| |
| |||||||
Log-Analyse und Auswertung: Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholtWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
02.09.2013, 12:25
| #1 |
| |  Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Hallo, habe mir beim Download von Gimp am 27.8.13 über die Website Softonic beim Download von 7ZipSetup einen Virus oder Trojaner geholt. Seitdem erscheinen auf allen Websiten die Aufrufe, rechts, links und auch mitten in der Seite Banner, die mich alarmieren mein Pc sei langsam wegen eines Virus und ich soll mir Software (z.B RegCleanPro) deswegen runterladen. Habe dann mehrer Virenscans durchgeführt, mit Antivir (sagt keine Befunde), mit Malwarebites (hängt sich auf) und SuperAntiSpyware (hängt sich auf). Hab dann ADW Cleaner laufen lassem, Junkware Revivwal Tool, Eset Smartinstaller (hängt sich auch auf). Bisher alles ohne Erfolg, Banner erscheinen immer noch auf Websites und Virenscans hängen sich auch noch auf (auch im abgesichterten Modus). Vielen Dank für jede Hilfe!!! |
|
02.09.2013, 13:30
| #2 | |
| /// the machine /// TB-Ausbilder    | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt hi,
__________________ So funktioniert es:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ |
|
02.09.2013, 22:17
| #3 |
| | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholtCode:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 5.5.6 (08.30.2013:1)
OS: Windows 7 Home Premium x64
Ran by Kathrin on 01.09.2013 at 22:12:51,68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6fa5dc4c-48b9-430b-8b06-94a50d18f249}
Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{6fa5dc4c-48b9-430b-8b06-94a50d18f249}
~~~ Files
Successfully deleted: [File] C:\Windows\Tasks\a2zLyrics Update.job
~~~ Folders
Successfully deleted: [Folder] "C:\Users\Kathrin\AppData\Roaming\goforfiles"
Successfully deleted: [Folder] "C:\Program Files (x86)\goforfiles"
~~~ FireFox
Emptied folder: C:\Users\Kathrin\AppData\Roaming\mozilla\firefox\profiles\hej92mpp.default\minidumps [478 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 01.09.2013 at 22:27:41,39
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-09-2013 04
Ran by Kathrin (administrator) on KATHRIN-VAIO on 02-09-2013 11:09:20
Running from C:\Users\Kathrin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3SD9218T
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\system32\atieclxx.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSpt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(STRATO) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Dropbox, Inc.) C:\Users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(McAfee, Inc.) C:\Program Files\mcafee.com\agent\mcagent.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(McAfee, Inc.) C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe
() C:\Users\Kathrin\Downloads\Defogger.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-04-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [221480 2010-05-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Policies\Explorer: [NoActiveDesktop] 1
HKLM\...\Policies\Explorer: [NoActiveDesktopChanges] 1
HKCU\...\Run: [SUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6581488 2013-08-27] (SUPERAntiSpyware)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048 2013-06-03] (Skype Technologies S.A.)
MountPoints2: {041e6fc5-25f9-11e2-8390-78843c2fcd6b} - "E:\WD SmartWare.exe" autoplay=true
MountPoints2: {99c17a44-5816-11e1-9c33-78843c2fcd6b} - E:\Startme.exe
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [mcui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [1675160 2011-11-22] (McAfee, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [538472 2009-06-17] (Symantec Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2010-01-21] (Sony Corporation)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-10] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-10] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] - C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-05] (Avira Operations GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
Startup: C:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {09C5847E-0A79-481E-B2A5-7546A36F000C} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {7BAD3864-ADC6-4041-AAB1-E62910AD1ED8} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {DB93BADF-39B4-452E-8E80-CBA1B7593D0D} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {EA11680E-7B02-490B-8F63-A286F13D77F2} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\Common Files\McAfee\SystemCore\ScriptSn.20120121214430.dll (McAfee, Inc.)
BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll ()
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files (x86)\Common Files\McAfee\SystemCore\ScriptSn.20120121214430.dll (McAfee, Inc.)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~1\mcafee\msc\MCSNIE~1.DLL (McAfee, Inc.)
Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default
FF Homepage: https://www.facebook.com/
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\progra~2\mcafee\msc\npmcsn~1.dll ()
FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default\Extensions\abb@amazon.com
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] C:\Program Files (x86)\McAfee\SiteAdvisor
FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor
FF HKLM-x32\...\Firefox\Extensions: [{D19CA586-DD6C-4a0a-96F8-14644F340D60}] C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF Extension: McAfee ScriptScan for Firefox - C:\Program Files (x86)\Common Files\McAfee\SystemCore
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{40cb9f89-3d25-4aee-91c3-3ce88d2cecde}] C:\Program Files (x86)\a2zlyr\130.xpi
FF Extension: No Name - C:\Program Files (x86)\a2zlyr\130.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=SVED
CHR DefaultSearchURL: (Yahoo! Deutschland) - hxxp://de.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}
CHR DefaultSuggestURL: (Yahoo! Deutschland) - hxxp://de-sayt.ff.search.yahoo.com/gossip-de-sayt?output=fxjson&command={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\McChPlg.dll (McAfee, Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll ()
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (SiteAdvisor) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0
CHR HKLM-x32\...\Chrome\Extension: [ciljpgjahkpnilhbolpaphfjhlejnplm] - C:\Program Files (x86)\a2zlyr\130.crx
CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [140672 2012-09-08] (SUPERAntiSpyware.com)
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-05] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-05] (Avira Operations GmbH & Co. KG)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 McAfee SiteAdvisor Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.)
R2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
R2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
R2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
R2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [502032 2011-10-18] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
R2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
R2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [199272 2011-12-06] (McAfee, Inc.)
R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [208536 2011-12-06] (McAfee, Inc.)
R2 mfevtp; C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe [161168 2011-12-06] (McAfee, Inc.)
R2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [249936 2011-01-27] (McAfee, Inc.)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [168448 2009-12-22] (Sony of America Corporation)
S3 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [155344 2011-06-29] (Avanquest Software)
R2 STRATO HiDrive Service; C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-11-15] (STRATO)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2010-04-08] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [852336 2010-03-18] (Sony Corporation)
S3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1203568 2010-01-22] (Sony Corporation)
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-05] (Avira Operations GmbH & Co. KG)
R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [65264 2011-10-15] (McAfee, Inc.)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [160280 2011-10-15] (McAfee, Inc.)
R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [229528 2011-10-15] (McAfee, Inc.)
R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [481768 2011-10-15] (McAfee, Inc.)
R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [647080 2011-10-15] (McAfee, Inc.)
R1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [75808 2011-10-15] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [100912 2011-10-15] (McAfee, Inc.)
R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [284648 2011-10-15] (McAfee, Inc.)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-01] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-01] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-01] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-01] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-01] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-01] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-01] (MCCI Corporation)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
U3 mfeavfk01; No ImagePath
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-02 11:04 - 2013-09-02 11:04 - 00000000 _____ C:\Users\Kathrin\defogger_reenable
2013-09-02 10:31 - 2013-09-02 10:31 - 00050477 _____ C:\Users\Kathrin\Downloads\Defogger.exe
2013-09-02 09:46 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-09-02 09:46 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-09-02 09:46 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-02 09:46 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-02 09:46 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-09-02 09:45 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-09-02 09:45 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-09-02 09:45 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-09-02 09:45 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-09-02 09:45 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-09-02 09:45 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-09-02 09:45 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-09-02 09:45 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-09-02 09:45 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-09-02 09:45 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-09-02 09:45 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-09-02 09:45 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-09-02 09:45 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-09-02 09:45 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-09-02 09:45 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-09-02 09:45 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-09-02 09:45 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-09-02 09:45 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-09-02 09:45 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-09-02 09:43 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-02 09:43 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-02 09:43 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-02 09:43 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-02 09:43 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-02 09:43 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-02 09:43 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-02 09:43 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-02 09:43 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-02 09:43 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-02 09:43 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-02 09:43 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-09-02 09:43 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-09-02 09:42 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-09-02 09:42 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-09-02 09:42 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-09-02 09:42 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-09-02 09:42 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-09-02 09:42 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-09-02 09:42 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-09-01 23:32 - 2013-09-01 23:32 - 00000000 ____D C:\Users\Kathrin\AppData\Local\ESET
2013-09-01 22:53 - 2013-09-01 22:53 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-01 22:51 - 2013-09-01 22:52 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu.exe
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\ProgramData\ESET
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\Program Files\ESET
2013-09-01 22:31 - 2013-09-01 22:31 - 01415824 _____ (ESET) C:\Users\Kathrin\Downloads\eset_nod32_antivirus_live_installer.exe
2013-09-01 22:27 - 2013-09-01 22:27 - 00001358 _____ C:\Users\Kathrin\Desktop\JRT.txt
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 22:11 - 2013-09-01 22:11 - 01027511 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT_5.5.6.exe
2013-09-01 22:00 - 2013-09-01 22:02 - 00000000 ____D C:\AdwCleaner
2013-09-01 21:59 - 2013-09-01 21:59 - 00994642 _____ C:\Users\Kathrin\Downloads\adwcleaner3001.exe
2013-09-01 21:52 - 2013-09-01 21:52 - 00045133 _____ C:\Users\Kathrin\Downloads\FRST.txt
2013-09-01 21:52 - 2013-09-01 21:52 - 00025995 _____ C:\Users\Kathrin\Downloads\Addition.txt
2013-09-01 21:49 - 2013-09-01 21:49 - 00000000 ____D C:\FRST
2013-09-01 21:12 - 2013-09-02 10:54 - 00000336 _____ C:\Windows\setupact.log
