 - 2013-09-02 10:03 - 00050477 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Defogger.exe
2013-09-02 09:29 - 2012-06-15 16:39 - 00169744 _____ C:\WINDOWS\system32\ztvunrar36.dll
2013-09-02 09:29 - 2012-06-15 16:35 - 00185616 _____ C:\WINDOWS\system32\ztvunrar39.dll
2013-09-02 09:29 - 2012-06-15 16:33 - 00605968 _____ (Igor Pavlov) C:\WINDOWS\system32\ztv7z.dll
2013-09-02 09:29 - 2012-06-15 16:33 - 00077072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ztvcabinet.dll
2013-09-02 09:29 - 2005-08-26 01:50 - 00077312 _____ C:\WINDOWS\system32\ztvunace26.dll
2013-09-02 09:29 - 2003-02-02 20:06 - 00153088 _____ C:\WINDOWS\system32\UNRAR3.dll
2013-09-02 09:29 - 2002-03-06 01:00 - 00075264 _____ C:\WINDOWS\system32\unacev2.dll
2013-09-02 09:17 - 2013-09-02 09:17 - 00000000 ___DC C:\MaxAVLiveUpdate
2013-08-30 16:57 - 2013-08-13 08:38 - 00032328 _____ C:\WINDOWS\Launcher.exe
2013-08-30 16:16 - 2013-08-30 16:17 - 00000000 ___DC C:\EEK
2013-08-30 15:59 - 2013-08-30 15:59 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\TrojanHunter
2013-08-30 15:46 - 2013-08-30 16:05 - 00000000 ____D C:\Programme\TrojanHunter 5.5
2013-08-30 15:46 - 2013-08-30 15:46 - 00059392 ____R C:\WINDOWS\system32\streamhlp.dll
2013-08-30 15:19 - 2013-08-30 17:09 - 00065536 _____ C:\WINDOWS\system32\config\SpybotSD.evt
2013-08-30 13:34 - 2013-08-30 13:34 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-30 13:31 - 2013-08-30 13:31 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Malwarebytes
2013-08-30 07:43 - 2013-08-30 07:43 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService\IETldCache
2013-08-30 07:29 - 2013-09-02 14:25 - 00000000 ____C C:\#$%^.txt
2013-08-28 11:33 - 2013-08-28 11:33 - 00004135 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 11:33 - 2013-08-28 11:33 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-19 11:59 - 2013-08-19 12:40 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Max
2013-08-15 07:36 - 2013-08-15 07:36 - 00014862 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-15 07:30 - 2013-08-15 07:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-15 07:29 - 2013-08-15 07:29 - 00005564 _____ C:\WINDOWS\KB2863058.log
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-15 07:20 - 2013-08-15 07:30 - 00011495 _____ C:\WINDOWS\KB2859537.log
2013-08-15 07:20 - 2013-08-15 07:30 - 00010684 _____ C:\WINDOWS\KB2850869.log
==================== One Month Modified Files and Folders =======
2013-09-03 16:00 - 2006-08-02 22:07 - 00000000 ____D C:\Programme
2013-09-03 16:00 - 2004-08-07 08:08 - 01487723 _____ C:\WINDOWS\WindowsUpdate.log
2013-09-03 15:43 - 2013-09-03 15:43 - 95587704 _____ C:\WINDOWS\system32\랱媊ƌ
2013-09-03 12:52 - 2013-09-03 12:52 - 02347384 _____ (ESET) C:\Dokumente und Einstellungen\ALanghein\Desktop\esetsmartinstaller_enu.exe
2013-09-03 12:49 - 2004-08-07 08:47 - 00000209 _____ C:\WINDOWS\wiadebug.log
2013-09-03 12:47 - 2006-08-20 17:23 - 00002509 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Microsoft Office Word 2003.lnk
2013-09-03 12:15 - 2013-09-03 12:15 - 01084685 _____ (Farbar) C:\Dokumente und Einstellungen\ALanghein\Desktop\FRST.exe
2013-09-03 11:40 - 2013-09-03 10:33 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar
2013-09-03 11:13 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\system32\inetsrv
2013-09-03 11:12 - 2013-09-03 11:12 - 00048728 _____ (MalwareBytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2013-09-03 11:11 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\SMINST
2013-09-03 11:10 - 2004-08-07 08:08 - 00001158 _____ C:\WINDOWS\system32\wpa.dbl
2013-09-03 11:09 - 2004-08-07 08:47 - 00000050 _____ C:\WINDOWS\wiaservc.log
2013-09-03 11:08 - 2007-02-05 18:04 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB923414$