2013-09-01 21:12 - 2013-09-01 21:12 - 00000000 _____ C:\Windows\setuperr.log
2013-09-01 20:48 - 2013-09-01 20:49 - 00000000 ____D C:\Users\Kathrin\Downloads\ccsetup405
2013-09-01 20:48 - 2013-09-01 20:48 - 04352187 _____ C:\Users\Kathrin\Downloads\ccsetup405.zip
2013-08-30 11:25 - 2013-08-30 11:25 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-28 23:24 - 2013-08-28 23:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 23:24 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 23:23 - 2013-08-28 23:23 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-28 18:06 - 2013-08-28 18:06 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7956.dll
2013-08-28 18:04 - 2013-08-28 18:04 - 05683272 _____ (Systweak Inc ) C:\Users\Kathrin\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-08-28 16:04 - 2013-08-28 16:04 - 00001514 _____ C:\Users\Kathrin\AppData\Local\recently-used.xbel
2013-08-28 12:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-28 12:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-28 12:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-28 12:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-28 12:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-28 12:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-28 12:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-28 12:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-28 12:09 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-28 12:09 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-28 12:09 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-28 12:09 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-28 12:09 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-27 23:56 - 2013-08-27 23:59 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 23:56 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\.thumbnails
2013-08-27 23:53 - 2013-08-28 16:11 - 00000000 ____D C:\Users\Kathrin\.gimp-2.8
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 23:50 - 2013-08-27 23:52 - 00000000 ____D C:\Program Files\GIMP 2
2013-08-27 23:49 - 2013-08-27 23:50 - 90116160 _____ (The GIMP Team ) C:\Users\Kathrin\Downloads\gimp-2.8.6-setup.exe
2013-08-27 23:48 - 2013-08-27 23:48 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(2).exe
2013-08-27 23:42 - 2013-09-02 10:54 - 00000366 _____ C:\Windows\Tasks\a2zLyrics Update.job
2013-08-27 23:42 - 2013-08-27 23:42 - 00003018 _____ C:\Windows\System32\Tasks\a2zLyrics Update
2013-08-27 23:42 - 2013-08-27 23:42 - 00000000 ____D C:\Program Files (x86)\a2zlyr
2013-08-27 23:30 - 2013-08-27 23:30 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(1).exe
2013-08-27 23:29 - 2013-08-27 23:29 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup.exe
2013-08-27 16:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-27 16:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-27 16:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-27 16:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-27 16:09 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-27 16:09 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-27 16:07 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-27 16:07 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 16:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-27 16:07 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-05 22:00 - 2013-08-05 22:00 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Avira
2013-08-05 21:56 - 2013-08-05 21:56 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-05 21:54 - 2013-08-05 21:54 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-05 21:53 - 2013-08-05 21:54 - 00000000 ____D C:\ProgramData\Avira
2013-08-05 21:53 - 2013-08-05 21:53 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-05 21:53 - 2013-08-05 21:45 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-05 21:53 - 2013-08-05 21:45 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-05 21:53 - 2013-08-05 21:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-03 08:41 - 2013-08-28 11:55 - 00000000 ____D C:\Windows\system32\MRT
==================== One Month Modified Files and Folders =======
2013-09-02 11:12 - 2012-01-06 12:07 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-02 11:11 - 2012-01-06 12:07 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-02 11:08 - 2009-07-14 06:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-02 11:08 - 2009-07-14 06:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-02 11:06 - 2013-09-02 11:04 - 00000476 _____ C:\Users\Kathrin\Downloads\defogger_disable.log
2013-09-02 11:04 - 2013-09-02 11:04 - 00000000 _____ C:\Users\Kathrin\defogger_reenable
2013-09-02 11:04 - 2012-07-21 17:17 - 00001828 _____ C:\Users\Public\Desktop\McAfee Security Center.lnk
2013-09-02 11:04 - 2012-01-10 16:08 - 00000000 ____D C:\Users\Kathrin
2013-09-02 11:03 - 2012-01-10 16:16 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Skype
2013-09-02 11:01 - 2012-02-05 10:05 - 00000000 ___RD C:\Users\Kathrin\Dropbox
2013-09-02 11:01 - 2012-02-05 09:58 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Dropbox
2013-09-02 11:00 - 2012-04-04 09:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-02 10:54 - 2013-09-01 21:12 - 00000336 _____ C:\Windows\setupact.log
2013-09-02 10:54 - 2013-08-27 23:42 - 00000366 _____ C:\Windows\Tasks\a2zLyrics Update.job
2013-09-02 10:54 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-02 10:31 - 2013-09-02 10:31 - 00050477 _____ C:\Users\Kathrin\Downloads\Defogger.exe
2013-09-02 10:28 - 2012-01-06 11:51 - 01394263 _____ C:\Windows\WindowsUpdate.log
2013-09-02 09:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-09-01 23:32 - 2013-09-01 23:32 - 00000000 ____D C:\Users\Kathrin\AppData\Local\ESET
2013-09-01 22:53 - 2013-09-01 22:53 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-01 22:52 - 2013-09-01 22:51 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu.exe
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\ProgramData\ESET
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\Program Files\ESET
2013-09-01 22:31 - 2013-09-01 22:31 - 01415824 _____ (ESET) C:\Users\Kathrin\Downloads\eset_nod32_antivirus_live_installer.exe
2013-09-01 22:27 - 2013-09-01 22:27 - 00001358 _____ C:\Users\Kathrin\Desktop\JRT.txt
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 22:11 - 2013-09-01 22:11 - 01027511 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT_5.5.6.exe
2013-09-01 22:02 - 2013-09-01 22:00 - 00000000 ____D C:\AdwCleaner
2013-09-01 21:59 - 2013-09-01 21:59 - 00994642 _____ C:\Users\Kathrin\Downloads\adwcleaner3001.exe
2013-09-01 21:52 - 2013-09-01 21:52 - 00045133 _____ C:\Users\Kathrin\Downloads\FRST.txt
2013-09-01 21:52 - 2013-09-01 21:52 - 00025995 _____ C:\Users\Kathrin\Downloads\Addition.txt
2013-09-01 21:49 - 2013-09-01 21:49 - 00000000 ____D C:\FRST
2013-09-01 21:12 - 2013-09-01 21:12 - 00000000 _____ C:\Windows\setuperr.log
2013-09-01 21:04 - 2012-01-10 16:27 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-09-01 21:04 - 2010-04-13 02:39 - 00000000 ____D C:\Windows\Panther
2013-09-01 20:49 - 2013-09-01 20:48 - 00000000 ____D C:\Users\Kathrin\Downloads\ccsetup405
2013-09-01 20:48 - 2013-09-01 20:48 - 04352187 _____ C:\Users\Kathrin\Downloads\ccsetup405.zip
2013-09-01 20:27 - 2012-01-10 16:15 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3BC58626-E210-4F8C-8C04-443C520B696D}
2013-09-01 20:15 - 2012-03-08 20:08 - 00000000 ____D C:\Users\Kathrin\AppData\Local\Apple Computer
2013-09-01 17:52 - 2012-01-06 12:07 - 00000000 ____D C:\Program Files\Google
2013-09-01 17:52 - 2012-01-06 12:07 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-30 16:34 - 2013-02-04 15:44 - 00000000 ____D C:\Users\Kathrin\Documents\barcelona
2013-08-30 11:30 - 2012-01-10 16:22 - 00000000 ____D C:\Users\Kathrin\AppData\Local\Google
2013-08-30 11:30 - 2012-01-06 12:07 - 00000000 ____D C:\ProgramData\Google
2013-08-30 11:25 - 2013-08-30 11:25 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-29 10:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-29 07:44 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-08-29 06:52 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files\mcafee
2013-08-28 23:24 - 2013-08-28 23:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 23:23 - 2013-08-28 23:23 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-28 18:06 - 2013-08-28 18:06 - 00129536 _____ C:\Users\Public\AlexaNSISPlugin.7956.dll
2013-08-28 18:06 - 2012-02-10 16:01 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-08-28 18:04 - 2013-08-28 18:04 - 05683272 _____ (Systweak Inc ) C:\Users\Kathrin\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-08-28 16:11 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\.gimp-2.8
2013-08-28 16:04 - 2013-08-28 16:04 - 00001514 _____ C:\Users\Kathrin\AppData\Local\recently-used.xbel
2013-08-28 12:09 - 2012-01-10 16:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 12:02 - 2012-01-06 11:46 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-08-28 12:02 - 2012-01-06 11:46 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-08-28 12:02 - 2009-07-14 07:13 - 01520734 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-28 11:55 - 2013-08-03 08:41 - 00000000 ____D C:\Windows\system32\MRT
2013-08-28 11:47 - 2012-01-19 19:01 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-28 11:26 - 2012-05-04 13:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-27 23:59 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 23:56 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\.thumbnails
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 23:52 - 2013-08-27 23:50 - 00000000 ____D C:\Program Files\GIMP 2
2013-08-27 23:50 - 2013-08-27 23:49 - 90116160 _____ (The GIMP Team ) C:\Users\Kathrin\Downloads\gimp-2.8.6-setup.exe
2013-08-27 23:48 - 2013-08-27 23:48 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(2).exe
2013-08-27 23:42 - 2013-08-27 23:42 - 00003018 _____ C:\Windows\System32\Tasks\a2zLyrics Update
2013-08-27 23:42 - 2013-08-27 23:42 - 00000000 ____D C:\Program Files (x86)\a2zlyr
2013-08-27 23:42 - 2012-01-10 16:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-27 23:30 - 2013-08-27 23:30 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(1).exe
2013-08-27 23:29 - 2013-08-27 23:29 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup.exe
2013-08-27 15:59 - 2012-04-04 09:42 - 00692104 ____N (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-27 15:59 - 2012-04-04 09:42 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-27 15:59 - 2012-01-10 18:13 - 00071048 ____N (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-27 15:52 - 2012-01-10 17:23 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-08-05 22:00 - 2013-08-05 22:00 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Avira
2013-08-05 21:56 - 2013-08-05 21:56 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-05 21:54 - 2013-08-05 21:54 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-05 21:54 - 2013-08-05 21:53 - 00000000 ____D C:\ProgramData\Avira
2013-08-05 21:53 - 2013-08-05 21:53 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-05 21:45 - 2013-08-05 21:53 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-05 21:45 - 2013-08-05 21:53 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-05 21:45 - 2013-08-05 21:53 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-05 21:27 - 2012-01-10 17:49 - 00000000 ____D C:\Users\Kathrin\Documents\privat
2013-08-05 07:20 - 2012-11-28 18:17 - 00245209 _____ C:\test.xml
Files to move or delete:
====================
C:\Users\Kathrin\AppData\Local\Temp\Quarantine.exe
C:\Users\Kathrin\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-27 16:39
==================== End Of Log ============================
--- --- --- --- --- --- --- --- --- --- --- --- --- --- --- Code:
ATTFilter GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-09-02 12:04:31
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000064 ST950032 rev.0006 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Kathrin\AppData\Local\Temp\kxdiykow.sys
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\506313fe70ca
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\506313fe70ca (not active ControlSet)
---- EOF - GMER 2.1 ----
vielen Dank für deine Antwort, ich hab die logfiles nun wie gewünscht in code-tags verwandelt, ich hoff das war richtig so?! Ich warte jetzt auf weitere Anweisungen oder soll ich Combofix jetzt schon runterladen und ausführen? Hab schon versucht meine Firewall zu deaktivieren aber kann das irgendwie in der Systemsteuerung nicht, wie kann ich mich als Administrator anmelden, hab leider beim Anmelden keine Wahlmöglichkeiten! Vielen Dank für die Hilfe bisher! lg Kathrin Hat sich erledigt, kann nun die Antivirenprogramme deaktivieren! Lade Combofix jetzt runter. lg Code:
ATTFilter ComboFix 13-09-02.02 - Kathrin 02.09.2013 22:46:55.1.2 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.3835.2306 [GMT 2:00]
ausgeführt von:: c:\users\Kathrin\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AV: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
AV: McAfee Anti-Virus und Anti-Spyware *Disabled/Outdated* {86355677-4064-3EA7-ABB3-1B136EB04637}
FW: McAfee Firewall *Disabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: ESET NOD32 Antivirus 6.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: McAfee Anti-Virus und Anti-Spyware *Disabled/Outdated* {3D54B793-665E-3129-9103-206115370C8A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Kathrin\AppData\Local\Temp\SASEF52.tmp
c:\users\Public\AlexaNSISPlugin.7956.dll
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-08-02 bis 2013-09-02 ))))))))))))))))))))))))))))))
.
.
2013-09-02 21:05 . 2013-09-02 21:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-09-02 07:46 . 2012-08-23 15:09 3584 ----a-w- c:\windows\system32\drivers\de-DE\tsusbflt.sys.mui
2013-09-02 07:46 . 2012-08-23 13:41 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-02 07:46 . 2012-08-23 13:40 13312 ----a-w- c:\windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-02 07:46 . 2012-08-23 13:24 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
2013-09-02 07:46 . 2012-08-23 14:10 19456 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
2013-09-02 07:46 . 2012-08-23 14:07 57856 ----a-w- c:\windows\system32\drivers\TsUsbFlt.sys
2013-09-02 07:43 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
2013-09-02 07:43 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
2013-09-02 07:43 . 2013-07-09 05:03 3913664 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-09-02 07:43 . 2013-07-09 06:03 5550528 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-09-02 07:43 . 2013-07-09 05:03 3968960 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-09-02 07:43 . 2013-07-09 05:54 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-09-02 07:43 . 2013-07-09 04:53 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-09-02 07:43 . 2013-07-09 05:53 243712 ----a-w- c:\windows\system32\wow64.dll
2013-09-02 07:43 . 2013-07-09 02:49 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-09-02 07:43 . 2013-07-09 04:52 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-09-02 07:43 . 2013-07-09 02:49 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-09-02 07:43 . 2013-07-09 02:49 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-09-02 07:43 . 2013-07-09 02:49 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-09-02 07:42 . 2012-08-24 18:05 340992 ----a-w- c:\windows\system32\schannel.dll
2013-09-02 07:42 . 2012-08-24 18:09 458712 ----a-w- c:\windows\system32\drivers\cng.sys
2013-09-02 07:42 . 2012-08-24 16:57 247808 ----a-w- c:\windows\SysWow64\schannel.dll
2013-09-02 07:42 . 2012-08-24 18:13 154480 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2013-09-02 07:42 . 2012-08-24 18:03 1448448 ----a-w- c:\windows\system32\lsasrv.dll
2013-09-02 07:42 . 2012-08-24 16:57 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2013-09-02 07:42 . 2012-08-24 16:53 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2013-09-01 21:32 . 2013-09-01 21:32 -------- d-----w- c:\users\Kathrin\AppData\Local\ESET
2013-09-01 20:53 . 2013-09-01 20:53 -------- d-----w- c:\program files (x86)\ESET
2013-09-01 20:34 . 2013-09-01 20:34 -------- d-----w- c:\program files\ESET
2013-09-01 20:12 . 2013-09-01 20:12 -------- d-----w- c:\windows\ERUNT
2013-09-01 20:00 . 2013-09-01 20:02 -------- d-----w- C:\AdwCleaner
2013-09-01 19:49 . 2013-09-01 19:49 -------- d-----w- C:\FRST
2013-08-30 09:25 . 2013-08-30 09:25 -------- d-----w- c:\users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-28 21:24 . 2013-08-28 21:24 -------- d-----w- c:\users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 21:24 . 2013-08-28 21:24 -------- d-----w- c:\programdata\Malwarebytes
2013-08-28 21:24 . 2013-08-28 21:24 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2013-08-28 21:24 . 2013-04-04 12:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2013-08-28 10:09 . 2013-07-26 06:23 775256 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2013-08-27 21:56 . 2013-08-27 21:59 -------- d-----w- c:\users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 21:56 . 2013-08-27 21:56 -------- d-----w- c:\users\Kathrin\.thumbnails
2013-08-27 21:53 . 2013-08-28 14:11 -------- d-----w- c:\users\Kathrin\.gimp-2.8
2013-08-27 21:53 . 2013-08-27 21:53 -------- d-----w- c:\users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 21:50 . 2013-08-27 21:52 -------- d-----w- c:\program files\GIMP 2
2013-08-27 21:42 . 2013-08-27 21:42 -------- d-----w- c:\program files (x86)\a2zlyr
2013-08-27 14:56 . 2013-07-06 16:56 263576 ----a-w- c:\program files (x86)\Mozilla Firefox\updated\browser\components\browsercomps.dll
2013-08-27 14:56 . 2013-07-06 16:56 74136 ----a-w- c:\program files (x86)\Mozilla Firefox\updated\breakpadinjector.dll
2013-08-27 14:56 . 2013-07-06 16:56 19352 ----a-w- c:\program files (x86)\Mozilla Firefox\updated\AccessibleMarshal.dll
2013-08-27 14:11 . 2013-07-09 05:51 1217024 ----a-w- c:\windows\system32\rpcrt4.dll
2013-08-27 14:11 . 2013-07-09 04:52 663552 ----a-w- c:\windows\SysWow64\rpcrt4.dll
2013-08-27 14:11 . 2013-07-19 01:58 2048 ----a-w- c:\windows\system32\tzres.dll
2013-08-27 14:11 . 2013-07-19 01:41 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2013-08-27 14:09 . 2013-07-09 05:52 224256 ----a-w- c:\windows\system32\wintrust.dll
2013-08-27 14:09 . 2013-07-09 05:46 1472512 ----a-w- c:\windows\system32\crypt32.dll
2013-08-27 14:09 . 2013-07-09 04:46 1166848 ----a-w- c:\windows\SysWow64\crypt32.dll
2013-08-27 14:09 . 2013-07-09 05:46 184320 ----a-w- c:\windows\system32\cryptsvc.dll
2013-08-27 14:09 . 2013-07-09 04:52 175104 ----a-w- c:\windows\SysWow64\wintrust.dll
2013-08-27 14:09 . 2013-07-09 04:46 140288 ----a-w- c:\windows\SysWow64\cryptsvc.dll
2013-08-27 14:09 . 2013-07-09 05:46 139776 ----a-w- c:\windows\system32\cryptnet.dll
2013-08-27 14:09 . 2013-07-09 04:46 103936 ----a-w- c:\windows\SysWow64\cryptnet.dll
2013-08-27 14:07 . 2013-07-25 09:25 1888768 ----a-w- c:\windows\system32\WMVDECOD.DLL
2013-08-27 14:07 . 2013-07-25 08:57 1620992 ----a-w- c:\windows\SysWow64\WMVDECOD.DLL
2013-08-27 14:07 . 2013-06-15 04:32 39936 ----a-w- c:\windows\system32\drivers\tssecsrv.sys
2013-08-27 14:07 . 2013-07-06 06:03 1910208 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-08-05 20:00 . 2013-08-05 20:00 -------- d-----w- c:\users\Kathrin\AppData\Roaming\Avira
2013-08-05 19:56 . 2013-08-05 19:56 83672 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2013-08-05 19:53 . 2013-08-05 19:45 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2013-08-05 19:53 . 2013-08-05 19:45 130016 ----a-w- c:\windows\system32\drivers\avipbb.sys
2013-08-05 19:53 . 2013-08-05 19:45 100712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2013-08-05 19:53 . 2013-08-05 19:54 -------- d-----w- c:\programdata\Avira
2013-08-05 19:53 . 2013-08-05 19:53 -------- d-----w- c:\program files (x86)\Avira
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-08-28 09:47 . 2012-01-19 17:01 78161360 ----a-w- c:\windows\system32\MRT.exe
2013-08-27 13:59 . 2012-04-04 07:42 692104 ------w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-08-27 13:59 . 2012-01-10 16:13 71048 ------w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-07-09 04:45 . 2013-09-02 07:43 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-06-25 19:44 . 2013-06-25 19:44 96168 ------w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-06-25 19:44 . 2012-07-08 09:20 867240 ------w- c:\windows\SysWow64\npdeployJava1.dll
2013-06-25 19:44 . 2012-01-10 14:21 789416 ------w- c:\windows\SysWow64\deployJava1.dll
2013-06-05 03:34 . 2013-07-10 17:28 3153920 ----a-w- c:\windows\system32\win32k.sys
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 130736 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-06-03 19603048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-03-02 98304]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-06-17 538472]
"PMBVolumeWatcher"="c:\program files (x86)\Sony\PMB\PMBVolumeWatcher.exe" [2010-01-21 597792]
"GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"SSBkgdUpdate"="c:\program files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]
"PaperPort PTD"="c:\program files (x86)\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-09 29984]
"IndexSearch"="c:\program files (x86)\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-09 46368]
"PPort11reminder"="c:\program files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]
"BrMfcWnd"="c:\program files (x86)\Brother\Brmfcmon\BrMfcWnd.exe" [2009-05-26 1159168]
"ControlCenter3"="c:\program files (x86)\Brother\ControlCenter3\brctrcen.exe" [2008-12-24 114688]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-07-31 38872]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-11 919008]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-08-27 59280]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-18 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-09-09 421776]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-03-12 253816]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2013-08-05 345144]
.