2013-09-03 11:08 - 2006-08-10 12:00 - 00000300 ___SH C:\Dokumente und Einstellungen\ALanghein\ntuser.ini
2013-09-03 11:08 - 2006-08-10 12:00 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein
2013-09-03 11:08 - 2006-04-18 02:05 - 00524288 _____ C:\WINDOWS\system32\config\Credenti.evt
2013-09-03 10:33 - 2013-09-03 10:32 - 12907592 _____ (Malwarebytes Corp.) C:\Dokumente und Einstellungen\ALanghein\Desktop\mbar-1.07.0.1005.exe
2013-09-03 10:19 - 2013-09-03 10:19 - 00017324 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Ereignisse.txt
2013-09-03 10:15 - 2013-09-03 10:15 - 00000000 ___SD C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix
2013-09-03 10:12 - 2013-09-03 10:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090313-01.dmp
2013-09-03 10:12 - 2009-02-18 11:03 - 00000000 ____D C:\WINDOWS\Minidump
2013-09-03 10:11 - 2013-09-03 10:00 - 00000000 __SDC C:\ComboFix
2013-09-03 09:53 - 2013-09-03 09:53 - 05119472 ____R (Swearware) C:\Dokumente und Einstellungen\ALanghein\Desktop\ComboFix.exe
2013-09-03 09:52 - 2006-08-13 03:44 - 00000000 ____D C:\WINDOWS\system32\NtmsData
2013-09-03 09:44 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\Registration
2013-09-02 14:48 - 2013-09-02 14:48 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Avira
2013-09-02 14:44 - 2013-09-02 14:44 - 00000000 ____D C:\Programme\AskPartnerNetwork
2013-09-02 14:44 - 2011-12-23 13:08 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Mozilla
2013-09-02 14:42 - 2013-09-02 14:42 - 00001671 _____ C:\Dokumente und Einstellungen\All Users\Desktop\Avira Control Center.lnk
2013-09-02 14:42 - 2013-09-02 14:42 - 00000000 ____D C:\Programme\Avira
2013-09-02 14:41 - 2013-09-02 14:42 - 00136672 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avipbb.sys
2013-09-02 14:41 - 2013-09-02 14:42 - 00088840 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avgntflt.sys
2013-09-02 14:41 - 2013-09-02 14:42 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\WINDOWS\system32\Drivers\avkmgr.sys
2013-09-02 14:41 - 2013-09-02 14:42 - 00028520 _____ (Avira GmbH) C:\WINDOWS\system32\Drivers\ssmdrv.sys
2013-09-02 14:25 - 2013-09-02 14:25 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-04.dmp
2013-09-02 14:25 - 2013-08-30 07:29 - 00000000 ____C C:\#$%^.txt
2013-09-02 14:01 - 2013-09-02 14:01 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-03.dmp
2013-09-02 13:44 - 2013-09-02 13:43 - 00000000 RSHDC C:\cmdcons
2013-09-02 13:44 - 2004-08-07 07:47 - 00000327 _RSHC C:\boot.ini
2013-09-02 13:34 - 2006-04-18 02:10 - 00085608 _____ C:\WINDOWS\system32\lsass.log
2013-09-02 13:31 - 2011-04-25 18:43 - 00553326 _____ C:\WINDOWS\setupapi.log
2013-09-02 13:19 - 2013-09-02 13:16 - 00000000 ___DC C:\Qoobox
2013-09-02 13:15 - 2013-09-02 13:15 - 00000000 ____D C:\WINDOWS\erdnt
2013-09-02 13:08 - 2013-09-02 13:05 - 00000000 ___DC C:\AdwCleaner
2013-09-02 13:05 - 2013-04-05 14:40 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\CallingID
2013-09-02 12:49 - 2013-09-02 12:49 - 01037134 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\adwcleaner.exe
2013-09-02 12:20 - 2013-09-02 12:20 - 00000000 ____D C:\Programme\7-Zip
2013-09-02 11:55 - 2013-09-02 11:55 - 00016868 _____ C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Ereignisse.txt
2013-09-02 11:28 - 2008-10-05 18:15 - 00001100 _____ C:\WINDOWS\system32\d3d8caps.dat
2013-09-02 11:12 - 2013-09-02 11:12 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-02.dmp
2013-09-02 11:08 - 2013-09-02 11:08 - 00090112 _____ C:\WINDOWS\Minidump\Mini090213-01.dmp
2013-09-02 10:46 - 2013-09-02 10:46 - 00000000 ___DC C:\FRST
2013-09-02 10:44 - 2013-09-02 10:44 - 00000152 _____ C:\Dokumente und Einstellungen\ALanghein\defogger_reenable