c:\users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2013-5-25 27776968]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-9-4 1081632]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [x]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys;c:\windows\SYSNATIVE\drivers\mferkdet.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 s1039bus;Sony Ericsson Device 1039 driver (WDM);c:\windows\system32\DRIVERS\s1039bus.sys;c:\windows\SYSNATIVE\DRIVERS\s1039bus.sys [x]
R3 s1039mdfl;Sony Ericsson Device 1039 USB WMC Modem Filter;c:\windows\system32\DRIVERS\s1039mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\s1039mdfl.sys [x]
R3 s1039mdm;Sony Ericsson Device 1039 USB WMC Modem Driver;c:\windows\system32\DRIVERS\s1039mdm.sys;c:\windows\SYSNATIVE\DRIVERS\s1039mdm.sys [x]
R3 s1039mgmt;Sony Ericsson Device 1039 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s1039mgmt.sys;c:\windows\SYSNATIVE\DRIVERS\s1039mgmt.sys [x]
R3 s1039nd5;Sony Ericsson Device 1039 USB Ethernet Emulation (NDIS);c:\windows\system32\DRIVERS\s1039nd5.sys;c:\windows\SYSNATIVE\DRIVERS\s1039nd5.sys [x]
R3 s1039obex;Sony Ericsson Device 1039 USB WMC OBEX Interface;c:\windows\system32\DRIVERS\s1039obex.sys;c:\windows\SYSNATIVE\DRIVERS\s1039obex.sys [x]
R3 s1039unic;Sony Ericsson Device 1039 USB Ethernet Emulation (WDM);c:\windows\system32\DRIVERS\s1039unic.sys;c:\windows\SYSNATIVE\DRIVERS\s1039unic.sys [x]
R3 SampleCollector;Intel(R) Sample Collector;c:\program files\Sony\VAIO Care\collsvc.exe;c:\program files\Sony\VAIO Care\collsvc.exe [x]
R4 AntiVirWebService;Avira Browser-Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys;c:\windows\SYSNATIVE\DRIVERS\eamonm.sys [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys;c:\windows\SYSNATIVE\DRIVERS\ehdrv.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe;c:\program files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [x]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys;c:\windows\SYSNATIVE\DRIVERS\epfwwfpr.sys [x]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*Deregistered* - mfeavfk01
*Deregistered* - mfenlfk
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2013-09-01 16:12 1177552 ----a-w- c:\program files (x86)\Google\Chrome\Application\29.0.1547.62\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-09-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 13:59]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-06 10:07]
.
2013-09-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-06 10:07]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-05-25 00:36 164016 ----a-w- c:\users\Kathrin\AppData\Roaming\Dropbox\bin\DropboxExt64.19.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-07 10134560]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2013-03-21 6330568]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default\
FF - prefs.js: browser.startup.homepage - hxxps://www.facebook.com/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p=
FF - ExtSQL: 2013-08-27 23:42; {40cb9f89-3d25-4aee-91c3-3ce88d2cecde}; c:\program files (x86)\a2zlyr\130.xpi
FF - ExtSQL: 2013-08-28 18:06; abb@amazon.com; c:\users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default\extensions\abb@amazon.com
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-Apoint - c:\program files (x86)\Apoint\Apoint.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath"="\"c:\program files\Sony\VAIO Care\collsvc.exe\" \"/service\" \"/counter=\Processor(_Total)\% Processor Time:5\" \"/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:5\" \"/counter=\Network Interface(*)\Bytes Total/sec:5\" \"/directory=inteldata\""
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10d.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10d.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10d.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-09-02 23:10:34
ComboFix-quarantined-files.txt 2013-09-02 21:10
.
Vor Suchlauf: 14 Verzeichnis(se), 234.279.849.984 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 235.579.514.880 Bytes frei
.
- - End Of File - - 16BA6EFFCAFCAE6F7EDA6C77DE245CBE
|
|
03.09.2013, 08:07
| #4 |
| /// the machine /// TB-Ausbilder | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Downloade Dir bitte  Malwarebytes Anti-Malware
Downloade Dir bitte  AdwCleaner auf deinen Desktop.
und ein frisches FRST log bitte.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 09:07
| #5 |
| | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Leider hängt sich wie immer mein Laptop beim Virenscann auf, länger als eine Minute läuft Malewarebites nicht durch, ich poste hier mal die letzte logdatei die er mir anzeigt: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.75.0.1300 www.malwarebytes.org Datenbank Version: v2013.08.28.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Kathrin :: KATHRIN-VAIO [Administrator] Schutz: Aktiviert 29.08.2013 17:18:18 mbam-log-2013-08-29 (17-18-18).txt Art des Suchlaufs: Benutzerdefinierter Suchlauf (C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip\7-Zip File Manager.lnk|) Aktivierte Suchlaufeinstellungen: Dateisystem | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Heuristiks/Extra | P2P Durchsuchte Objekte: 0 Laufzeit: 27 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter # AdwCleaner v3.002 - Bericht erstellt am 03/09/2013 um 09:52:08
# Updated 01/09/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Kathrin - KATHRIN-VAIO
# Gestartet von : C:\Users\Kathrin\Downloads\adwcleaner.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{2CE4D4CF-B278-4126-AD1E-B622DA2E8339}
***** [ Browser ] *****
-\\ Internet Explorer v10.0.9200.16660
-\\ Mozilla Firefox v23.0.1 (de)
[ Datei : C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default\prefs.js ]
-\\ Google Chrome v29.0.1547.62
[ Datei : C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\preferences ]
*************************
AdwCleaner[R0].txt - [7402 octets] - [01/09/2013 22:00:34]
AdwCleaner[R1].txt - [1149 octets] - [03/09/2013 09:50:25]
AdwCleaner[S0].txt - [7458 octets] - [01/09/2013 22:02:43]
AdwCleaner[S1].txt - [1071 octets] - [03/09/2013 09:52:08]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1131 octets] ##########
FRST Logfile: FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 01
Ran by Kathrin (administrator) on KATHRIN-VAIO on 03-09-2013 10:02:39
Running from C:\Users\Kathrin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSpt.exe
(STRATO) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Farbar) C:\Users\Kathrin\Downloads\FRST64(1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-04-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [221480 2010-05-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [538472 2009-06-17] (Symantec Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2010-01-21] (Sony Corporation)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-10] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-10] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] - C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-05] (Avira Operations GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {09C5847E-0A79-481E-B2A5-7546A36F000C} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {7BAD3864-ADC6-4041-AAB1-E62910AD1ED8} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {DB93BADF-39B4-452E-8E80-CBA1B7593D0D} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {EA11680E-7B02-490B-8F63-A286F13D77F2} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll ()
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default
FF Homepage: https://www.facebook.com/
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default\Extensions\abb@amazon.com
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{40cb9f89-3d25-4aee-91c3-3ce88d2cecde}] C:\Program Files (x86)\a2zlyr\130.xpi
FF Extension: No Name - C:\Program Files (x86)\a2zlyr\130.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=SVED
CHR DefaultSearchURL: (Yahoo! Deutschland) - hxxp://de.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}
CHR DefaultSuggestURL: (Yahoo! Deutschland) - hxxp://de-sayt.ff.search.yahoo.com/gossip-de-sayt?output=fxjson&command={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\McChPlg.dll (McAfee, Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (SiteAdvisor) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0
CHR HKLM-x32\...\Chrome\Extension: [ciljpgjahkpnilhbolpaphfjhlejnplm] - C:\Program Files (x86)\a2zlyr\130.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-05] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-05] (Avira Operations GmbH & Co. KG)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [168448 2009-12-22] (Sony of America Corporation)
S3 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [155344 2011-06-29] (Avanquest Software)
R2 STRATO HiDrive Service; C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-11-15] (STRATO)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2010-04-08] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [852336 2010-03-18] (Sony Corporation)
S3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1203568 2010-01-22] (Sony Corporation)
S2 0188741378154977mcinstcleanup; C:\Users\Kathrin\AppData\Local\Temp\018874~1.EXE -cleanup -nolog [x]
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-01] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-01] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-01] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-01] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-01] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-01] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-01] (MCCI Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64(1).exe
2013-09-03 09:47 - 2013-09-03 09:47 - 01037134 _____ C:\Users\Kathrin\Downloads\adwcleaner.exe
2013-09-03 09:45 - 2013-09-03 09:45 - 00001196 _____ C:\Users\Kathrin\Downloads\adwcleaner3001 - Verknüpfung.lnk
2013-09-03 08:56 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-09-03 08:49 - 2013-09-03 08:49 - 00004946 _____ C:\Windows\PFRO.log
2013-09-02 23:19 - 2013-09-02 23:19 - 00025738 _____ C:\Users\Kathrin\Desktop\combofix.txt
2013-09-02 23:10 - 2013-09-02 23:10 - 00025063 _____ C:\ComboFix.txt
2013-09-02 22:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-02 22:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-02 22:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-02 22:28 - 2013-09-02 23:10 - 00000000 ____D C:\Qoobox
2013-09-02 22:27 - 2013-09-02 23:07 - 00000000 ____D C:\Windows\erdnt
2013-09-02 22:20 - 2013-09-02 22:21 - 05119472 ____R (Swearware) C:\Users\Kathrin\Downloads\ComboFix.exe
2013-09-02 12:04 - 2013-09-02 12:04 - 00000538 _____ C:\Users\Kathrin\Desktop\gmer.log
2013-09-02 11:15 - 2013-09-02 11:15 - 00377856 _____ C:\Users\Kathrin\Downloads\gmer_2.1.19163.exe
2013-09-02 11:14 - 2013-09-02 11:14 - 00052413 _____ C:\Users\Kathrin\Desktop\FRST.txt
2013-09-02 11:04 - 2013-09-02 11:06 - 00000476 _____ C:\Users\Kathrin\Downloads\defogger_disable.log
2013-09-02 11:04 - 2013-09-02 11:04 - 00000000 _____ C:\Users\Kathrin\defogger_reenable
2013-09-02 10:31 - 2013-09-02 10:31 - 00050477 _____ C:\Users\Kathrin\Downloads\Defogger.exe
2013-09-02 09:46 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-09-02 09:46 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-09-02 09:46 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-02 09:46 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-02 09:46 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-09-02 09:45 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-09-02 09:45 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-09-02 09:45 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-09-02 09:45 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-09-02 09:45 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-09-02 09:45 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-09-02 09:45 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-09-02 09:45 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-09-02 09:45 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-09-02 09:45 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-09-02 09:45 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-09-02 09:45 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-09-02 09:45 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-09-02 09:45 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-09-02 09:45 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-09-02 09:45 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-09-02 09:45 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-09-02 09:45 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-09-02 09:45 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-09-02 09:43 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-02 09:43 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-02 09:43 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-02 09:43 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-02 09:43 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-02 09:43 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-02 09:43 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-02 09:43 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-02 09:43 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-02 09:43 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-02 09:43 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-02 09:43 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-09-02 09:43 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-09-02 09:42 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-09-02 09:42 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-09-02 09:42 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-09-02 09:42 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-09-02 09:42 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-09-02 09:42 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-09-02 09:42 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-09-01 23:32 - 2013-09-01 23:32 - 00000000 ____D C:\Users\Kathrin\AppData\Local\ESET
2013-09-01 22:53 - 2013-09-01 22:53 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-01 22:51 - 2013-09-01 22:52 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu.exe
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\ProgramData\ESET
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\Program Files\ESET
2013-09-01 22:31 - 2013-09-01 22:31 - 01415824 _____ (ESET) C:\Users\Kathrin\Downloads\eset_nod32_antivirus_live_installer.exe
2013-09-01 22:27 - 2013-09-01 22:27 - 00001358 _____ C:\Users\Kathrin\Desktop\JRT.txt
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 22:11 - 2013-09-01 22:11 - 01027511 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT_5.5.6.exe
2013-09-01 22:00 - 2013-09-03 09:52 - 00000000 ____D C:\AdwCleaner
2013-09-01 21:52 - 2013-09-01 21:52 - 00025995 _____ C:\Users\Kathrin\Downloads\Addition.txt
2013-09-01 21:49 - 2013-09-01 21:49 - 00000000 ____D C:\FRST
2013-09-01 21:12 - 2013-09-03 09:53 - 00000896 _____ C:\Windows\setupact.log
2013-09-01 21:12 - 2013-09-01 21:12 - 00000000 _____ C:\Windows\setuperr.log
2013-09-01 20:48 - 2013-09-01 20:49 - 00000000 ____D C:\Users\Kathrin\Downloads\ccsetup405
2013-09-01 20:48 - 2013-09-01 20:48 - 04352187 _____ C:\Users\Kathrin\Downloads\ccsetup405.zip
2013-08-30 11:25 - 2013-08-30 11:25 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-28 23:24 - 2013-08-28 23:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 23:24 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 23:23 - 2013-08-28 23:23 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-28 18:04 - 2013-08-28 18:04 - 05683272 _____ (Systweak Inc ) C:\Users\Kathrin\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-08-28 16:04 - 2013-08-28 16:04 - 00001514 _____ C:\Users\Kathrin\AppData\Local\recently-used.xbel
2013-08-28 12:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-28 12:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-28 12:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-28 12:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-28 12:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-28 12:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-28 12:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-28 12:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-28 12:09 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-28 12:09 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-28 12:09 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-28 12:09 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-28 12:09 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-27 23:56 - 2013-08-27 23:59 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 23:56 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\.thumbnails
2013-08-27 23:53 - 2013-08-28 16:11 - 00000000 ____D C:\Users\Kathrin\.gimp-2.8
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 23:50 - 2013-08-27 23:52 - 00000000 ____D C:\Program Files\GIMP 2
2013-08-27 23:49 - 2013-08-27 23:50 - 90116160 _____ (The GIMP Team ) C:\Users\Kathrin\Downloads\gimp-2.8.6-setup.exe
2013-08-27 23:48 - 2013-08-27 23:48 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(2).exe
2013-08-27 23:42 - 2013-08-27 23:42 - 00000000 ____D C:\Program Files (x86)\a2zlyr
2013-08-27 23:30 - 2013-08-27 23:30 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(1).exe
2013-08-27 23:29 - 2013-08-27 23:29 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup.exe
2013-08-27 16:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-27 16:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-27 16:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-27 16:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-27 16:09 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-27 16:09 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-27 16:07 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-27 16:07 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 16:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-27 16:07 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-05 22:00 - 2013-08-05 22:00 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Avira
2013-08-05 21:56 - 2013-08-05 21:56 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-05 21:54 - 2013-08-05 21:54 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-05 21:53 - 2013-08-05 21:54 - 00000000 ____D C:\ProgramData\Avira
2013-08-05 21:53 - 2013-08-05 21:53 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-05 21:53 - 2013-08-05 21:45 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-05 21:53 - 2013-08-05 21:45 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-05 21:53 - 2013-08-05 21:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
==================== One Month Modified Files and Folders =======
2013-09-03 10:03 - 2012-01-10 16:16 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Skype
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64.exe
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64(1).exe
2013-09-03 10:02 - 2009-07-14 06:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 10:02 - 2009-07-14 06:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 09:59 - 2012-04-04 09:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 09:58 - 2012-01-06 11:51 - 01500773 _____ C:\Windows\WindowsUpdate.log
2013-09-03 09:56 - 2012-02-05 09:58 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Dropbox
2013-09-03 09:55 - 2012-02-05 10:05 - 00000000 ___RD C:\Users\Kathrin\Dropbox
2013-09-03 09:54 - 2012-01-06 12:07 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 09:53 - 2013-09-01 21:12 - 00000896 _____ C:\Windows\setupact.log
2013-09-03 09:53 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 09:52 - 2013-09-01 22:00 - 00000000 ____D C:\AdwCleaner
2013-09-03 09:47 - 2013-09-03 09:47 - 01037134 _____ C:\Users\Kathrin\Downloads\adwcleaner.exe
2013-09-03 09:45 - 2013-09-03 09:45 - 00001196 _____ C:\Users\Kathrin\Downloads\adwcleaner3001 - Verknüpfung.lnk
2013-09-03 09:12 - 2012-01-06 12:07 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-03 08:49 - 2013-09-03 08:49 - 00004946 _____ C:\Windows\PFRO.log
2013-09-03 08:49 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files\Common Files\mcafee
2013-09-02 23:19 - 2013-09-02 23:19 - 00025738 _____ C:\Users\Kathrin\Desktop\combofix.txt
2013-09-02 23:10 - 2013-09-02 23:10 - 00025063 _____ C:\ComboFix.txt
2013-09-02 23:10 - 2013-09-02 22:28 - 00000000 ____D C:\Qoobox
2013-09-02 23:10 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-02 23:07 - 2013-09-02 22:27 - 00000000 ____D C:\Windows\erdnt
2013-09-02 23:05 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-02 22:50 - 2012-01-10 16:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-02 22:49 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files\mcafee
2013-09-02 22:44 - 2012-01-10 17:23 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-09-02 22:21 - 2013-09-02 22:20 - 05119472 ____R (Swearware) C:\Users\Kathrin\Downloads\ComboFix.exe
2013-09-02 21:31 - 2012-01-10 16:15 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3BC58626-E210-4F8C-8C04-443C520B696D}
2013-09-02 12:04 - 2013-09-02 12:04 - 00000538 _____ C:\Users\Kathrin\Desktop\gmer.log
2013-09-02 11:15 - 2013-09-02 11:15 - 00377856 _____ C:\Users\Kathrin\Downloads\gmer_2.1.19163.exe
2013-09-02 11:14 - 2013-09-02 11:14 - 00052413 _____ C:\Users\Kathrin\Desktop\FRST.txt
2013-09-02 11:06 - 2013-09-02 11:04 - 00000476 _____ C:\Users\Kathrin\Downloads\defogger_disable.log
2013-09-02 11:04 - 2013-09-02 11:04 - 00000000 _____ C:\Users\Kathrin\defogger_reenable
2013-09-02 11:04 - 2012-01-10 16:08 - 00000000 ____D C:\Users\Kathrin
2013-09-02 10:31 - 2013-09-02 10:31 - 00050477 _____ C:\Users\Kathrin\Downloads\Defogger.exe
2013-09-02 09:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-09-01 23:32 - 2013-09-01 23:32 - 00000000 ____D C:\Users\Kathrin\AppData\Local\ESET
2013-09-01 22:53 - 2013-09-01 22:53 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-01 22:52 - 2013-09-01 22:51 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu.exe
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\ProgramData\ESET
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\Program Files\ESET
2013-09-01 22:31 - 2013-09-01 22:31 - 01415824 _____ (ESET) C:\Users\Kathrin\Downloads\eset_nod32_antivirus_live_installer.exe
2013-09-01 22:27 - 2013-09-01 22:27 - 00001358 _____ C:\Users\Kathrin\Desktop\JRT.txt
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 22:11 - 2013-09-01 22:11 - 01027511 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT_5.5.6.exe
2013-09-01 21:52 - 2013-09-01 21:52 - 00025995 _____ C:\Users\Kathrin\Downloads\Addition.txt
2013-09-01 21:49 - 2013-09-01 21:49 - 00000000 ____D C:\FRST
2013-09-01 21:12 - 2013-09-01 21:12 - 00000000 _____ C:\Windows\setuperr.log
2013-09-01 21:04 - 2012-01-10 16:27 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-09-01 21:04 - 2010-04-13 02:39 - 00000000 ____D C:\Windows\Panther
2013-09-01 20:49 - 2013-09-01 20:48 - 00000000 ____D C:\Users\Kathrin\Downloads\ccsetup405
2013-09-01 20:48 - 2013-09-01 20:48 - 04352187 _____ C:\Users\Kathrin\Downloads\ccsetup405.zip
2013-09-01 20:15 - 2012-03-08 20:08 - 00000000 ____D C:\Users\Kathrin\AppData\Local\Apple Computer
2013-09-01 17:52 - 2012-01-06 12:07 - 00000000 ____D C:\Program Files\Google
2013-09-01 17:52 - 2012-01-06 12:07 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-30 16:34 - 2013-02-04 15:44 - 00000000 ____D C:\Users\Kathrin\Documents\barcelona
2013-08-30 11:30 - 2012-01-10 16:22 - 00000000 ____D C:\Users\Kathrin\AppData\Local\Google
2013-08-30 11:30 - 2012-01-06 12:07 - 00000000 ____D C:\ProgramData\Google
2013-08-30 11:25 - 2013-08-30 11:25 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-29 10:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-29 07:44 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-08-28 23:24 - 2013-08-28 23:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 23:23 - 2013-08-28 23:23 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-28 18:06 - 2012-02-10 16:01 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-08-28 18:04 - 2013-08-28 18:04 - 05683272 _____ (Systweak Inc ) C:\Users\Kathrin\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-08-28 16:11 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\.gimp-2.8
2013-08-28 16:04 - 2013-08-28 16:04 - 00001514 _____ C:\Users\Kathrin\AppData\Local\recently-used.xbel
2013-08-28 12:09 - 2012-01-10 16:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 12:02 - 2012-01-06 11:46 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-08-28 12:02 - 2012-01-06 11:46 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-08-28 12:02 - 2009-07-14 07:13 - 01520734 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-28 11:55 - 2013-08-03 08:41 - 00000000 ____D C:\Windows\system32\MRT
2013-08-28 11:47 - 2012-01-19 19:01 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-28 11:26 - 2012-05-04 13:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-27 23:59 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 23:56 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\.thumbnails
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 23:52 - 2013-08-27 23:50 - 00000000 ____D C:\Program Files\GIMP 2
2013-08-27 23:50 - 2013-08-27 23:49 - 90116160 _____ (The GIMP Team ) C:\Users\Kathrin\Downloads\gimp-2.8.6-setup.exe
2013-08-27 23:48 - 2013-08-27 23:48 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(2).exe
2013-08-27 23:42 - 2013-08-27 23:42 - 00000000 ____D C:\Program Files (x86)\a2zlyr
2013-08-27 23:30 - 2013-08-27 23:30 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(1).exe
2013-08-27 23:29 - 2013-08-27 23:29 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup.exe
2013-08-27 15:59 - 2012-04-04 09:42 - 00692104 ____N (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-27 15:59 - 2012-04-04 09:42 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-27 15:59 - 2012-01-10 18:13 - 00071048 ____N (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-07 04:22 - 2013-09-03 08:56 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-08-05 22:00 - 2013-08-05 22:00 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Avira
2013-08-05 21:56 - 2013-08-05 21:56 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-05 21:54 - 2013-08-05 21:54 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-05 21:54 - 2013-08-05 21:53 - 00000000 ____D C:\ProgramData\Avira
2013-08-05 21:53 - 2013-08-05 21:53 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-05 21:45 - 2013-08-05 21:53 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-05 21:45 - 2013-08-05 21:53 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-05 21:45 - 2013-08-05 21:53 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-05 21:27 - 2012-01-10 17:49 - 00000000 ____D C:\Users\Kathrin\Documents\privat
2013-08-05 07:20 - 2012-11-28 18:17 - 00245209 _____ C:\test.xml
Files to move or delete:
====================
C:\Users\Kathrin\AppData\Local\Temp\Quarantine.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-27 16:39
==================== End Of Log ============================
--- --- --- |
|
03.09.2013, 11:25
| #6 |
| /// the machine /// TB-Ausbilder | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholtESET Online Scanner
Downloade Dir bitte  SecurityCheck und:
und ein frisches FRST log bitte. Noch Probleme? 