2013-09-02 10:05 - 2013-09-02 10:05 - 00377856 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\gmer_2.1.19163.exe
2013-09-02 10:03 - 2013-09-02 10:03 - 00050477 _____ C:\Dokumente und Einstellungen\ALanghein\Desktop\Defogger.exe
2013-09-02 09:58 - 2007-05-15 17:02 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Software_Download_Security_Freeware
2013-09-02 09:53 - 2006-08-02 22:07 - 00000000 ___RD C:\Dokumente und Einstellungen\All Users\Startmenü
2013-09-02 09:36 - 2004-08-07 07:57 - 00290088 _____ C:\WINDOWS\system32\FNTCACHE.DAT
2013-09-02 09:17 - 2013-09-02 09:17 - 00000000 ___DC C:\MaxAVLiveUpdate
2013-08-31 08:01 - 2004-08-07 07:57 - 00228848 _____ C:\WINDOWS\setupact.log
2013-08-31 07:50 - 2007-02-08 12:33 - 00000000 ____D C:\Programme\Games
2013-08-30 19:24 - 2006-08-10 12:00 - 00000000 ___RD C:\Dokumente und Einstellungen\ALanghein\Startmenü\Programme\Autostart
2013-08-30 19:12 - 2006-08-02 13:20 - 00000000 ____D C:\Programme\Google
2013-08-30 17:09 - 2013-08-30 15:19 - 00065536 _____ C:\WINDOWS\system32\config\SpybotSD.evt
2013-08-30 17:02 - 2006-04-18 01:54 - 00000234 ____C C:\WINDOWS\wininit.ini
2013-08-30 16:17 - 2013-08-30 16:16 - 00000000 ___DC C:\EEK
2013-08-30 16:05 - 2013-08-30 15:46 - 00000000 ____D C:\Programme\TrojanHunter 5.5
2013-08-30 15:59 - 2013-08-30 15:59 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\TrojanHunter
2013-08-30 15:46 - 2013-08-30 15:46 - 00059392 ____R C:\WINDOWS\system32\streamhlp.dll
2013-08-30 14:01 - 2013-07-29 12:28 - 00000000 ____D C:\WINDOWS\system32\MRT
2013-08-30 13:34 - 2013-08-30 13:34 - 00000000 ____D C:\Programme\Mozilla Firefox
2013-08-30 13:31 - 2013-08-30 13:31 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Anwendungsdaten\Malwarebytes
2013-08-30 10:50 - 2004-08-07 08:08 - 00032642 _____ C:\WINDOWS\SchedLgU.Txt
2013-08-30 10:50 - 2004-08-07 08:08 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT
2013-08-30 10:47 - 2013-07-13 10:42 - 00001210 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2627080624-2748659677-743147931-1008UA.job
2013-08-30 10:47 - 2013-07-13 10:42 - 00001158 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-2627080624-2748659677-743147931-1008Core.job
2013-08-30 10:38 - 2010-06-07 10:27 - 00001090 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-30 10:38 - 2010-06-07 10:27 - 00001086 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-30 10:01 - 2013-04-05 07:36 - 00000884 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2013-08-30 10:01 - 2006-08-02 22:07 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService
2013-08-30 07:43 - 2013-08-30 07:43 - 00000000 __SHD C:\Dokumente und Einstellungen\LocalService\IETldCache
2013-08-29 11:45 - 2008-12-20 18:16 - 00000966 _____ C:\WINDOWS\Tasks\Google Software Updater.job
2013-08-28 11:33 - 2013-08-28 11:33 - 00004135 _____ C:\WINDOWS\KB2834904-v2.log
2013-08-28 11:33 - 2013-08-28 11:33 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2834904-v2_WM11$
2013-08-28 11:33 - 2004-08-07 08:07 - 01394458 ____C C:\WINDOWS\tsoc.log
2013-08-28 11:33 - 2004-08-07 08:07 - 00160595 _____ C:\WINDOWS\iis6.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00973720 ____C C:\WINDOWS\comsetup.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00596066 ____C C:\WINDOWS\ntdtcsetup.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00160725 ____C C:\WINDOWS\ocmsn.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00150108 ____C C:\WINDOWS\tabletoc.log
2013-08-28 11:33 - 2004-08-07 07:57 - 00001374 _____ C:\WINDOWS\imsins.log
2013-08-28 11:33 - 2004-08-07 07:50 - 03012351 ____C C:\WINDOWS\FaxSetup.log
2013-08-28 11:33 - 2004-08-07 07:50 - 01493001 ____C C:\WINDOWS\ocgen.log