__________________ --> Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt |
|
03.09.2013, 14:03
| #7 |
| | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Wie immerhängt sich der Scan mit ESET bei 54% und 2 Funden auf, hab trotzdem den securitycheck gemacht, hier die logfile: Code:
ATTFilter o Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` ESET NOD32 Antivirus 6.0 Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.75.0.1300 Java(TM) 6 Update 37 Java 7 Update 25 Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.8.800.94 Adobe Reader 9 Adobe Reader out of Date! Mozilla Firefox (23.0.1) Google Chrome 28.0.1500.95 Google Chrome 29.0.1547.62 ````````Process Check: objlist.exe by Laurent```````` ESET NOD32 Antivirus egui.exe ESET NOD32 Antivirus ekrn.exe Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2013 01
Ran by Kathrin (administrator) on KATHRIN-VAIO on 03-09-2013 15:01:37
Running from C:\Users\Kathrin\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
(Sony Corporation) c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
(STRATO) C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCSpt.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe
(ArcSoft, Inc.) C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
(Microsoft Corporation) C:\Windows\SysWOW64\DllHost.exe
(Sony Corporation) C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
(Sony Corporation) C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apoint.exe
(ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Dropbox, Inc.) C:\Users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe
(Sony Corporation) C:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Care\VCsystray.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\Apoint\Apntex.exe
(ALPS) C:\Program Files\Apoint\Apvfb.exe
(Microsoft Corporation) C:\Windows\System32\vds.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\OUTLOOK.EXE
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) C:\Windows\system32\prevhost.exe
() C:\Users\Kathrin\Downloads\SecurityCheck.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Farbar) C:\Users\Kathrin\Downloads\FRST64(1).exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10134560 2010-04-07] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] - C:\Program Files\Apoint\Apoint.exe [221480 2010-05-17] (Alps Electric Co., Ltd.)
HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
HKLM\...\Policies\Explorer: [NoDrives] 0
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19603048 2013-06-03] (Skype Technologies S.A.)
HKCU\...\Policies\Explorer: [NoDrives] 0
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-03-03] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [NortonOnlineBackupReminder] - C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [538472 2009-06-17] (Symantec Corporation)
HKLM-x32\...\Run: [PMBVolumeWatcher] - c:\Program Files (x86)\Sony\PMB\PMBVolumeWatcher.exe [597792 2010-01-21] (Sony Corporation)
HKLM-x32\...\Run: [GrooveMonitor] - C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [SSBkgdUpdate] - C:\Program Files (x86)\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [210472 2006-10-25] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-10] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-10] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort11reminder] - C:\Program Files (x86)\ScanSoft\PaperPort\Ereg\Ereg.exe [328992 2007-08-31] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [38872 2012-07-31] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-11] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-08-27] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-04-18] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [421776 2012-09-10] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-05] (Avira Operations GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\Kathrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Kathrin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=EU01
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {09C5847E-0A79-481E-B2A5-7546A36F000C} URL = hxxp://services.zinio.com/search?s={searchTerms}&rf=sonyslices
SearchScopes: HKCU - {7BAD3864-ADC6-4041-AAB1-E62910AD1ED8} URL = hxxp://de.shopping.com/?linkin_id=8056363
SearchScopes: HKCU - {DB93BADF-39B4-452E-8E80-CBA1B7593D0D} URL = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
SearchScopes: HKCU - {EA11680E-7B02-490B-8F63-A286F13D77F2} URL = hxxp://rover.ebay.com/rover/1/707-37276-16609-0/4?satitle={searchTerms}
BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File
BHO: Windows Live Family Safety Browser Helper Class - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll ()
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default
FF Homepage: https://www.facebook.com/
FF Keyword.URL: hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=827316&p=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @SonyCreativeSoftware.com/Media Go,version=1.0 - C:\Program Files (x86)\Sony\Media Go\npmediago.dll (Sony Media Software and Services Inc)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101721.dll (Amazon.com, Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: No Name - C:\Users\Kathrin\AppData\Roaming\Mozilla\Firefox\Profiles\hej92mpp.default\Extensions\abb@amazon.com
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
FF HKLM\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKLM-x32\...\Thunderbird\Extensions: [eplgTb@eset.com] C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF Extension: ESET Smart Security Extension - C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird
FF HKCU\...\Firefox\Extensions: [{40cb9f89-3d25-4aee-91c3-3ce88d2cecde}] C:\Program Files (x86)\a2zlyr\130.xpi
FF Extension: No Name - C:\Program Files (x86)\a2zlyr\130.xpi
Chrome:
=======
CHR HomePage: hxxp://www.google.com/ig/redirectdomain?brand=SVED&bmod=SVED
CHR DefaultSearchURL: (Yahoo! Deutschland) - hxxp://de.search.yahoo.com/search?ei={inputEncoding}&fr=crmas&p={searchTerms}
CHR DefaultSuggestURL: (Yahoo! Deutschland) - hxxp://de-sayt.ff.search.yahoo.com/gossip-de-sayt?output=fxjson&command={searchTerms}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\pdf.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\16.0.912.75\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (McAfee SiteAdvisor) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0\McChPlg.dll (McAfee, Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.180.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeploytk.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U20) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (SiteAdvisor) - C:\Users\Kathrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fheoggkfdfchfphceeifdbepaooicaho\3.31.137.7_0
CHR HKLM-x32\...\Chrome\Extension: [ciljpgjahkpnilhbolpaphfjhlejnplm] - C:\Program Files (x86)\a2zlyr\130.crx
CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
==================== Services (Whitelisted) =================
S3 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-05] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-05] (Avira Operations GmbH & Co. KG)
R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S3 SampleCollector; C:\Program Files\Sony\VAIO Care\collsvc.exe [168448 2009-12-22] (Sony of America Corporation)
S3 Sony Ericsson PCCompanion; C:\Program Files (x86)\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe [155344 2011-06-29] (Avanquest Software)
R2 STRATO HiDrive Service; C:\Program Files (x86)\STRATO AG\STRATO HiDrive\STRATO HiDrive Service.exe [32768 2011-11-15] (STRATO)
R2 uCamMonitor; C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [104960 2008-09-18] (ArcSoft, Inc.)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Entertainment Platform\VzHardwareResourceManager\VzHardwareResourceManager\VzHardwareResourceManager.exe [69632 2010-04-08] (Sony Corporation)
S3 VCFw; C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [852336 2010-03-18] (Sony Corporation)
S3 VUAgent; C:\Program Files\Sony\VAIO Update 5\VUAgent.exe [1203568 2010-01-22] (Sony Corporation)
S2 0188741378154977mcinstcleanup; C:\Users\Kathrin\AppData\Local\Temp\018874~1.EXE -cleanup -nolog [x]
==================== Drivers (Whitelisted) ====================
R3 ArcSoftKsUFilter; C:\Windows\System32\DRIVERS\ArcSoftKsUFilter.sys [19968 2009-05-26] (ArcSoft, Inc.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-05] (Avira Operations GmbH & Co. KG)
R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-14] (ESET)
R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 s1039bus; C:\Windows\System32\DRIVERS\s1039bus.sys [127600 2010-03-01] (MCCI Corporation)
S3 s1039mdfl; C:\Windows\System32\DRIVERS\s1039mdfl.sys [19568 2010-03-01] (MCCI Corporation)
S3 s1039mdm; C:\Windows\System32\DRIVERS\s1039mdm.sys [161904 2010-03-01] (MCCI Corporation)
S3 s1039mgmt; C:\Windows\System32\DRIVERS\s1039mgmt.sys [141424 2010-03-01] (MCCI Corporation)
S3 s1039nd5; C:\Windows\System32\DRIVERS\s1039nd5.sys [34416 2010-03-01] (MCCI Corporation)
S3 s1039obex; C:\Windows\System32\DRIVERS\s1039obex.sys [137328 2010-03-01] (MCCI Corporation)
S3 s1039unic; C:\Windows\System32\DRIVERS\s1039unic.sys [158320 2010-03-01] (MCCI Corporation)
U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-09-03 14:15 - 2013-09-03 14:15 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu(1).exe
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64.exe
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64(1).exe
2013-09-03 09:47 - 2013-09-03 09:47 - 01037134 _____ C:\Users\Kathrin\Downloads\adwcleaner.exe
2013-09-03 09:45 - 2013-09-03 09:45 - 00001196 _____ C:\Users\Kathrin\Downloads\adwcleaner3001 - Verknüpfung.lnk
2013-09-03 08:56 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-09-03 08:49 - 2013-09-03 08:49 - 00004946 _____ C:\Windows\PFRO.log
2013-09-02 23:19 - 2013-09-02 23:19 - 00025738 _____ C:\Users\Kathrin\Desktop\combofix.txt
2013-09-02 23:10 - 2013-09-02 23:10 - 00025063 _____ C:\ComboFix.txt
2013-09-02 22:43 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-09-02 22:43 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-09-02 22:43 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-09-02 22:43 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-09-02 22:28 - 2013-09-02 23:10 - 00000000 ____D C:\Qoobox
2013-09-02 22:27 - 2013-09-02 23:07 - 00000000 ____D C:\Windows\erdnt
2013-09-02 22:20 - 2013-09-02 22:21 - 05119472 ____R (Swearware) C:\Users\Kathrin\Downloads\ComboFix.exe
2013-09-02 12:04 - 2013-09-02 12:04 - 00000538 _____ C:\Users\Kathrin\Desktop\gmer.log
2013-09-02 11:15 - 2013-09-02 11:15 - 00377856 _____ C:\Users\Kathrin\Downloads\gmer_2.1.19163.exe
2013-09-02 11:14 - 2013-09-02 11:14 - 00052413 _____ C:\Users\Kathrin\Desktop\FRST.txt
2013-09-02 11:04 - 2013-09-02 11:06 - 00000476 _____ C:\Users\Kathrin\Downloads\defogger_disable.log
2013-09-02 11:04 - 2013-09-02 11:04 - 00000000 _____ C:\Users\Kathrin\defogger_reenable
2013-09-02 10:31 - 2013-09-02 10:31 - 00050477 _____ C:\Users\Kathrin\Downloads\Defogger.exe
2013-09-02 09:46 - 2012-08-23 16:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2013-09-02 09:46 - 2012-08-23 16:07 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2013-09-02 09:46 - 2012-08-23 15:41 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2013-09-02 09:46 - 2012-08-23 15:40 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2013-09-02 09:46 - 2012-08-23 15:24 - 00015360 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2013-09-02 09:45 - 2012-08-23 16:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2013-09-02 09:45 - 2012-08-23 15:47 - 00046592 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2013-09-02 09:45 - 2012-08-23 15:46 - 00016896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2013-09-02 09:45 - 2012-08-23 15:20 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2013-09-02 09:45 - 2012-08-23 15:18 - 00037376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-09-02 09:45 - 2012-08-23 15:17 - 00018432 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2013-09-02 09:45 - 2012-08-23 15:06 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2013-09-02 09:45 - 2012-08-23 14:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2013-09-02 09:45 - 2012-08-23 13:20 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2013-09-02 09:45 - 2012-08-23 13:15 - 00269312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-09-02 09:45 - 2012-08-23 13:14 - 00384000 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2013-09-02 09:45 - 2012-08-23 13:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2013-09-02 09:45 - 2012-08-23 12:54 - 00322560 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll
2013-09-02 09:45 - 2012-08-23 12:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2013-09-02 09:45 - 2012-08-23 12:39 - 01048064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2013-09-02 09:45 - 2012-08-23 12:22 - 01123840 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2013-09-02 09:45 - 2012-08-23 11:51 - 03174912 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2013-09-02 09:45 - 2012-08-23 10:19 - 04916224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-09-02 09:45 - 2012-08-23 10:13 - 05773824 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2013-09-02 09:43 - 2013-07-09 08:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-09-02 09:43 - 2013-07-09 07:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-09-02 09:43 - 2013-07-09 07:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
2013-09-02 09:43 - 2013-07-09 07:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-09-02 09:43 - 2013-07-09 07:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-09-02 09:43 - 2013-07-09 06:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2013-09-02 09:43 - 2013-07-09 06:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2013-09-02 09:43 - 2013-07-09 04:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2013-09-02 09:43 - 2013-07-09 04:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2013-09-02 09:43 - 2013-07-09 04:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2013-09-02 09:43 - 2013-07-09 04:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2013-09-02 09:43 - 2012-05-04 13:00 - 00366592 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2013-09-02 09:43 - 2012-05-04 11:59 - 00514560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2013-09-02 09:42 - 2012-08-24 20:13 - 00154480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-09-02 09:42 - 2012-08-24 20:09 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-09-02 09:42 - 2012-08-24 20:05 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-09-02 09:42 - 2012-08-24 20:03 - 01448448 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-09-02 09:42 - 2012-08-24 18:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-09-02 09:42 - 2012-08-24 18:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-09-02 09:42 - 2012-08-24 18:53 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-09-01 23:32 - 2013-09-01 23:32 - 00000000 ____D C:\Users\Kathrin\AppData\Local\ESET
2013-09-01 22:53 - 2013-09-01 22:53 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-01 22:51 - 2013-09-01 22:52 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu.exe
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\ProgramData\ESET
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\Program Files\ESET
2013-09-01 22:31 - 2013-09-01 22:31 - 01415824 _____ (ESET) C:\Users\Kathrin\Downloads\eset_nod32_antivirus_live_installer.exe
2013-09-01 22:27 - 2013-09-01 22:27 - 00001358 _____ C:\Users\Kathrin\Desktop\JRT.txt
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 22:11 - 2013-09-01 22:11 - 01027511 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT_5.5.6.exe
2013-09-01 22:00 - 2013-09-03 09:52 - 00000000 ____D C:\AdwCleaner
2013-09-01 21:52 - 2013-09-01 21:52 - 00025995 _____ C:\Users\Kathrin\Downloads\Addition.txt
2013-09-01 21:49 - 2013-09-01 21:49 - 00000000 ____D C:\FRST
2013-09-01 21:12 - 2013-09-03 14:41 - 00001120 _____ C:\Windows\setupact.log
2013-09-01 21:12 - 2013-09-01 21:12 - 00000000 _____ C:\Windows\setuperr.log
2013-09-01 20:48 - 2013-09-01 20:49 - 00000000 ____D C:\Users\Kathrin\Downloads\ccsetup405
2013-09-01 20:48 - 2013-09-01 20:48 - 04352187 _____ C:\Users\Kathrin\Downloads\ccsetup405.zip
2013-08-30 11:25 - 2013-08-30 11:25 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-28 23:24 - 2013-08-28 23:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 23:24 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-28 23:23 - 2013-08-28 23:23 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-28 18:04 - 2013-08-28 18:04 - 05683272 _____ (Systweak Inc ) C:\Users\Kathrin\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-08-28 16:04 - 2013-08-28 16:04 - 00001514 _____ C:\Users\Kathrin\AppData\Local\recently-used.xbel
2013-08-28 12:10 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-28 12:10 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-28 12:10 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-28 12:10 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-28 12:10 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-28 12:10 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-28 12:10 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-28 12:10 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-28 12:10 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-28 12:10 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-28 12:09 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-28 12:09 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-28 12:09 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-28 12:09 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-28 12:09 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-28 12:09 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-28 12:09 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-27 23:56 - 2013-08-27 23:59 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 23:56 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\.thumbnails
2013-08-27 23:53 - 2013-08-28 16:11 - 00000000 ____D C:\Users\Kathrin\.gimp-2.8
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 23:50 - 2013-08-27 23:52 - 00000000 ____D C:\Program Files\GIMP 2
2013-08-27 23:49 - 2013-08-27 23:50 - 90116160 _____ (The GIMP Team ) C:\Users\Kathrin\Downloads\gimp-2.8.6-setup.exe
2013-08-27 23:48 - 2013-08-27 23:48 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(2).exe
2013-08-27 23:42 - 2013-08-27 23:42 - 00000000 ____D C:\Program Files (x86)\a2zlyr
2013-08-27 23:30 - 2013-08-27 23:30 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(1).exe
2013-08-27 23:29 - 2013-08-27 23:29 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup.exe
2013-08-27 16:11 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-27 16:11 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-27 16:11 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-27 16:11 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-27 16:09 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-27 16:09 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-27 16:09 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-27 16:09 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-27 16:07 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-27 16:07 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-27 16:07 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-27 16:07 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-05 22:00 - 2013-08-05 22:00 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Avira
2013-08-05 21:56 - 2013-08-05 21:56 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-05 21:54 - 2013-08-05 21:54 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-05 21:53 - 2013-08-05 21:54 - 00000000 ____D C:\ProgramData\Avira
2013-08-05 21:53 - 2013-08-05 21:53 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-05 21:53 - 2013-08-05 21:45 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-05 21:53 - 2013-08-05 21:45 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-05 21:53 - 2013-08-05 21:45 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
==================== One Month Modified Files and Folders =======
2013-09-03 14:59 - 2012-04-04 09:42 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-09-03 14:53 - 2013-09-03 14:53 - 00891115 _____ C:\Users\Kathrin\Downloads\SecurityCheck.exe
2013-09-03 14:50 - 2009-07-14 06:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-09-03 14:50 - 2009-07-14 06:45 - 00014144 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-09-03 14:46 - 2012-01-06 11:51 - 01514172 _____ C:\Windows\WindowsUpdate.log
2013-09-03 14:43 - 2012-02-05 10:05 - 00000000 ___RD C:\Users\Kathrin\Dropbox
2013-09-03 14:43 - 2012-02-05 09:58 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Dropbox
2013-09-03 14:43 - 2012-01-10 16:16 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Skype