2013-08-28 11:33 - 2004-08-07 07:50 - 00527115 ____C C:\WINDOWS\netfxocm.log
2013-08-28 11:33 - 2004-08-07 07:50 - 00210832 ____C C:\WINDOWS\MedCtrOC.log
2013-08-28 11:33 - 2004-08-07 07:50 - 00151946 ____C C:\WINDOWS\msgsocm.log
2013-08-28 11:33 - 2004-08-07 07:49 - 00839202 ____C C:\WINDOWS\msmqinst.log
2013-08-26 17:35 - 2008-10-03 12:45 - 00000190 __SHC C:\Dokumente und Einstellungen\Puppi\ntuser.ini
2013-08-26 17:35 - 2008-10-03 12:45 - 00000000 ___DC C:\Dokumente und Einstellungen\Puppi
2013-08-19 12:40 - 2013-08-19 11:59 - 00000000 ____D C:\Dokumente und Einstellungen\ALanghein\Eigene Dateien\Max
2013-08-15 09:35 - 2006-08-02 22:08 - 00000000 ____D C:\WINDOWS\Microsoft.NET
2013-08-15 07:36 - 2013-08-15 07:36 - 00014862 _____ C:\WINDOWS\KB2862772-IE8.log
2013-08-15 07:36 - 2009-07-21 07:43 - 00000000 ____D C:\WINDOWS\ie8updates
2013-08-15 07:36 - 2006-04-18 01:44 - 00389340 ____C C:\WINDOWS\updspapi.log
2013-08-15 07:36 - 2004-08-07 07:57 - 00001374 _____ C:\WINDOWS\imsins.BAK
2013-08-15 07:30 - 2013-08-15 07:30 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2850869$
2013-08-15 07:30 - 2013-08-15 07:20 - 00011495 _____ C:\WINDOWS\KB2859537.log
2013-08-15 07:30 - 2013-08-15 07:20 - 00010684 _____ C:\WINDOWS\KB2850869.log
2013-08-15 07:29 - 2013-08-15 07:29 - 00005564 _____ C:\WINDOWS\KB2863058.log
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2863058$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2859537$
2013-08-15 07:29 - 2013-08-15 07:29 - 00000000 __HDC C:\WINDOWS\$NtUninstallKB2849470$
2013-08-15 07:29 - 2007-02-05 18:05 - 00502904 ____C C:\WINDOWS\system32\TZLog.log
2013-08-15 07:27 - 2004-08-07 08:04 - 01372404 _____ C:\WINDOWS\system32\PerfStringBackup.INI
2013-08-13 08:38 - 2013-08-30 16:57 - 00032328 _____ C:\WINDOWS\Launcher.exe
2013-08-09 17:46 - 2012-05-14 06:58 - 00692104 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe
2013-08-09 17:46 - 2011-09-19 20:26 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl
2013-08-08 14:49 - 2007-01-19 19:04 - 00000276 _____ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2013-08-05 16:00 - 2007-02-05 18:07 - 75778376 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
==================== Bamital & volsnap Check =================
C:\Windows\explorer.exe
[2004-08-04 10:00] - [2008-04-14 04:22] - 1036800 ____A (Microsoft Corporation) 418045a93cd87a352098ab7dabe1b53e
C:\Windows\System32\winlogon.exe
[2004-08-04 10:00] - [2008-04-14 04:23] - 0513024 ____A (Microsoft Corporation) f09a527b422e25c478e38caa0e44417a
C:\Windows\System32\svchost.exe
[2004-08-04 10:00] - [2008-04-14 04:23] - 0014336 ____A (Microsoft Corporation) 4fbc75b74479c7a6f829e0ca19df3366
C:\Windows\System32\services.exe
[2004-08-04 10:00] - [2009-02-09 13:21] - 0111104 ____A (Microsoft Corporation) a3edbe9053889fb24ab22492472b39dc
C:\Windows\System32\User32.dll
[2004-08-04 10:00] - [2008-04-14 04:22] - 0580096 ____A (Microsoft Corporation) b0050cc5340e3a0760dd8b417ff7aebd
C:\Windows\System32\userinit.exe
[2004-08-04 10:00] - [2008-04-14 04:23] - 0026624 ____A (Microsoft Corporation) 788f95312e26389d596c0fa55834e106
C:\Windows\System32\Drivers\volsnap.sys
[2004-08-04 10:00] - [2008-04-14 03:52] - 0053760 ____A (Microsoft Corporation) a5a712f4e880874a477af790b5186e1d
==================== End Of Log ============================
--- --- --- |
|
| Themen zu Windows XP: Avira meldet mehrere Trojaner, wurde beim Online Banking auf falsche Seite geleitet... |
| anmelden, antivir, avira, einloggen, entfernen, falsche, fehlermeldung, freeware, komische, mehrere trojaner, meldet, online banking, pum.hijack.startmenu, rechner, seite, spr/autoit.gen, tr/bublik.a.11, tr/crypt.zpack.1748, tr/zusy.bp, trojaner, virus.sality, windows, windows xp |
Hybrid-Darstellung