2013-09-03 14:41 - 2013-09-01 21:12 - 00001120 _____ C:\Windows\setupact.log
2013-09-03 14:41 - 2012-01-06 12:07 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-09-03 14:41 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-09-03 14:15 - 2013-09-03 14:15 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu(1).exe
2013-09-03 14:12 - 2012-01-06 12:07 - 00001124 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64.exe
2013-09-03 10:02 - 2013-09-03 10:02 - 01950474 _____ (Farbar) C:\Users\Kathrin\Downloads\FRST64(1).exe
2013-09-03 09:52 - 2013-09-01 22:00 - 00000000 ____D C:\AdwCleaner
2013-09-03 09:47 - 2013-09-03 09:47 - 01037134 _____ C:\Users\Kathrin\Downloads\adwcleaner.exe
2013-09-03 09:45 - 2013-09-03 09:45 - 00001196 _____ C:\Users\Kathrin\Downloads\adwcleaner3001 - Verknüpfung.lnk
2013-09-03 08:49 - 2013-09-03 08:49 - 00004946 _____ C:\Windows\PFRO.log
2013-09-03 08:49 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files\Common Files\mcafee
2013-09-02 23:19 - 2013-09-02 23:19 - 00025738 _____ C:\Users\Kathrin\Desktop\combofix.txt
2013-09-02 23:10 - 2013-09-02 23:10 - 00025063 _____ C:\ComboFix.txt
2013-09-02 23:10 - 2013-09-02 22:28 - 00000000 ____D C:\Qoobox
2013-09-02 23:10 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-09-02 23:07 - 2013-09-02 22:27 - 00000000 ____D C:\Windows\erdnt
2013-09-02 23:05 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-09-02 22:50 - 2012-01-10 16:25 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-09-02 22:49 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files\mcafee
2013-09-02 22:44 - 2012-01-10 17:23 - 00000000 ____D C:\Program Files\SUPERAntiSpyware
2013-09-02 22:21 - 2013-09-02 22:20 - 05119472 ____R (Swearware) C:\Users\Kathrin\Downloads\ComboFix.exe
2013-09-02 21:31 - 2012-01-10 16:15 - 00003954 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{3BC58626-E210-4F8C-8C04-443C520B696D}
2013-09-02 12:04 - 2013-09-02 12:04 - 00000538 _____ C:\Users\Kathrin\Desktop\gmer.log
2013-09-02 11:15 - 2013-09-02 11:15 - 00377856 _____ C:\Users\Kathrin\Downloads\gmer_2.1.19163.exe
2013-09-02 11:14 - 2013-09-02 11:14 - 00052413 _____ C:\Users\Kathrin\Desktop\FRST.txt
2013-09-02 11:06 - 2013-09-02 11:04 - 00000476 _____ C:\Users\Kathrin\Downloads\defogger_disable.log
2013-09-02 11:04 - 2013-09-02 11:04 - 00000000 _____ C:\Users\Kathrin\defogger_reenable
2013-09-02 11:04 - 2012-01-10 16:08 - 00000000 ____D C:\Users\Kathrin
2013-09-02 10:31 - 2013-09-02 10:31 - 00050477 _____ C:\Users\Kathrin\Downloads\Defogger.exe
2013-09-02 09:48 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-09-01 23:32 - 2013-09-01 23:32 - 00000000 ____D C:\Users\Kathrin\AppData\Local\ESET
2013-09-01 22:53 - 2013-09-01 22:53 - 00000000 ____D C:\Program Files (x86)\ESET
2013-09-01 22:52 - 2013-09-01 22:51 - 02347384 _____ (ESET) C:\Users\Kathrin\Downloads\esetsmartinstaller_enu.exe
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\ProgramData\ESET
2013-09-01 22:34 - 2013-09-01 22:34 - 00000000 ____D C:\Program Files\ESET
2013-09-01 22:31 - 2013-09-01 22:31 - 01415824 _____ (ESET) C:\Users\Kathrin\Downloads\eset_nod32_antivirus_live_installer.exe
2013-09-01 22:27 - 2013-09-01 22:27 - 00001358 _____ C:\Users\Kathrin\Desktop\JRT.txt
2013-09-01 22:12 - 2013-09-01 22:12 - 00000000 ____D C:\Windows\ERUNT
2013-09-01 22:11 - 2013-09-01 22:11 - 01027511 _____ (Thisisu) C:\Users\Kathrin\Downloads\JRT_5.5.6.exe
2013-09-01 21:52 - 2013-09-01 21:52 - 00025995 _____ C:\Users\Kathrin\Downloads\Addition.txt
2013-09-01 21:49 - 2013-09-01 21:49 - 00000000 ____D C:\FRST
2013-09-01 21:12 - 2013-09-01 21:12 - 00000000 _____ C:\Windows\setuperr.log
2013-09-01 21:04 - 2012-01-10 16:27 - 00000000 ____D C:\Program Files (x86)\PDFCreator
2013-09-01 21:04 - 2010-04-13 02:39 - 00000000 ____D C:\Windows\Panther
2013-09-01 20:49 - 2013-09-01 20:48 - 00000000 ____D C:\Users\Kathrin\Downloads\ccsetup405
2013-09-01 20:48 - 2013-09-01 20:48 - 04352187 _____ C:\Users\Kathrin\Downloads\ccsetup405.zip
2013-09-01 20:15 - 2012-03-08 20:08 - 00000000 ____D C:\Users\Kathrin\AppData\Local\Apple Computer
2013-09-01 17:52 - 2012-01-06 12:07 - 00000000 ____D C:\Program Files\Google
2013-09-01 17:52 - 2012-01-06 12:07 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-30 16:34 - 2013-02-04 15:44 - 00000000 ____D C:\Users\Kathrin\Documents\barcelona
2013-08-30 11:30 - 2012-01-10 16:22 - 00000000 ____D C:\Users\Kathrin\AppData\Local\Google
2013-08-30 11:30 - 2012-01-06 12:07 - 00000000 ____D C:\ProgramData\Google
2013-08-30 11:25 - 2013-08-30 11:25 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Roxio Log Files
2013-08-29 10:49 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-29 07:44 - 2012-01-06 12:08 - 00000000 ____D C:\Program Files (x86)\McAfee
2013-08-28 23:24 - 2013-08-28 23:24 - 00001109 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-28 23:24 - 2013-08-28 23:24 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-28 23:23 - 2013-08-28 23:23 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Kathrin\Downloads\mbam-setup-1.75.0.1300.exe
2013-08-28 18:06 - 2012-02-10 16:01 - 00000000 ____D C:\Program Files (x86)\Amazon
2013-08-28 18:04 - 2013-08-28 18:04 - 05683272 _____ (Systweak Inc ) C:\Users\Kathrin\Downloads\rcpsetupmarm1_marm10de_aot.exe
2013-08-28 16:11 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\.gimp-2.8
2013-08-28 16:04 - 2013-08-28 16:04 - 00001514 _____ C:\Users\Kathrin\AppData\Local\recently-used.xbel
2013-08-28 12:09 - 2012-01-10 16:38 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-28 12:02 - 2012-01-06 11:46 - 00654400 _____ C:\Windows\system32\perfh007.dat
2013-08-28 12:02 - 2012-01-06 11:46 - 00130240 _____ C:\Windows\system32\perfc007.dat
2013-08-28 12:02 - 2009-07-14 07:13 - 01520734 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-28 11:55 - 2013-08-03 08:41 - 00000000 ____D C:\Windows\system32\MRT
2013-08-28 11:47 - 2012-01-19 19:01 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-28 11:26 - 2012-05-04 13:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-27 23:59 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gtk-2.0
2013-08-27 23:56 - 2013-08-27 23:56 - 00000000 ____D C:\Users\Kathrin\.thumbnails
2013-08-27 23:53 - 2013-08-27 23:53 - 00000000 ____D C:\Users\Kathrin\AppData\Local\gegl-0.2
2013-08-27 23:52 - 2013-08-27 23:50 - 00000000 ____D C:\Program Files\GIMP 2
2013-08-27 23:50 - 2013-08-27 23:49 - 90116160 _____ (The GIMP Team ) C:\Users\Kathrin\Downloads\gimp-2.8.6-setup.exe
2013-08-27 23:48 - 2013-08-27 23:48 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(2).exe
2013-08-27 23:42 - 2013-08-27 23:42 - 00000000 ____D C:\Program Files (x86)\a2zlyr
2013-08-27 23:30 - 2013-08-27 23:30 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup(1).exe
2013-08-27 23:29 - 2013-08-27 23:29 - 00166568 _____ () C:\Users\Kathrin\Downloads\7ZipSetup.exe
2013-08-27 15:59 - 2012-04-04 09:42 - 00692104 ____N (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-27 15:59 - 2012-04-04 09:42 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-27 15:59 - 2012-01-10 18:13 - 00071048 ____N (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-07 04:22 - 2013-09-03 08:56 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-08-05 22:00 - 2013-08-05 22:00 - 00000000 ____D C:\Users\Kathrin\AppData\Roaming\Avira
2013-08-05 21:56 - 2013-08-05 21:56 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-05 21:54 - 2013-08-05 21:54 - 00001994 _____ C:\Users\Public\Desktop\Avira Control Center.lnk
2013-08-05 21:54 - 2013-08-05 21:53 - 00000000 ____D C:\ProgramData\Avira
2013-08-05 21:53 - 2013-08-05 21:53 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-05 21:45 - 2013-08-05 21:53 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-05 21:45 - 2013-08-05 21:53 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-05 21:45 - 2013-08-05 21:53 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-05 21:27 - 2012-01-10 17:49 - 00000000 ____D C:\Users\Kathrin\Documents\privat
2013-08-05 07:20 - 2012-11-28 18:17 - 00245209 _____ C:\test.xml
Files to move or delete:
====================
C:\Users\Kathrin\AppData\Local\Temp\Quarantine.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\Objlist.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\runprocesses.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\uninstalllist.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\cmdinfo.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\nircmdc.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\sed.exe
C:\Users\Kathrin\AppData\Local\Temp\RarSFX0\SecurityCheck\Other\swreg.exe
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-27 16:39
==================== End Of Log ============================
|
|
03.09.2013, 20:18
| #8 |
| /// the machine /// TB-Ausbilder | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Flash und Adobe updaten. Mach statt dem onlinescan nen Vollscan mit deinem AV Programm. Noch Probleme?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
03.09.2013, 20:26
| #9 |
| | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Hab jetzt mal Firefox neu installiert, Adobe Reader und Flash Player deinstalliert, scheint jetzt besser zu sein. Aber Virenscan hängt sich immer noch auf, aber zumindest die Viren-Banner sind glaub ich durch das neue Firefox weg. Werd jetzt mal alle Virenprogramme deinstallieren und dann neu installieren, wenn das nicht hilft, werd ich Windows neu installieren, hilft ja anscheinend alles nix  |
|
04.09.2013, 08:49
| #10 |
| /// the machine /// TB-Ausbilder | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Deinstalliere alles an AV und Schutzprogrammen, und instaliere nur eines neu.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
04.09.2013, 09:08
| #11 |
| | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Zu welchem räts du mir? Maleware? Avira ist nicht so gut denk ich...Eset? Vielen Dank!!!! |
|
04.09.2013, 13:03
| #12 |
| /// the machine /// TB-Ausbilder | Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt Avast
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
| Themen zu Win 7 hängt sich beim Virusscan auf, Auf Websites erscheinen Viren-Alarm-Banner, Virus/Trojaner beim Download von Gimp über Softonic geholt |
| adw cleaner, antivir, banner, cleaner, download, durchgeführt, eset, hilfe!, hängen, hängt, installer, junkware, langsam, laufen, links, modus, rechts, regcleanpro, seite, software, superantispyware, tool, trojaner, virus, virusscan, website, websites, win |
Linear-Darstellung
